# Flog Txt Version 1 # Analyzer Version: 2023.3.1 # Analyzer Build Date: Jul 17 2023 06:23:22 # Log Creation Date: 19.09.2023 15:11:33.451 Process: id = "1" image_name = "excel.exe" filename = "c:\\program files\\microsoft office\\office16\\excel.exe" page_root = "0x45e09000" os_pid = "0x1380" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x7e8" cmd_line = "\"C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE\"" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 262 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 263 start_va = 0x6c812a0000 end_va = 0x6c8139ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c812a0000" filename = "" Region: id = 264 start_va = 0x6c81400000 end_va = 0x6c815fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c81400000" filename = "" Region: id = 265 start_va = 0x6c81600000 end_va = 0x6c816fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c81600000" filename = "" Region: id = 266 start_va = 0x6c81700000 end_va = 0x6c817fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c81700000" filename = "" Region: id = 267 start_va = 0x6c81800000 end_va = 0x6c818fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c81800000" filename = "" Region: id = 268 start_va = 0x6c81900000 end_va = 0x6c819fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c81900000" filename = "" Region: id = 269 start_va = 0x6c81a00000 end_va = 0x6c81afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c81a00000" filename = "" Region: id = 270 start_va = 0x6c81b00000 end_va = 0x6c81bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c81b00000" filename = "" Region: id = 271 start_va = 0x6c81c00000 end_va = 0x6c81cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c81c00000" filename = "" Region: id = 272 start_va = 0x6c81d00000 end_va = 0x6c81dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c81d00000" filename = "" Region: id = 273 start_va = 0x6c81e00000 end_va = 0x6c81efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c81e00000" filename = "" Region: id = 274 start_va = 0x6c82000000 end_va = 0x6c820fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c82000000" filename = "" Region: id = 275 start_va = 0x6c82100000 end_va = 0x6c821fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c82100000" filename = "" Region: id = 276 start_va = 0x6c82200000 end_va = 0x6c822fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c82200000" filename = "" Region: id = 277 start_va = 0x6c82400000 end_va = 0x6c824fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c82400000" filename = "" Region: id = 278 start_va = 0x6c82500000 end_va = 0x6c825fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c82500000" filename = "" Region: id = 279 start_va = 0x6c82600000 end_va = 0x6c826fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c82600000" filename = "" Region: id = 280 start_va = 0x6c82700000 end_va = 0x6c827fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c82700000" filename = "" Region: id = 281 start_va = 0x6c82800000 end_va = 0x6c828fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c82800000" filename = "" Region: id = 282 start_va = 0x6c82900000 end_va = 0x6c829fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c82900000" filename = "" Region: id = 283 start_va = 0x6c82a00000 end_va = 0x6c82afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c82a00000" filename = "" Region: id = 284 start_va = 0x6c82b00000 end_va = 0x6c82bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c82b00000" filename = "" Region: id = 285 start_va = 0x6c82c00000 end_va = 0x6c82cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c82c00000" filename = "" Region: id = 286 start_va = 0x6c82d00000 end_va = 0x6c82dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c82d00000" filename = "" Region: id = 287 start_va = 0x6c82e00000 end_va = 0x6c82efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c82e00000" filename = "" Region: id = 288 start_va = 0x6c82f00000 end_va = 0x6c82ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c82f00000" filename = "" Region: id = 289 start_va = 0x6c83000000 end_va = 0x6c830fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c83000000" filename = "" Region: id = 290 start_va = 0x6c83200000 end_va = 0x6c832fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c83200000" filename = "" Region: id = 291 start_va = 0x6c83300000 end_va = 0x6c833fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c83300000" filename = "" Region: id = 292 start_va = 0x18480000000 end_va = 0x18481041fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "xlintl32.dll" filename = "\\Program Files\\Microsoft Office\\Office16\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\1033\\xlintl32.dll") Region: id = 293 start_va = 0x18481050000 end_va = 0x18481386fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 294 start_va = 0x18481390000 end_va = 0x18481391fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018481390000" filename = "" Region: id = 295 start_va = 0x184813a0000 end_va = 0x184813a3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 296 start_va = 0x184813b0000 end_va = 0x184813b3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 297 start_va = 0x184813c0000 end_va = 0x184813c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184813c0000" filename = "" Region: id = 298 start_va = 0x184813d0000 end_va = 0x184813d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184813d0000" filename = "" Region: id = 299 start_va = 0x184813e0000 end_va = 0x184813e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184813e0000" filename = "" Region: id = 300 start_va = 0x184813f0000 end_va = 0x184813f8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184813f0000" filename = "" Region: id = 301 start_va = 0x18481400000 end_va = 0x184817fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018481400000" filename = "" Region: id = 302 start_va = 0x18481800000 end_va = 0x18481801fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018481800000" filename = "" Region: id = 303 start_va = 0x18481810000 end_va = 0x18481810fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018481810000" filename = "" Region: id = 304 start_va = 0x18481820000 end_va = 0x18481868fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 305 start_va = 0x18481870000 end_va = 0x18481870fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018481870000" filename = "" Region: id = 306 start_va = 0x18481880000 end_va = 0x18481880fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018481880000" filename = "" Region: id = 307 start_va = 0x18481890000 end_va = 0x18481890fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018481890000" filename = "" Region: id = 308 start_va = 0x184818a0000 end_va = 0x184818a4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184818a0000" filename = "" Region: id = 309 start_va = 0x184818b0000 end_va = 0x184820affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184818b0000" filename = "" Region: id = 310 start_va = 0x184820b0000 end_va = 0x184820b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184820b0000" filename = "" Region: id = 311 start_va = 0x184820c0000 end_va = 0x184820c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184820c0000" filename = "" Region: id = 312 start_va = 0x184820d0000 end_va = 0x184821cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184820d0000" filename = "" Region: id = 313 start_va = 0x184821d0000 end_va = 0x1848320ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 314 start_va = 0x18483210000 end_va = 0x18483210fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018483210000" filename = "" Region: id = 315 start_va = 0x18483220000 end_va = 0x18483220fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483220000" filename = "" Region: id = 316 start_va = 0x18483230000 end_va = 0x18483230fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483230000" filename = "" Region: id = 317 start_va = 0x18483240000 end_va = 0x1848343ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483240000" filename = "" Region: id = 318 start_va = 0x18483440000 end_va = 0x18483440fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483440000" filename = "" Region: id = 319 start_va = 0x18483450000 end_va = 0x1848354ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483450000" filename = "" Region: id = 320 start_va = 0x18483550000 end_va = 0x18483554fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 321 start_va = 0x18483560000 end_va = 0x18483560fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483560000" filename = "" Region: id = 322 start_va = 0x18483570000 end_va = 0x18483570fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483570000" filename = "" Region: id = 323 start_va = 0x18483580000 end_va = 0x18483580fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483580000" filename = "" Region: id = 324 start_va = 0x18483590000 end_va = 0x1848366bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoeuib.ttf" filename = "\\Windows\\Fonts\\segoeuib.ttf" (normalized: "c:\\windows\\fonts\\segoeuib.ttf") Region: id = 325 start_va = 0x18483670000 end_va = 0x18483671fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018483670000" filename = "" Region: id = 326 start_va = 0x18483680000 end_va = 0x18483b71fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018483680000" filename = "" Region: id = 327 start_va = 0x18483b80000 end_va = 0x18484b7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 328 start_va = 0x18484b80000 end_va = 0x1848537ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-s-1-5-21-1560258661-3990802383-1811730007-1000.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-S-1-5-21-1560258661-3990802383-1811730007-1000.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-s-1-5-21-1560258661-3990802383-1811730007-1000.dat") Region: id = 329 start_va = 0x18485380000 end_va = 0x1848545efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 330 start_va = 0x18485460000 end_va = 0x1848585ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018485460000" filename = "" Region: id = 331 start_va = 0x18485860000 end_va = 0x184858a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "d2d1.dll.mui" filename = "\\Windows\\System32\\en-US\\d2d1.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\d2d1.dll.mui") Region: id = 332 start_va = 0x184858b0000 end_va = 0x184858d3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184858b0000" filename = "" Region: id = 333 start_va = 0x184858e0000 end_va = 0x184858e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mpr.dll.mui" filename = "\\Windows\\System32\\en-US\\mpr.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mpr.dll.mui") Region: id = 334 start_va = 0x184858f0000 end_va = 0x184858f7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windows.storage.dll.mui" filename = "\\Windows\\System32\\en-US\\windows.storage.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.storage.dll.mui") Region: id = 335 start_va = 0x18485900000 end_va = 0x18485901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018485900000" filename = "" Region: id = 336 start_va = 0x18485910000 end_va = 0x18485913fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 337 start_va = 0x18485920000 end_va = 0x18485923fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 338 start_va = 0x18485930000 end_va = 0x18485930fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{376d4583-7d39-4b0c-a26b-8169803ad7c6}.2.ver0x0000000000000003.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{376D4583-7D39-4B0C-A26B-8169803AD7C6}.2.ver0x0000000000000003.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{376d4583-7d39-4b0c-a26b-8169803ad7c6}.2.ver0x0000000000000003.db") Region: id = 339 start_va = 0x184859e0000 end_va = 0x184859e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184859e0000" filename = "" Region: id = 340 start_va = 0x184859f0000 end_va = 0x184861effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184859f0000" filename = "" Region: id = 341 start_va = 0x184861f0000 end_va = 0x184862c3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoeuil.ttf" filename = "\\Windows\\Fonts\\segoeuil.ttf" (normalized: "c:\\windows\\fonts\\segoeuil.ttf") Region: id = 342 start_va = 0x184862d0000 end_va = 0x184863b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "seguisb.ttf" filename = "\\Windows\\Fonts\\seguisb.ttf" (normalized: "c:\\windows\\fonts\\seguisb.ttf") Region: id = 343 start_va = 0x184863c0000 end_va = 0x184863cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184863c0000" filename = "" Region: id = 344 start_va = 0x184863d0000 end_va = 0x184863dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184863d0000" filename = "" Region: id = 345 start_va = 0x184863e0000 end_va = 0x184863effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184863e0000" filename = "" Region: id = 346 start_va = 0x184863f0000 end_va = 0x184867f5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184863f0000" filename = "" Region: id = 347 start_va = 0x18486800000 end_va = 0x18486c09fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018486800000" filename = "" Region: id = 348 start_va = 0x18486c10000 end_va = 0x18487015fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018486c10000" filename = "" Region: id = 349 start_va = 0x18487020000 end_va = 0x1848709ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487020000" filename = "" Region: id = 350 start_va = 0x184870a0000 end_va = 0x1848729ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184870a0000" filename = "" Region: id = 351 start_va = 0x184872a0000 end_va = 0x184872b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1255.nls" filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls") Region: id = 352 start_va = 0x184872c0000 end_va = 0x184872d4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db") Region: id = 353 start_va = 0x184872e0000 end_va = 0x184872ebfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184872e0000" filename = "" Region: id = 354 start_va = 0x184872f0000 end_va = 0x184877acfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184872f0000" filename = "" Region: id = 355 start_va = 0x184877b0000 end_va = 0x18487c6cfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184877b0000" filename = "" Region: id = 356 start_va = 0x18487c70000 end_va = 0x18487c81fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "normidna.nls" filename = "\\Windows\\System32\\normidna.nls" (normalized: "c:\\windows\\system32\\normidna.nls") Region: id = 357 start_va = 0x18487c90000 end_va = 0x18487cf0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "shell32.dll.mui" filename = "\\Windows\\System32\\en-US\\shell32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\shell32.dll.mui") Region: id = 358 start_va = 0x18487d00000 end_va = 0x18487d47fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487d00000" filename = "" Region: id = 359 start_va = 0x18487d50000 end_va = 0x18487d94fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000010.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000010.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000010.db") Region: id = 360 start_va = 0x18487da0000 end_va = 0x18487e2dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 361 start_va = 0x18487e30000 end_va = 0x18487e40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 362 start_va = 0x18487e50000 end_va = 0x18487e6efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487e50000" filename = "" Region: id = 363 start_va = 0x18487e70000 end_va = 0x18487e71fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487e70000" filename = "" Region: id = 364 start_va = 0x18487e80000 end_va = 0x18487e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487e80000" filename = "" Region: id = 365 start_va = 0x18487e90000 end_va = 0x18487e9bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487e90000" filename = "" Region: id = 366 start_va = 0x18487ea0000 end_va = 0x18487ea0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487ea0000" filename = "" Region: id = 367 start_va = 0x18487eb0000 end_va = 0x18487ebcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "comdlg32.dll.mui" filename = "\\Windows\\System32\\en-US\\comdlg32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\comdlg32.dll.mui") Region: id = 368 start_va = 0x18487ec0000 end_va = 0x18487ec1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487ec0000" filename = "" Region: id = 369 start_va = 0x18487ed0000 end_va = 0x18487eeefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487ed0000" filename = "" Region: id = 370 start_va = 0x18487ef0000 end_va = 0x18487ef1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487ef0000" filename = "" Region: id = 371 start_va = 0x18487f00000 end_va = 0x18487f06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "explorerframe.dll.mui" filename = "\\Windows\\System32\\en-US\\explorerframe.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\explorerframe.dll.mui") Region: id = 372 start_va = 0x18487f10000 end_va = 0x18487f13fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487f10000" filename = "" Region: id = 373 start_va = 0x18487f20000 end_va = 0x18487f23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487f20000" filename = "" Region: id = 374 start_va = 0x18487f30000 end_va = 0x18487f33fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487f30000" filename = "" Region: id = 375 start_va = 0x18487f40000 end_va = 0x18487f42fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487f40000" filename = "" Region: id = 376 start_va = 0x18487f50000 end_va = 0x18487f51fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487f50000" filename = "" Region: id = 377 start_va = 0x18487f60000 end_va = 0x18487f60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487f60000" filename = "" Region: id = 378 start_va = 0x18487f70000 end_va = 0x18487f70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487f70000" filename = "" Region: id = 379 start_va = 0x18487f80000 end_va = 0x18487f80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487f80000" filename = "" Region: id = 380 start_va = 0x18487f90000 end_va = 0x18487f90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487f90000" filename = "" Region: id = 381 start_va = 0x18487fa0000 end_va = 0x18487fa1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 382 start_va = 0x18487fb0000 end_va = 0x18487fb1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487fb0000" filename = "" Region: id = 383 start_va = 0x18487fc0000 end_va = 0x18487fd1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487fc0000" filename = "" Region: id = 384 start_va = 0x18487fe0000 end_va = 0x184880dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487fe0000" filename = "" Region: id = 385 start_va = 0x184880e0000 end_va = 0x184881b5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184880e0000" filename = "" Region: id = 386 start_va = 0x184881c0000 end_va = 0x18488295fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184881c0000" filename = "" Region: id = 387 start_va = 0x184882a0000 end_va = 0x184882a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184882a0000" filename = "" Region: id = 388 start_va = 0x184882b0000 end_va = 0x184882b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184882b0000" filename = "" Region: id = 389 start_va = 0x184882c0000 end_va = 0x184882c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184882c0000" filename = "" Region: id = 390 start_va = 0x184882d0000 end_va = 0x184882d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184882d0000" filename = "" Region: id = 391 start_va = 0x184882e0000 end_va = 0x18488315fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184882e0000" filename = "" Region: id = 392 start_va = 0x18488320000 end_va = 0x18488355fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018488320000" filename = "" Region: id = 393 start_va = 0x18488360000 end_va = 0x18488360fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488360000" filename = "" Region: id = 394 start_va = 0x18488370000 end_va = 0x18488370fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488370000" filename = "" Region: id = 395 start_va = 0x18488380000 end_va = 0x18488381fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488380000" filename = "" Region: id = 396 start_va = 0x18488390000 end_va = 0x18488393fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488390000" filename = "" Region: id = 397 start_va = 0x184883a0000 end_va = 0x184883a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184883a0000" filename = "" Region: id = 398 start_va = 0x184883d0000 end_va = 0x184883dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184883d0000" filename = "" Region: id = 399 start_va = 0x18488420000 end_va = 0x1848842ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488420000" filename = "" Region: id = 400 start_va = 0x18488430000 end_va = 0x1848890dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018488430000" filename = "" Region: id = 401 start_va = 0x18488910000 end_va = 0x184889effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 402 start_va = 0x18488a60000 end_va = 0x18488a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488a60000" filename = "" Region: id = 403 start_va = 0x18488a70000 end_va = 0x18489a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488a70000" filename = "" Region: id = 404 start_va = 0x18489a40000 end_va = 0x18489dc6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018489a40000" filename = "" Region: id = 405 start_va = 0x18489dd0000 end_va = 0x1848a156fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018489dd0000" filename = "" Region: id = 406 start_va = 0x1848a160000 end_va = 0x1848a25ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_16.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_16.db") Region: id = 407 start_va = 0x1848a360000 end_va = 0x1848a45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a360000" filename = "" Region: id = 408 start_va = 0x1848a460000 end_va = 0x1848a65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a460000" filename = "" Region: id = 409 start_va = 0x1848a660000 end_va = 0x1848a85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a660000" filename = "" Region: id = 410 start_va = 0x1848a860000 end_va = 0x1848a9b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001848a860000" filename = "" Region: id = 411 start_va = 0x184f8320000 end_va = 0x184f832ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184f8320000" filename = "" Region: id = 412 start_va = 0x184f8330000 end_va = 0x184f8336fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184f8330000" filename = "" Region: id = 413 start_va = 0x184f8340000 end_va = 0x184f8354fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184f8340000" filename = "" Region: id = 414 start_va = 0x184f8360000 end_va = 0x184f8363fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184f8360000" filename = "" Region: id = 415 start_va = 0x184f8370000 end_va = 0x184f8370fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184f8370000" filename = "" Region: id = 416 start_va = 0x184f8380000 end_va = 0x184f8381fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184f8380000" filename = "" Region: id = 417 start_va = 0x184f8390000 end_va = 0x184f844dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 418 start_va = 0x184f8450000 end_va = 0x184f8451fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184f8450000" filename = "" Region: id = 419 start_va = 0x184f8460000 end_va = 0x184f8466fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184f8460000" filename = "" Region: id = 420 start_va = 0x184f8470000 end_va = 0x184f8470fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184f8470000" filename = "" Region: id = 421 start_va = 0x184f8480000 end_va = 0x184f8480fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184f8480000" filename = "" Region: id = 422 start_va = 0x184f8490000 end_va = 0x184f8490fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184f8490000" filename = "" Region: id = 423 start_va = 0x184f84a0000 end_va = 0x184f84a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184f84a0000" filename = "" Region: id = 424 start_va = 0x184f84b0000 end_va = 0x184f84b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184f84b0000" filename = "" Region: id = 425 start_va = 0x184f84c0000 end_va = 0x184f84cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184f84c0000" filename = "" Region: id = 426 start_va = 0x184f84d0000 end_va = 0x184f84d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184f84d0000" filename = "" Region: id = 427 start_va = 0x184f84e0000 end_va = 0x184f84e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184f84e0000" filename = "" Region: id = 428 start_va = 0x184f84f0000 end_va = 0x184f84f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184f84f0000" filename = "" Region: id = 429 start_va = 0x184f8500000 end_va = 0x184f850ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184f8500000" filename = "" Region: id = 430 start_va = 0x184f8510000 end_va = 0x184f8511fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184f8510000" filename = "" Region: id = 431 start_va = 0x184f8520000 end_va = 0x184f8521fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184f8520000" filename = "" Region: id = 432 start_va = 0x184f8530000 end_va = 0x184f8530fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184f8530000" filename = "" Region: id = 433 start_va = 0x184f8540000 end_va = 0x184f863ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184f8540000" filename = "" Region: id = 434 start_va = 0x184f8640000 end_va = 0x184f87c7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184f8640000" filename = "" Region: id = 435 start_va = 0x184f87d0000 end_va = 0x184f8950fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184f87d0000" filename = "" Region: id = 436 start_va = 0x184f8960000 end_va = 0x184f9d5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184f8960000" filename = "" Region: id = 437 start_va = 0x184f9d60000 end_va = 0x184f9d61fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184f9d60000" filename = "" Region: id = 438 start_va = 0x184f9d70000 end_va = 0x184f9d9dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184f9d70000" filename = "" Region: id = 439 start_va = 0x184f9da0000 end_va = 0x184f9da0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184f9da0000" filename = "" Region: id = 440 start_va = 0x184f9db0000 end_va = 0x184f9db0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184f9db0000" filename = "" Region: id = 441 start_va = 0x184f9dc0000 end_va = 0x184f9e7bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184f9dc0000" filename = "" Region: id = 442 start_va = 0x184f9e80000 end_va = 0x184f9e83fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184f9e80000" filename = "" Region: id = 443 start_va = 0x184f9e90000 end_va = 0x184f9e96fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184f9e90000" filename = "" Region: id = 444 start_va = 0x184f9ea0000 end_va = 0x184f9ea0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184f9ea0000" filename = "" Region: id = 445 start_va = 0x184f9eb0000 end_va = 0x184f9eb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184f9eb0000" filename = "" Region: id = 446 start_va = 0x184f9ec0000 end_va = 0x184f9ec1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184f9ec0000" filename = "" Region: id = 447 start_va = 0x184f9ed0000 end_va = 0x184f9ed0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184f9ed0000" filename = "" Region: id = 448 start_va = 0x184f9ee0000 end_va = 0x184f9eeefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msointl30.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\1033\\msointl30.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\1033\\msointl30.dll") Region: id = 449 start_va = 0x184f9ef0000 end_va = 0x184f9ef6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184f9ef0000" filename = "" Region: id = 450 start_va = 0x184f9f00000 end_va = 0x184f9f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184f9f00000" filename = "" Region: id = 451 start_va = 0x184f9f20000 end_va = 0x184fa0d8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 452 start_va = 0x184fa0e0000 end_va = 0x184fa1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184fa0e0000" filename = "" Region: id = 453 start_va = 0x184fa280000 end_va = 0x184fa28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184fa280000" filename = "" Region: id = 454 start_va = 0x184fa290000 end_va = 0x184fa597fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mso40uires.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\MSO40UIRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\mso40uires.dll") Region: id = 455 start_va = 0x184fa5a0000 end_va = 0x184faec0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mso99lres.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\MSO99LRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\mso99lres.dll") Region: id = 456 start_va = 0x184faed0000 end_va = 0x184ffd0efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msores.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\msores.dll") Region: id = 457 start_va = 0x184ffd10000 end_va = 0x184ffe8afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msointl.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\1033\\msointl.dll") Region: id = 458 start_va = 0x184ffeb0000 end_va = 0x184ffebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184ffeb0000" filename = "" Region: id = 459 start_va = 0x184fffb0000 end_va = 0x184fffbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184fffb0000" filename = "" Region: id = 460 start_va = 0x7ff661e80000 end_va = 0x7ff661e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff661e80000" filename = "" Region: id = 461 start_va = 0x7ff661e90000 end_va = 0x7ff661e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff661e90000" filename = "" Region: id = 462 start_va = 0x7ff661ea0000 end_va = 0x7ff661f9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff661ea0000" filename = "" Region: id = 463 start_va = 0x7ff661fa0000 end_va = 0x7ff661fc2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff661fa0000" filename = "" Region: id = 464 start_va = 0x7ff6621f0000 end_va = 0x7ff6642d0fff monitored = 0 entry_point = 0x7ff6621f3830 region_type = mapped_file name = "excel.exe" filename = "\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\excel.exe") Region: id = 465 start_va = 0x7ffa3abf0000 end_va = 0x7ffa3abfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffa3abf0000" filename = "" Region: id = 466 start_va = 0x7ffa59700000 end_va = 0x7ffa59725fff monitored = 0 entry_point = 0x7ffa5970cbc0 region_type = mapped_file name = "ehstorapi.dll" filename = "\\Windows\\System32\\EhStorAPI.dll" (normalized: "c:\\windows\\system32\\ehstorapi.dll") Region: id = 467 start_va = 0x7ffa59730000 end_va = 0x7ffa59932fff monitored = 0 entry_point = 0x7ffa59731660 region_type = mapped_file name = "wpdshext.dll" filename = "\\Windows\\System32\\wpdshext.dll" (normalized: "c:\\windows\\system32\\wpdshext.dll") Region: id = 468 start_va = 0x7ffa59940000 end_va = 0x7ffa5995efff monitored = 0 entry_point = 0x7ffa599554a0 region_type = mapped_file name = "devdispitemprovider.dll" filename = "\\Windows\\System32\\DevDispItemProvider.dll" (normalized: "c:\\windows\\system32\\devdispitemprovider.dll") Region: id = 469 start_va = 0x7ffa59960000 end_va = 0x7ffa599d3fff monitored = 0 entry_point = 0x7ffa599a96e0 region_type = mapped_file name = "playtodevice.dll" filename = "\\Windows\\System32\\PlayToDevice.dll" (normalized: "c:\\windows\\system32\\playtodevice.dll") Region: id = 470 start_va = 0x7ffa599e0000 end_va = 0x7ffa59b92fff monitored = 0 entry_point = 0x7ffa59a49be0 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 471 start_va = 0x7ffa59ba0000 end_va = 0x7ffa59c42fff monitored = 0 entry_point = 0x7ffa59bb6140 region_type = mapped_file name = "tiptsf.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll") Region: id = 472 start_va = 0x7ffa59c50000 end_va = 0x7ffa59ea1fff monitored = 0 entry_point = 0x7ffa59c9766c region_type = mapped_file name = "wxpnse.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\WXPNSE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\wxpnse.dll") Region: id = 473 start_va = 0x7ffa59eb0000 end_va = 0x7ffa59f59fff monitored = 0 entry_point = 0x7ffa59eb93e0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_396e892957c7fb25\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_396e892957c7fb25\\comctl32.dll") Region: id = 474 start_va = 0x7ffa59f60000 end_va = 0x7ffa5aa58fff monitored = 0 entry_point = 0x7ffa5a017a3c region_type = mapped_file name = "chart.dll" filename = "\\Program Files\\Microsoft Office\\Office16\\CHART.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\chart.dll") Region: id = 475 start_va = 0x7ffa5aa60000 end_va = 0x7ffa5ac82fff monitored = 0 entry_point = 0x7ffa5aa62bf0 region_type = mapped_file name = "riched20.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\riched20.dll") Region: id = 476 start_va = 0x7ffa5ac90000 end_va = 0x7ffa5bf6bfff monitored = 0 entry_point = 0x7ffa5ac9caf0 region_type = mapped_file name = "mso.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\mso.dll") Region: id = 477 start_va = 0x7ffa5bf70000 end_va = 0x7ffa5c73bfff monitored = 0 entry_point = 0x7ffa5c005f94 region_type = mapped_file name = "mso99lwin32client.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Mso99Lwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\mso99lwin32client.dll") Region: id = 478 start_va = 0x7ffa5c740000 end_va = 0x7ffa5d02afff monitored = 0 entry_point = 0x7ffa5c845a48 region_type = mapped_file name = "mso40uiwin32client.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Mso40UIwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\mso40uiwin32client.dll") Region: id = 479 start_va = 0x7ffa5d030000 end_va = 0x7ffa5d4a7fff monitored = 0 entry_point = 0x7ffa5d0a9154 region_type = mapped_file name = "mso30win32client.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\mso30win32client.dll") Region: id = 480 start_va = 0x7ffa5d4b0000 end_va = 0x7ffa5d7b3fff monitored = 0 entry_point = 0x7ffa5d556094 region_type = mapped_file name = "mso20win32client.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\mso20win32client.dll") Region: id = 481 start_va = 0x7ffa5d7c0000 end_va = 0x7ffa5e92bfff monitored = 0 entry_point = 0x7ffa5d7c53f0 region_type = mapped_file name = "oart.dll" filename = "\\Program Files\\Microsoft Office\\Office16\\OART.DLL" (normalized: "c:\\program files\\microsoft office\\office16\\oart.dll") Region: id = 482 start_va = 0x7ffa5ed90000 end_va = 0x7ffa5ee0efff monitored = 0 entry_point = 0x7ffa5ed917d0 region_type = mapped_file name = "dlnashext.dll" filename = "\\Windows\\System32\\dlnashext.dll" (normalized: "c:\\windows\\system32\\dlnashext.dll") Region: id = 483 start_va = 0x7ffa5ee10000 end_va = 0x7ffa5eeacfff monitored = 0 entry_point = 0x7ffa5ee11010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 484 start_va = 0x7ffa5eeb0000 end_va = 0x7ffa5ef17fff monitored = 0 entry_point = 0x7ffa5eeb4970 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 485 start_va = 0x7ffa5ef20000 end_va = 0x7ffa5ef81fff monitored = 0 entry_point = 0x7ffa5ef21a50 region_type = mapped_file name = "d3d10_1core.dll" filename = "\\Windows\\System32\\d3d10_1core.dll" (normalized: "c:\\windows\\system32\\d3d10_1core.dll") Region: id = 486 start_va = 0x7ffa5ef90000 end_va = 0x7ffa5efc1fff monitored = 0 entry_point = 0x7ffa5efb11c0 region_type = mapped_file name = "d3d10_1.dll" filename = "\\Windows\\System32\\d3d10_1.dll" (normalized: "c:\\windows\\system32\\d3d10_1.dll") Region: id = 487 start_va = 0x7ffa637b0000 end_va = 0x7ffa637c7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 488 start_va = 0x7ffa643a0000 end_va = 0x7ffa64423fff monitored = 0 entry_point = 0x7ffa643b2830 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 489 start_va = 0x7ffa65510000 end_va = 0x7ffa655a7fff monitored = 0 entry_point = 0x7ffa65533980 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 490 start_va = 0x7ffa65b30000 end_va = 0x7ffa65bfbfff monitored = 0 entry_point = 0x7ffa65b6e390 region_type = mapped_file name = "windows.storage.search.dll" filename = "\\Windows\\System32\\Windows.Storage.Search.dll" (normalized: "c:\\windows\\system32\\windows.storage.search.dll") Region: id = 491 start_va = 0x7ffa65c00000 end_va = 0x7ffa65ca9fff monitored = 0 entry_point = 0x7ffa65c37c30 region_type = mapped_file name = "structuredquery.dll" filename = "\\Windows\\System32\\StructuredQuery.dll" (normalized: "c:\\windows\\system32\\structuredquery.dll") Region: id = 492 start_va = 0x7ffa664f0000 end_va = 0x7ffa664f8fff monitored = 0 entry_point = 0x7ffa664f1b60 region_type = mapped_file name = "iconcodecservice.dll" filename = "\\Windows\\System32\\IconCodecService.dll" (normalized: "c:\\windows\\system32\\iconcodecservice.dll") Region: id = 493 start_va = 0x7ffa68db0000 end_va = 0x7ffa68dedfff monitored = 0 entry_point = 0x7ffa68db9650 region_type = mapped_file name = "mlang.dll" filename = "\\Windows\\System32\\mlang.dll" (normalized: "c:\\windows\\system32\\mlang.dll") Region: id = 494 start_va = 0x7ffa691f0000 end_va = 0x7ffa69528fff monitored = 0 entry_point = 0x7ffa692beb30 region_type = mapped_file name = "msftedit.dll" filename = "\\Windows\\System32\\msftedit.dll" (normalized: "c:\\windows\\system32\\msftedit.dll") Region: id = 495 start_va = 0x7ffa6bdb0000 end_va = 0x7ffa6bde6fff monitored = 0 entry_point = 0x7ffa6bdb20a0 region_type = mapped_file name = "ehstorshell.dll" filename = "\\Windows\\System32\\EhStorShell.dll" (normalized: "c:\\windows\\system32\\ehstorshell.dll") Region: id = 496 start_va = 0x7ffa6bdf0000 end_va = 0x7ffa6c129fff monitored = 0 entry_point = 0x7ffa6bdf8520 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 497 start_va = 0x7ffa6c130000 end_va = 0x7ffa6c13bfff monitored = 0 entry_point = 0x7ffa6c134150 region_type = mapped_file name = "vcruntime140_1.dll" filename = "\\Windows\\System32\\vcruntime140_1.dll" (normalized: "c:\\windows\\system32\\vcruntime140_1.dll") Region: id = 498 start_va = 0x7ffa6c140000 end_va = 0x7ffa6c1d0fff monitored = 0 entry_point = 0x7ffa6c192430 region_type = mapped_file name = "msvcp140.dll" filename = "\\Windows\\System32\\msvcp140.dll" (normalized: "c:\\windows\\system32\\msvcp140.dll") Region: id = 499 start_va = 0x7ffa6c1e0000 end_va = 0x7ffa6c1f8fff monitored = 0 entry_point = 0x7ffa6c1eee50 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Windows\\System32\\vcruntime140.dll" (normalized: "c:\\windows\\system32\\vcruntime140.dll") Region: id = 500 start_va = 0x7ffa6c420000 end_va = 0x7ffa6c42cfff monitored = 0 entry_point = 0x7ffa6c421ea0 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll") Region: id = 501 start_va = 0x7ffa6c430000 end_va = 0x7ffa6c47cfff monitored = 0 entry_point = 0x7ffa6c447de0 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 502 start_va = 0x7ffa6c480000 end_va = 0x7ffa6c4a5fff monitored = 0 entry_point = 0x7ffa6c481cf0 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 503 start_va = 0x7ffa6c4b0000 end_va = 0x7ffa6c58afff monitored = 0 entry_point = 0x7ffa6c4c28b0 region_type = mapped_file name = "ntshrui.dll" filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll") Region: id = 504 start_va = 0x7ffa6d190000 end_va = 0x7ffa6d1dffff monitored = 0 entry_point = 0x7ffa6d192580 region_type = mapped_file name = "edputil.dll" filename = "\\Windows\\System32\\edputil.dll" (normalized: "c:\\windows\\system32\\edputil.dll") Region: id = 505 start_va = 0x7ffa6d1e0000 end_va = 0x7ffa6d67ffff monitored = 0 entry_point = 0x7ffa6d278740 region_type = mapped_file name = "explorerframe.dll" filename = "\\Windows\\System32\\ExplorerFrame.dll" (normalized: "c:\\windows\\system32\\explorerframe.dll") Region: id = 506 start_va = 0x7ffa6d680000 end_va = 0x7ffa6d6c9fff monitored = 0 entry_point = 0x7ffa6d685800 region_type = mapped_file name = "dataexchange.dll" filename = "\\Windows\\System32\\DataExchange.dll" (normalized: "c:\\windows\\system32\\dataexchange.dll") Region: id = 507 start_va = 0x7ffa6d880000 end_va = 0x7ffa6daf3fff monitored = 0 entry_point = 0x7ffa6d8f0400 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll") Region: id = 508 start_va = 0x7ffa6de30000 end_va = 0x7ffa6de3ffff monitored = 0 entry_point = 0x7ffa6de378e0 region_type = mapped_file name = "atlthunk.dll" filename = "\\Windows\\System32\\atlthunk.dll" (normalized: "c:\\windows\\system32\\atlthunk.dll") Region: id = 509 start_va = 0x7ffa6df40000 end_va = 0x7ffa6df4bfff monitored = 0 entry_point = 0x7ffa6df435c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 510 start_va = 0x7ffa6e250000 end_va = 0x7ffa6e300fff monitored = 0 entry_point = 0x7ffa6e2608f0 region_type = mapped_file name = "twinapi.dll" filename = "\\Windows\\System32\\twinapi.dll" (normalized: "c:\\windows\\system32\\twinapi.dll") Region: id = 511 start_va = 0x7ffa6e410000 end_va = 0x7ffa6e44ffff monitored = 0 entry_point = 0x7ffa6e426c60 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 512 start_va = 0x7ffa708c0000 end_va = 0x7ffa708d1fff monitored = 0 entry_point = 0x7ffa708c3580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 513 start_va = 0x7ffa708f0000 end_va = 0x7ffa708fbfff monitored = 0 entry_point = 0x7ffa708f1860 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\System32\\davhlpr.dll" (normalized: "c:\\windows\\system32\\davhlpr.dll") Region: id = 514 start_va = 0x7ffa70900000 end_va = 0x7ffa7091ffff monitored = 0 entry_point = 0x7ffa70901920 region_type = mapped_file name = "davclnt.dll" filename = "\\Windows\\System32\\davclnt.dll" (normalized: "c:\\windows\\system32\\davclnt.dll") Region: id = 515 start_va = 0x7ffa70920000 end_va = 0x7ffa70935fff monitored = 0 entry_point = 0x7ffa70923380 region_type = mapped_file name = "ntlanman.dll" filename = "\\Windows\\System32\\ntlanman.dll" (normalized: "c:\\windows\\system32\\ntlanman.dll") Region: id = 516 start_va = 0x7ffa70940000 end_va = 0x7ffa7094afff monitored = 0 entry_point = 0x7ffa70941a40 region_type = mapped_file name = "drprov.dll" filename = "\\Windows\\System32\\drprov.dll" (normalized: "c:\\windows\\system32\\drprov.dll") Region: id = 517 start_va = 0x7ffa70950000 end_va = 0x7ffa7096afff monitored = 0 entry_point = 0x7ffa70951040 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 518 start_va = 0x7ffa70ae0000 end_va = 0x7ffa70aedfff monitored = 0 entry_point = 0x7ffa70ae1460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 519 start_va = 0x7ffa71790000 end_va = 0x7ffa71796fff monitored = 0 entry_point = 0x7ffa71791220 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\System32\\msimg32.dll" (normalized: "c:\\windows\\system32\\msimg32.dll") Region: id = 520 start_va = 0x7ffa71b80000 end_va = 0x7ffa71bd4fff monitored = 0 entry_point = 0x7ffa71b83fb0 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 521 start_va = 0x7ffa71e20000 end_va = 0x7ffa71e8ffff monitored = 0 entry_point = 0x7ffa71e42960 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 522 start_va = 0x7ffa71f30000 end_va = 0x7ffa71fbafff monitored = 0 entry_point = 0x7ffa71f63660 region_type = mapped_file name = "directmanipulation.dll" filename = "\\Windows\\System32\\directmanipulation.dll" (normalized: "c:\\windows\\system32\\directmanipulation.dll") Region: id = 523 start_va = 0x7ffa71fc0000 end_va = 0x7ffa72144fff monitored = 0 entry_point = 0x7ffa72006180 region_type = mapped_file name = "windows.globalization.dll" filename = "\\Windows\\System32\\Windows.Globalization.dll" (normalized: "c:\\windows\\system32\\windows.globalization.dll") Region: id = 524 start_va = 0x7ffa72150000 end_va = 0x7ffa723affff monitored = 0 entry_point = 0x7ffa721fb5b0 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 525 start_va = 0x7ffa723d0000 end_va = 0x7ffa72470fff monitored = 0 entry_point = 0x7ffa723d3db0 region_type = mapped_file name = "portabledeviceapi.dll" filename = "\\Windows\\System32\\PortableDeviceApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceapi.dll") Region: id = 526 start_va = 0x7ffa74030000 end_va = 0x7ffa741d8fff monitored = 0 entry_point = 0x7ffa74084060 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_0bdd1d3064f6384a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_0bdd1d3064f6384a\\gdiplus.dll") Region: id = 527 start_va = 0x7ffa744f0000 end_va = 0x7ffa74505fff monitored = 0 entry_point = 0x7ffa744f1b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 528 start_va = 0x7ffa747d0000 end_va = 0x7ffa74861fff monitored = 0 entry_point = 0x7ffa7481a780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 529 start_va = 0x7ffa74c90000 end_va = 0x7ffa74cb8fff monitored = 0 entry_point = 0x7ffa74c9ca00 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 530 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 531 start_va = 0x7ffa74d00000 end_va = 0x7ffa75244fff monitored = 0 entry_point = 0x7ffa74e9a450 region_type = mapped_file name = "d2d1.dll" filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll") Region: id = 532 start_va = 0x7ffa75250000 end_va = 0x7ffa754befff monitored = 0 entry_point = 0x7ffa753022b0 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 533 start_va = 0x7ffa75800000 end_va = 0x7ffa759b0fff monitored = 0 entry_point = 0x7ffa758961a0 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 534 start_va = 0x7ffa759c0000 end_va = 0x7ffa75a61fff monitored = 0 entry_point = 0x7ffa759e0a40 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 535 start_va = 0x7ffa75a70000 end_va = 0x7ffa75d17fff monitored = 0 entry_point = 0x7ffa75b03250 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 536 start_va = 0x7ffa75d20000 end_va = 0x7ffa75d41fff monitored = 0 entry_point = 0x7ffa75d21a40 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 537 start_va = 0x7ffa75e30000 end_va = 0x7ffa75f12fff monitored = 0 entry_point = 0x7ffa75e67da0 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 538 start_va = 0x7ffa76220000 end_va = 0x7ffa76298fff monitored = 0 entry_point = 0x7ffa7623fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 539 start_va = 0x7ffa763b0000 end_va = 0x7ffa763dffff monitored = 0 entry_point = 0x7ffa763c9b10 region_type = mapped_file name = "globinputhost.dll" filename = "\\Windows\\System32\\globinputhost.dll" (normalized: "c:\\windows\\system32\\globinputhost.dll") Region: id = 540 start_va = 0x7ffa76450000 end_va = 0x7ffa768e2fff monitored = 0 entry_point = 0x7ffa7645f760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 541 start_va = 0x7ffa768f0000 end_va = 0x7ffa76956fff monitored = 0 entry_point = 0x7ffa7690e710 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 542 start_va = 0x7ffa769f0000 end_va = 0x7ffa76b75fff monitored = 0 entry_point = 0x7ffa76a3d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 543 start_va = 0x7ffa76be0000 end_va = 0x7ffa76bf2fff monitored = 0 entry_point = 0x7ffa76be2760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 544 start_va = 0x7ffa76c00000 end_va = 0x7ffa76c24fff monitored = 0 entry_point = 0x7ffa76c02300 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 545 start_va = 0x7ffa76c60000 end_va = 0x7ffa76c84fff monitored = 0 entry_point = 0x7ffa76c75220 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 546 start_va = 0x7ffa76d30000 end_va = 0x7ffa76d39fff monitored = 0 entry_point = 0x7ffa76d31350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 547 start_va = 0x7ffa76e20000 end_va = 0x7ffa76eb5fff monitored = 0 entry_point = 0x7ffa76e45570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 548 start_va = 0x7ffa76ec0000 end_va = 0x7ffa76ee6fff monitored = 0 entry_point = 0x7ffa76ec7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 549 start_va = 0x7ffa77090000 end_va = 0x7ffa7718ffff monitored = 0 entry_point = 0x7ffa770d0f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 550 start_va = 0x7ffa77320000 end_va = 0x7ffa77351fff monitored = 0 entry_point = 0x7ffa77332340 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 551 start_va = 0x7ffa77640000 end_va = 0x7ffa77733fff monitored = 0 entry_point = 0x7ffa7764a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 552 start_va = 0x7ffa778b0000 end_va = 0x7ffa778bbfff monitored = 0 entry_point = 0x7ffa778b27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 553 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 554 start_va = 0x7ffa782b0000 end_va = 0x7ffa78305fff monitored = 0 entry_point = 0x7ffa782c0bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 555 start_va = 0x7ffa78330000 end_va = 0x7ffa78358fff monitored = 0 entry_point = 0x7ffa78344530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 556 start_va = 0x7ffa784a0000 end_va = 0x7ffa784b3fff monitored = 0 entry_point = 0x7ffa784a52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 557 start_va = 0x7ffa784c0000 end_va = 0x7ffa784cffff monitored = 0 entry_point = 0x7ffa784c56e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 558 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 559 start_va = 0x7ffa784e0000 end_va = 0x7ffa7852afff monitored = 0 entry_point = 0x7ffa784e35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 560 start_va = 0x7ffa78530000 end_va = 0x7ffa785e4fff monitored = 0 entry_point = 0x7ffa785722e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 561 start_va = 0x7ffa785f0000 end_va = 0x7ffa78644fff monitored = 0 entry_point = 0x7ffa78607970 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 562 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 563 start_va = 0x7ffa786c0000 end_va = 0x7ffa78702fff monitored = 0 entry_point = 0x7ffa786d4b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 564 start_va = 0x7ffa78710000 end_va = 0x7ffa78726fff monitored = 0 entry_point = 0x7ffa78711390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 565 start_va = 0x7ffa78730000 end_va = 0x7ffa788f6fff monitored = 0 entry_point = 0x7ffa7878db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 566 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 567 start_va = 0x7ffa78ba0000 end_va = 0x7ffa791e3fff monitored = 0 entry_point = 0x7ffa78d664b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 568 start_va = 0x7ffa791f0000 end_va = 0x7ffa79275fff monitored = 0 entry_point = 0x7ffa791fd8f0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 569 start_va = 0x7ffa79280000 end_va = 0x7ffa7938afff monitored = 0 entry_point = 0x7ffa792a2300 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 570 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 571 start_va = 0x7ffa79430000 end_va = 0x7ffa7a98efff monitored = 0 entry_point = 0x7ffa795911f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 572 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 573 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 574 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 575 start_va = 0x7ffa7abb0000 end_va = 0x7ffa7abb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "normaliz.dll" filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll") Region: id = 576 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 577 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 578 start_va = 0x7ffa7ad80000 end_va = 0x7ffa7b1a8fff monitored = 0 entry_point = 0x7ffa7ada8740 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 579 start_va = 0x7ffa7b1b0000 end_va = 0x7ffa7b21efff monitored = 0 entry_point = 0x7ffa7b1d5f70 region_type = mapped_file name = "coml2.dll" filename = "\\Windows\\System32\\coml2.dll" (normalized: "c:\\windows\\system32\\coml2.dll") Region: id = 580 start_va = 0x7ffa7b220000 end_va = 0x7ffa7b271fff monitored = 0 entry_point = 0x7ffa7b22f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 581 start_va = 0x7ffa7b290000 end_va = 0x7ffa7b3d2fff monitored = 0 entry_point = 0x7ffa7b2b8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 582 start_va = 0x7ffa7b3e0000 end_va = 0x7ffa7b539fff monitored = 0 entry_point = 0x7ffa7b4238e0 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 583 start_va = 0x7ffa7b540000 end_va = 0x7ffa7b5aafff monitored = 0 entry_point = 0x7ffa7b5590c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 584 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 585 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 586 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 587 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 588 start_va = 0x7ffa7bdd0000 end_va = 0x7ffa7be76fff monitored = 0 entry_point = 0x7ffa7bde58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 589 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 590 start_va = 0x18485940000 end_va = 0x18485945fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "oregres.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\oregres.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\oregres.dll") Region: id = 591 start_va = 0x18485950000 end_va = 0x18485953fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "oregres.dll.mui" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\en-us\\oregres.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\en-us\\oregres.dll.mui") Region: id = 592 start_va = 0x6c83400000 end_va = 0x6c834fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c83400000" filename = "" Region: id = 593 start_va = 0x18485940000 end_va = 0x18485940fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018485940000" filename = "" Region: id = 594 start_va = 0x18485950000 end_va = 0x18485956fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018485950000" filename = "" Region: id = 595 start_va = 0x18485960000 end_va = 0x18485978fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018485960000" filename = "" Region: id = 596 start_va = 0x18485980000 end_va = 0x18485980fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018485980000" filename = "" Region: id = 597 start_va = 0x18485990000 end_va = 0x18485990fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018485990000" filename = "" Region: id = 598 start_va = 0x184859a0000 end_va = 0x184859a1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 599 start_va = 0x1848a260000 end_va = 0x1848a35ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_16.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_16.db") Region: id = 600 start_va = 0x184859b0000 end_va = 0x184859b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll.mui" filename = "\\Windows\\System32\\en-US\\imageres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\imageres.dll.mui") Region: id = 601 start_va = 0x1848a9c0000 end_va = 0x1848d5dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 602 start_va = 0x184859c0000 end_va = 0x184859c1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 603 start_va = 0x184859d0000 end_va = 0x184859d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184859d0000" filename = "" Region: id = 604 start_va = 0x7ffa6c200000 end_va = 0x7ffa6c413fff monitored = 0 entry_point = 0x7ffa6c201000 region_type = mapped_file name = "grooveex.dll" filename = "\\PROGRA~1\\MICROS~1\\Office16\\GROOVEEX.DLL" (normalized: "c:\\program files\\micros~1\\office16\\grooveex.dll") Region: id = 605 start_va = 0x1848a9c0000 end_va = 0x1848aabffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_16.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_16.db") Region: id = 606 start_va = 0x18485990000 end_va = 0x18485991fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 607 start_va = 0x184859b0000 end_va = 0x184859b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll.mui" filename = "\\Windows\\System32\\en-US\\imageres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\imageres.dll.mui") Region: id = 608 start_va = 0x184883b0000 end_va = 0x184883b1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 609 start_va = 0x1848aac0000 end_va = 0x1848abbffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_16.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_16.db") Region: id = 610 start_va = 0x1848abc0000 end_va = 0x1848d7dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 611 start_va = 0x1848d7e0000 end_va = 0x1848d8dffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_16.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_16.db") Region: id = 612 start_va = 0x1848abc0000 end_va = 0x1848ad78fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 613 start_va = 0x1848ad80000 end_va = 0x1848b5fdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "grooveintlresource.dll" filename = "\\PROGRA~1\\MICROS~1\\Office16\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\micros~1\\office16\\1033\\grooveintlresource.dll") Region: id = 614 start_va = 0x7ffa6bce0000 end_va = 0x7ffa6bda5fff monitored = 0 entry_point = 0x7ffa6bce3ac0 region_type = mapped_file name = "cscui.dll" filename = "\\Windows\\System32\\cscui.dll" (normalized: "c:\\windows\\system32\\cscui.dll") Region: id = 615 start_va = 0x184859b0000 end_va = 0x184859b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184859b0000" filename = "" Region: id = 616 start_va = 0x184883c0000 end_va = 0x184883c7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184883c0000" filename = "" Region: id = 617 start_va = 0x18485940000 end_va = 0x18485958fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018485940000" filename = "" Region: id = 618 start_va = 0x184883e0000 end_va = 0x184883f8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184883e0000" filename = "" Region: id = 619 start_va = 0x1848b600000 end_va = 0x1848b6f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "shellstyle.dll" filename = "\\Windows\\Resources\\Themes\\aero\\Shell\\NormalColor\\shellstyle.dll" (normalized: "c:\\windows\\resources\\themes\\aero\\shell\\normalcolor\\shellstyle.dll") Region: id = 620 start_va = 0x1848b600000 end_va = 0x1848b6f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "shellstyle.dll" filename = "\\Windows\\Resources\\Themes\\aero\\Shell\\NormalColor\\shellstyle.dll" (normalized: "c:\\windows\\resources\\themes\\aero\\shell\\normalcolor\\shellstyle.dll") Region: id = 621 start_va = 0x18488400000 end_va = 0x18488400fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018488400000" filename = "" Region: id = 622 start_va = 0x18485940000 end_va = 0x18485940fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018485940000" filename = "" Region: id = 623 start_va = 0x18485940000 end_va = 0x18485958fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018485940000" filename = "" Region: id = 624 start_va = 0x18485960000 end_va = 0x18485978fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018485960000" filename = "" Region: id = 625 start_va = 0x184883e0000 end_va = 0x184883f8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184883e0000" filename = "" Region: id = 626 start_va = 0x18488400000 end_va = 0x18488400fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018488400000" filename = "" Region: id = 627 start_va = 0x7ffa77e20000 end_va = 0x7ffa77e36fff monitored = 0 entry_point = 0x7ffa77e279d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 628 start_va = 0x7ffa77ab0000 end_va = 0x7ffa77ae3fff monitored = 0 entry_point = 0x7ffa77acae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 629 start_va = 0x7ffa77f40000 end_va = 0x7ffa77f4afff monitored = 0 entry_point = 0x7ffa77f419a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 630 start_va = 0x6c83500000 end_va = 0x6c835fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c83500000" filename = "" Region: id = 631 start_va = 0x7ffa6eb60000 end_va = 0x7ffa6ed17fff monitored = 0 entry_point = 0x7ffa6ebce630 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 632 start_va = 0x7ffa72950000 end_va = 0x7ffa72cd1fff monitored = 0 entry_point = 0x7ffa729a1220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 633 start_va = 0x6c83600000 end_va = 0x6c836fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c83600000" filename = "" Region: id = 634 start_va = 0x18485940000 end_va = 0x18485940fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018485940000" filename = "" Region: id = 635 start_va = 0x18485940000 end_va = 0x1848594ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018485940000" filename = "" Region: id = 636 start_va = 0x18485950000 end_va = 0x18485958fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018485950000" filename = "" Region: id = 637 start_va = 0x18485960000 end_va = 0x18485978fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018485960000" filename = "" Region: id = 638 start_va = 0x18487f10000 end_va = 0x18487f25fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487f10000" filename = "" Region: id = 639 start_va = 0x7ffa62300000 end_va = 0x7ffa62426fff monitored = 0 entry_point = 0x7ffa62302130 region_type = mapped_file name = "networkexplorer.dll" filename = "\\Windows\\System32\\networkexplorer.dll" (normalized: "c:\\windows\\system32\\networkexplorer.dll") Region: id = 640 start_va = 0x18485940000 end_va = 0x1848594ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018485940000" filename = "" Region: id = 641 start_va = 0x18485940000 end_va = 0x1848594afff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018485940000" filename = "" Region: id = 642 start_va = 0x18485950000 end_va = 0x1848595afff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018485950000" filename = "" Region: id = 643 start_va = 0x18485960000 end_va = 0x18485968fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018485960000" filename = "" Region: id = 644 start_va = 0x18485970000 end_va = 0x18485978fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018485970000" filename = "" Region: id = 645 start_va = 0x18487f10000 end_va = 0x18487f10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487f10000" filename = "" Region: id = 646 start_va = 0x18487f20000 end_va = 0x18487f20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487f20000" filename = "" Region: id = 647 start_va = 0x1848b600000 end_va = 0x1848c5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001848b600000" filename = "" Region: id = 648 start_va = 0x18487f30000 end_va = 0x18487f4dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "habilitado para macro.xlsmf78e7ad908912b162d6a79507f813d442eaa58xlsm8912b162d6a79507f813d442eaa58xlsm" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsmf78e7ad908912b162d6a79507f813d442eaa58xlsm8912b162d6a79507f813d442eaa58xlsm" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\habilitado para macro.xlsmf78e7ad908912b162d6a79507f813d442eaa58xlsm8912b162d6a79507f813d442eaa58xlsm") Region: id = 649 start_va = 0x18487f30000 end_va = 0x18487f30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487f30000" filename = "" Region: id = 650 start_va = 0x1848b600000 end_va = 0x1848c5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001848b600000" filename = "" Region: id = 651 start_va = 0x18487f60000 end_va = 0x18487f7dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "habilitado para macro.xlsmf78e7ad908912b162d6a79507f813d442eaa58xlsm8912b162d6a79507f813d442eaa58xlsm" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsmf78e7ad908912b162d6a79507f813d442eaa58xlsm8912b162d6a79507f813d442eaa58xlsm" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\habilitado para macro.xlsmf78e7ad908912b162d6a79507f813d442eaa58xlsm8912b162d6a79507f813d442eaa58xlsm") Region: id = 652 start_va = 0x1848a660000 end_va = 0x1848a80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a660000" filename = "" Region: id = 653 start_va = 0x1848a660000 end_va = 0x1848a75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a660000" filename = "" Region: id = 654 start_va = 0x1848a800000 end_va = 0x1848a80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a800000" filename = "" Region: id = 655 start_va = 0x18487f40000 end_va = 0x18487f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487f40000" filename = "" Region: id = 656 start_va = 0x18487f60000 end_va = 0x18487f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487f60000" filename = "" Region: id = 657 start_va = 0x18485990000 end_va = 0x1848599ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018485990000" filename = "" Region: id = 658 start_va = 0x7ffa78360000 end_va = 0x7ffa783f8fff monitored = 0 entry_point = 0x7ffa7838f4e0 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 659 start_va = 0x18485900000 end_va = 0x18485901fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018485900000" filename = "" Region: id = 660 start_va = 0x18485990000 end_va = 0x18485990fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018485990000" filename = "" Region: id = 661 start_va = 0x7ffa65f70000 end_va = 0x7ffa661e9fff monitored = 0 entry_point = 0x7ffa65f8a7a0 region_type = mapped_file name = "msxml6.dll" filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll") Region: id = 662 start_va = 0x18485900000 end_va = 0x1848590ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018485900000" filename = "" Region: id = 663 start_va = 0x18485990000 end_va = 0x18485990fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml6r.dll" filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll") Region: id = 664 start_va = 0x184859a0000 end_va = 0x184859a6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184859a0000" filename = "" Region: id = 665 start_va = 0x1848a260000 end_va = 0x1848a35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a260000" filename = "" Region: id = 666 start_va = 0x184859c0000 end_va = 0x184859cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184859c0000" filename = "" Region: id = 667 start_va = 0x184859c0000 end_va = 0x184859c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184859c0000" filename = "" Region: id = 668 start_va = 0x18487f40000 end_va = 0x18487f43fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487f40000" filename = "" Region: id = 669 start_va = 0x18487f60000 end_va = 0x18487f61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487f60000" filename = "" Region: id = 670 start_va = 0x18487f70000 end_va = 0x18487f70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487f70000" filename = "" Region: id = 671 start_va = 0x18487fb0000 end_va = 0x18487fb1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487fb0000" filename = "" Region: id = 672 start_va = 0x1848b600000 end_va = 0x1848baddfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001848b600000" filename = "" Region: id = 673 start_va = 0x18487f40000 end_va = 0x18487f4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487f40000" filename = "" Region: id = 674 start_va = 0x18487f40000 end_va = 0x18487f4dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487f40000" filename = "" Region: id = 675 start_va = 0x18487f60000 end_va = 0x18487f6dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487f60000" filename = "" Region: id = 676 start_va = 0x18488430000 end_va = 0x1848878ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488430000" filename = "" Region: id = 677 start_va = 0x18489a40000 end_va = 0x18489ebbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018489a40000" filename = "" Region: id = 678 start_va = 0x1848bae0000 end_va = 0x1848bf5bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001848bae0000" filename = "" Region: id = 679 start_va = 0x18485940000 end_va = 0x18485944fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll") Region: id = 680 start_va = 0x18485950000 end_va = 0x1848595ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui") Region: id = 681 start_va = 0x18488390000 end_va = 0x184883bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "xlsrvintl.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\1033\\xlsrvintl.dll") Region: id = 682 start_va = 0x184883e0000 end_va = 0x1848840ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "xlsrvintl.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\1033\\xlsrvintl.dll") Region: id = 683 start_va = 0x18488430000 end_va = 0x1848845ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "xlsrvintl.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\1033\\xlsrvintl.dll") Region: id = 684 start_va = 0x7ffa5e950000 end_va = 0x7ffa5ed80fff monitored = 1 entry_point = 0x7ffa5eab33cc region_type = mapped_file name = "vbe7.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll") Region: id = 685 start_va = 0x18487f70000 end_va = 0x18487f71fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487f70000" filename = "" Region: id = 686 start_va = 0x68310000 end_va = 0x683e1fff monitored = 0 entry_point = 0x683314e4 region_type = mapped_file name = "msvcr100.dll" filename = "\\Windows\\System32\\msvcr100.dll" (normalized: "c:\\windows\\system32\\msvcr100.dll") Region: id = 687 start_va = 0x18488460000 end_va = 0x1848865ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488460000" filename = "" Region: id = 688 start_va = 0x18488660000 end_va = 0x184888e0fff monitored = 1 entry_point = 0x18488674c98 region_type = mapped_file name = "vbeui.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbeui.dll") Region: id = 689 start_va = 0x7ffa58850000 end_va = 0x7ffa58adefff monitored = 1 entry_point = 0x7ffa58864c98 region_type = mapped_file name = "vbeui.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbeui.dll") Region: id = 690 start_va = 0x18487fb0000 end_va = 0x18487fb1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487fb0000" filename = "" Region: id = 691 start_va = 0x18488360000 end_va = 0x1848836ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488360000" filename = "" Region: id = 692 start_va = 0x7ffa6d6d0000 end_va = 0x7ffa6d6e0fff monitored = 0 entry_point = 0x7ffa6d6d2fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 693 start_va = 0x7ffa6f330000 end_va = 0x7ffa6f3aefff monitored = 0 entry_point = 0x7ffa6f347110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 694 start_va = 0x18488460000 end_va = 0x18488485fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vbe7intl.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\1033\\vbe7intl.dll") Region: id = 695 start_va = 0x18488650000 end_va = 0x1848865ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488650000" filename = "" Region: id = 696 start_va = 0x18488370000 end_va = 0x1848837afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "normnfd.nls" filename = "\\Windows\\System32\\normnfd.nls" (normalized: "c:\\windows\\system32\\normnfd.nls") Region: id = 697 start_va = 0x184883c0000 end_va = 0x184883c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184883c0000" filename = "" Region: id = 698 start_va = 0x18488490000 end_va = 0x18488599fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488490000" filename = "" Region: id = 699 start_va = 0x18488410000 end_va = 0x1848841ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488410000" filename = "" Region: id = 700 start_va = 0x184885a0000 end_va = 0x184885affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184885a0000" filename = "" Region: id = 701 start_va = 0x184885a0000 end_va = 0x184885befff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184885a0000" filename = "" Region: id = 702 start_va = 0x184885c0000 end_va = 0x184885defff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184885c0000" filename = "" Region: id = 703 start_va = 0x1848bf60000 end_va = 0x1848cf2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848bf60000" filename = "" Region: id = 704 start_va = 0x18488410000 end_va = 0x18488411fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018488410000" filename = "" Region: id = 705 start_va = 0x184885e0000 end_va = 0x184885e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184885e0000" filename = "" Region: id = 706 start_va = 0x7ffa6b730000 end_va = 0x7ffa6b743fff monitored = 0 entry_point = 0x7ffa6b731800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 707 start_va = 0x184885f0000 end_va = 0x184885fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184885f0000" filename = "" Region: id = 708 start_va = 0x18488600000 end_va = 0x1848860ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488600000" filename = "" Region: id = 709 start_va = 0x18488610000 end_va = 0x18488610fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488610000" filename = "" Region: id = 710 start_va = 0x18488620000 end_va = 0x18488620fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488620000" filename = "" Region: id = 711 start_va = 0x18488630000 end_va = 0x18488646fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488630000" filename = "" Region: id = 712 start_va = 0x18488660000 end_va = 0x18488660fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488660000" filename = "" Region: id = 713 start_va = 0x18488670000 end_va = 0x18488686fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488670000" filename = "" Region: id = 714 start_va = 0x18488690000 end_va = 0x18488690fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488690000" filename = "" Region: id = 715 start_va = 0x184886a0000 end_va = 0x184886a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184886a0000" filename = "" Region: id = 716 start_va = 0x184886b0000 end_va = 0x184886b2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184886b0000" filename = "" Region: id = 717 start_va = 0x184886c0000 end_va = 0x184886c2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184886c0000" filename = "" Region: id = 718 start_va = 0x184886d0000 end_va = 0x184886d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184886d0000" filename = "" Region: id = 719 start_va = 0x184886e0000 end_va = 0x184886e3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184886e0000" filename = "" Region: id = 720 start_va = 0x184886f0000 end_va = 0x184886f4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184886f0000" filename = "" Region: id = 721 start_va = 0x18488700000 end_va = 0x18488700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488700000" filename = "" Region: id = 722 start_va = 0x18488710000 end_va = 0x18488712fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488710000" filename = "" Region: id = 723 start_va = 0x18488720000 end_va = 0x18488720fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488720000" filename = "" Region: id = 724 start_va = 0x18488730000 end_va = 0x18488730fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488730000" filename = "" Region: id = 725 start_va = 0x18488740000 end_va = 0x18488742fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488740000" filename = "" Region: id = 726 start_va = 0x18488750000 end_va = 0x18488750fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488750000" filename = "" Region: id = 727 start_va = 0x7ffa6b750000 end_va = 0x7ffa6b845fff monitored = 0 entry_point = 0x7ffa6b789590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 728 start_va = 0x184885f0000 end_va = 0x18488606fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184885f0000" filename = "" Region: id = 729 start_va = 0x18488610000 end_va = 0x18488612fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488610000" filename = "" Region: id = 730 start_va = 0x18488630000 end_va = 0x1848863bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018488630000" filename = "" Region: id = 731 start_va = 0x18488640000 end_va = 0x1848864bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018488640000" filename = "" Region: id = 732 start_va = 0x18488760000 end_va = 0x18488795fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018488760000" filename = "" Region: id = 733 start_va = 0x184887a0000 end_va = 0x184887d5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184887a0000" filename = "" Region: id = 734 start_va = 0x18488660000 end_va = 0x18488661fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488660000" filename = "" Region: id = 735 start_va = 0x18488670000 end_va = 0x18488672fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488670000" filename = "" Region: id = 736 start_va = 0x18488680000 end_va = 0x18488680fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488680000" filename = "" Region: id = 737 start_va = 0x184885f0000 end_va = 0x184885f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184885f0000" filename = "" Region: id = 738 start_va = 0x18488600000 end_va = 0x18488610fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488600000" filename = "" Region: id = 739 start_va = 0x18488620000 end_va = 0x18488621fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488620000" filename = "" Region: id = 740 start_va = 0x18488660000 end_va = 0x1848867cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488660000" filename = "" Region: id = 741 start_va = 0x1848a810000 end_va = 0x1848ab34fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a810000" filename = "" Region: id = 742 start_va = 0x184886b0000 end_va = 0x184886c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184886b0000" filename = "" Region: id = 743 start_va = 0x184887e0000 end_va = 0x184888d8fff monitored = 0 entry_point = 0x184887e3830 region_type = mapped_file name = "excel.exe" filename = "\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\excel.exe") Region: id = 744 start_va = 0x18488680000 end_va = 0x18488680fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018488680000" filename = "" Region: id = 745 start_va = 0x18488680000 end_va = 0x18488684fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 746 start_va = 0x18489ec0000 end_va = 0x18489f48fff monitored = 0 entry_point = 0x18489eccaf0 region_type = mapped_file name = "mso.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\mso.dll") Region: id = 747 start_va = 0x18488600000 end_va = 0x18488600fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018488600000" filename = "" Region: id = 748 start_va = 0x18489f50000 end_va = 0x1848a050fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489f50000" filename = "" Region: id = 749 start_va = 0x18489f50000 end_va = 0x1848a050fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489f50000" filename = "" Region: id = 750 start_va = 0x18489f50000 end_va = 0x1848a050fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489f50000" filename = "" Region: id = 751 start_va = 0x18488600000 end_va = 0x18488600fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018488600000" filename = "" Region: id = 752 start_va = 0x18489f50000 end_va = 0x1848a050fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489f50000" filename = "" Region: id = 753 start_va = 0x18489f50000 end_va = 0x1848a050fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489f50000" filename = "" Region: id = 754 start_va = 0x6c83700000 end_va = 0x6c837fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c83700000" filename = "" Region: id = 755 start_va = 0x18489f50000 end_va = 0x1848a06ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489f50000" filename = "" Region: id = 756 start_va = 0x18489f50000 end_va = 0x1848a04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489f50000" filename = "" Region: id = 757 start_va = 0x1848a060000 end_va = 0x1848a06ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a060000" filename = "" Region: id = 758 start_va = 0x18488600000 end_va = 0x18488616fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488600000" filename = "" Region: id = 759 start_va = 0x18488620000 end_va = 0x18488622fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488620000" filename = "" Region: id = 760 start_va = 0x18488660000 end_va = 0x18488660fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488660000" filename = "" Region: id = 761 start_va = 0x18488670000 end_va = 0x18488672fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488670000" filename = "" Region: id = 762 start_va = 0x18488690000 end_va = 0x18488690fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488690000" filename = "" Region: id = 763 start_va = 0x184886b0000 end_va = 0x184886c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184886b0000" filename = "" Region: id = 764 start_va = 0x184886d0000 end_va = 0x184886d2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184886d0000" filename = "" Region: id = 765 start_va = 0x184886e0000 end_va = 0x184886e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184886e0000" filename = "" Region: id = 766 start_va = 0x184886f0000 end_va = 0x184886f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184886f0000" filename = "" Region: id = 767 start_va = 0x18488700000 end_va = 0x18488700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488700000" filename = "" Region: id = 768 start_va = 0x18488710000 end_va = 0x18488726fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488710000" filename = "" Region: id = 769 start_va = 0x18488600000 end_va = 0x18488602fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488600000" filename = "" Region: id = 770 start_va = 0x18488610000 end_va = 0x18488610fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488610000" filename = "" Region: id = 771 start_va = 0x18488660000 end_va = 0x18488676fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488660000" filename = "" Region: id = 772 start_va = 0x184886b0000 end_va = 0x184886b2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184886b0000" filename = "" Region: id = 773 start_va = 0x184886c0000 end_va = 0x184886c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184886c0000" filename = "" Region: id = 774 start_va = 0x184886d0000 end_va = 0x184886e6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184886d0000" filename = "" Region: id = 775 start_va = 0x18488710000 end_va = 0x18488712fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488710000" filename = "" Region: id = 776 start_va = 0x18488720000 end_va = 0x18488720fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488720000" filename = "" Region: id = 777 start_va = 0x18488740000 end_va = 0x18488756fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488740000" filename = "" Region: id = 778 start_va = 0x184888e0000 end_va = 0x184888e2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184888e0000" filename = "" Region: id = 779 start_va = 0x184888f0000 end_va = 0x184888f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184888f0000" filename = "" Region: id = 780 start_va = 0x18488900000 end_va = 0x18488902fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488900000" filename = "" Region: id = 781 start_va = 0x184889f0000 end_va = 0x184889f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184889f0000" filename = "" Region: id = 782 start_va = 0x18488a00000 end_va = 0x18488a16fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488a00000" filename = "" Region: id = 783 start_va = 0x18488a20000 end_va = 0x18488a22fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488a20000" filename = "" Region: id = 784 start_va = 0x18488a30000 end_va = 0x18488a30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488a30000" filename = "" Region: id = 785 start_va = 0x18488a40000 end_va = 0x18488a42fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488a40000" filename = "" Region: id = 786 start_va = 0x18488a50000 end_va = 0x18488a50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488a50000" filename = "" Region: id = 787 start_va = 0x18489f50000 end_va = 0x18489f66fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489f50000" filename = "" Region: id = 788 start_va = 0x18489f70000 end_va = 0x18489f72fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489f70000" filename = "" Region: id = 789 start_va = 0x18489f80000 end_va = 0x18489f80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489f80000" filename = "" Region: id = 790 start_va = 0x18489f90000 end_va = 0x18489f92fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489f90000" filename = "" Region: id = 791 start_va = 0x18489fa0000 end_va = 0x18489fa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489fa0000" filename = "" Region: id = 792 start_va = 0x18489fb0000 end_va = 0x18489fb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489fb0000" filename = "" Region: id = 793 start_va = 0x18489fc0000 end_va = 0x18489fd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489fc0000" filename = "" Region: id = 794 start_va = 0x18489fe0000 end_va = 0x18489fe2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489fe0000" filename = "" Region: id = 795 start_va = 0x18489ff0000 end_va = 0x18489ff0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489ff0000" filename = "" Region: id = 796 start_va = 0x1848a000000 end_va = 0x1848a002fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a000000" filename = "" Region: id = 797 start_va = 0x1848a010000 end_va = 0x1848a010fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a010000" filename = "" Region: id = 798 start_va = 0x1848a020000 end_va = 0x1848a036fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a020000" filename = "" Region: id = 799 start_va = 0x1848a040000 end_va = 0x1848a04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a040000" filename = "" Region: id = 800 start_va = 0x1848a050000 end_va = 0x1848a052fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a050000" filename = "" Region: id = 801 start_va = 0x1848a070000 end_va = 0x1848a070fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a070000" filename = "" Region: id = 802 start_va = 0x1848a080000 end_va = 0x1848a080fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a080000" filename = "" Region: id = 803 start_va = 0x1848a090000 end_va = 0x1848a092fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a090000" filename = "" Region: id = 804 start_va = 0x1848a0a0000 end_va = 0x1848a0a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0a0000" filename = "" Region: id = 805 start_va = 0x1848a0b0000 end_va = 0x1848a0c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0b0000" filename = "" Region: id = 806 start_va = 0x1848a0d0000 end_va = 0x1848a0d2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0d0000" filename = "" Region: id = 807 start_va = 0x1848a0e0000 end_va = 0x1848a0e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0e0000" filename = "" Region: id = 808 start_va = 0x1848a0f0000 end_va = 0x1848a0f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0f0000" filename = "" Region: id = 809 start_va = 0x1848a100000 end_va = 0x1848a100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a100000" filename = "" Region: id = 810 start_va = 0x1848a110000 end_va = 0x1848a126fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a110000" filename = "" Region: id = 811 start_va = 0x1848a130000 end_va = 0x1848a132fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a130000" filename = "" Region: id = 812 start_va = 0x1848a140000 end_va = 0x1848a140fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a140000" filename = "" Region: id = 813 start_va = 0x1848a150000 end_va = 0x1848a150fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a150000" filename = "" Region: id = 814 start_va = 0x1848a660000 end_va = 0x1848a662fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a660000" filename = "" Region: id = 815 start_va = 0x1848a670000 end_va = 0x1848a670fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a670000" filename = "" Region: id = 816 start_va = 0x1848a680000 end_va = 0x1848a696fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a680000" filename = "" Region: id = 817 start_va = 0x1848a6a0000 end_va = 0x1848a6a2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6a0000" filename = "" Region: id = 818 start_va = 0x1848a6b0000 end_va = 0x1848a6b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6b0000" filename = "" Region: id = 819 start_va = 0x1848a6c0000 end_va = 0x1848a6c2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6c0000" filename = "" Region: id = 820 start_va = 0x1848a6d0000 end_va = 0x1848a6d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6d0000" filename = "" Region: id = 821 start_va = 0x1848a6e0000 end_va = 0x1848a6f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6e0000" filename = "" Region: id = 822 start_va = 0x1848a700000 end_va = 0x1848a700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a700000" filename = "" Region: id = 823 start_va = 0x1848a710000 end_va = 0x1848a712fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a710000" filename = "" Region: id = 824 start_va = 0x1848a720000 end_va = 0x1848a720fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a720000" filename = "" Region: id = 825 start_va = 0x1848a750000 end_va = 0x1848a75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a750000" filename = "" Region: id = 826 start_va = 0x1848a730000 end_va = 0x1848a732fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a730000" filename = "" Region: id = 827 start_va = 0x1848a740000 end_va = 0x1848a740fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a740000" filename = "" Region: id = 828 start_va = 0x18488600000 end_va = 0x18488602fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488600000" filename = "" Region: id = 829 start_va = 0x18488610000 end_va = 0x18488610fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488610000" filename = "" Region: id = 830 start_va = 0x7ffa70f20000 end_va = 0x7ffa70f48fff monitored = 0 entry_point = 0x7ffa70f21340 region_type = mapped_file name = "wshom.ocx" filename = "\\Windows\\System32\\wshom.ocx" (normalized: "c:\\windows\\system32\\wshom.ocx") Region: id = 831 start_va = 0x7ffa63d50000 end_va = 0x7ffa63d84fff monitored = 0 entry_point = 0x7ffa63d55850 region_type = mapped_file name = "scrrun.dll" filename = "\\Windows\\System32\\scrrun.dll" (normalized: "c:\\windows\\system32\\scrrun.dll") Region: id = 832 start_va = 0x18488600000 end_va = 0x1848860ffff monitored = 0 entry_point = 0x18488605850 region_type = mapped_file name = "scrrun.dll" filename = "\\Windows\\System32\\scrrun.dll" (normalized: "c:\\windows\\system32\\scrrun.dll") Region: id = 833 start_va = 0x184886b0000 end_va = 0x184886effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184886b0000" filename = "" Region: id = 834 start_va = 0x18488620000 end_va = 0x18488622fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488620000" filename = "" Region: id = 835 start_va = 0x18488660000 end_va = 0x18488663fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488660000" filename = "" Region: id = 836 start_va = 0x18488670000 end_va = 0x18488670fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488670000" filename = "" Region: id = 837 start_va = 0x18488690000 end_va = 0x18488690fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488690000" filename = "" Region: id = 838 start_va = 0x184886f0000 end_va = 0x184886f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184886f0000" filename = "" Region: id = 839 start_va = 0x18488700000 end_va = 0x18488703fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488700000" filename = "" Region: id = 840 start_va = 0x184889f0000 end_va = 0x18488a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184889f0000" filename = "" Region: id = 841 start_va = 0x18488710000 end_va = 0x18488713fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488710000" filename = "" Region: id = 842 start_va = 0x1848d430000 end_va = 0x1848da10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848d430000" filename = "" Region: id = 843 start_va = 0x18483680000 end_va = 0x18483b71fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018483680000" filename = "" Region: id = 844 start_va = 0x18488720000 end_va = 0x18488721fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488720000" filename = "" Region: id = 845 start_va = 0x18488740000 end_va = 0x18488741fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488740000" filename = "" Region: id = 846 start_va = 0x18488750000 end_va = 0x18488752fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488750000" filename = "" Region: id = 847 start_va = 0x184888e0000 end_va = 0x184888e1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184888e0000" filename = "" Region: id = 848 start_va = 0x184888f0000 end_va = 0x184888f1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184888f0000" filename = "" Region: id = 849 start_va = 0x18488900000 end_va = 0x18488900fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488900000" filename = "" Region: id = 850 start_va = 0x18488a30000 end_va = 0x18488a31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488a30000" filename = "" Region: id = 851 start_va = 0x18488a40000 end_va = 0x18488a40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488a40000" filename = "" Region: id = 852 start_va = 0x18488a50000 end_va = 0x18488a51fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488a50000" filename = "" Region: id = 853 start_va = 0x18489f50000 end_va = 0x18489f50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489f50000" filename = "" Region: id = 854 start_va = 0x18489f60000 end_va = 0x18489f61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489f60000" filename = "" Region: id = 855 start_va = 0x18489f70000 end_va = 0x18489f72fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489f70000" filename = "" Region: id = 856 start_va = 0x1848da20000 end_va = 0x1848df99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848da20000" filename = "" Region: id = 857 start_va = 0x1848dfa0000 end_va = 0x1848ef6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848dfa0000" filename = "" Region: id = 858 start_va = 0x18488720000 end_va = 0x18488720fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netmsg.dll" filename = "\\Windows\\System32\\netmsg.dll" (normalized: "c:\\windows\\system32\\netmsg.dll") Region: id = 859 start_va = 0x18489f50000 end_va = 0x18489f81fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netmsg.dll.mui" filename = "\\Windows\\System32\\en-US\\netmsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netmsg.dll.mui") Region: id = 860 start_va = 0x18488740000 end_va = 0x1848874ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488740000" filename = "" Region: id = 861 start_va = 0x18488750000 end_va = 0x1848875ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488750000" filename = "" Region: id = 862 start_va = 0x7ff661e70000 end_va = 0x7ff661e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff661e70000" filename = "" Region: id = 863 start_va = 0x18488a30000 end_va = 0x18488a33fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488a30000" filename = "" Region: id = 864 start_va = 0x18489f90000 end_va = 0x18489f91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489f90000" filename = "" Region: id = 865 start_va = 0x18489fb0000 end_va = 0x18489fc9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489fb0000" filename = "" Region: id = 866 start_va = 0x18489fd0000 end_va = 0x18489febfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489fd0000" filename = "" Region: id = 867 start_va = 0x18489ff0000 end_va = 0x1848a002fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489ff0000" filename = "" Region: id = 868 start_va = 0x1848a010000 end_va = 0x1848a011fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a010000" filename = "" Region: id = 869 start_va = 0x1848a020000 end_va = 0x1848a022fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a020000" filename = "" Region: id = 870 start_va = 0x1848a030000 end_va = 0x1848a031fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a030000" filename = "" Region: id = 871 start_va = 0x1848a050000 end_va = 0x1848a052fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a050000" filename = "" Region: id = 872 start_va = 0x1848a070000 end_va = 0x1848a072fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a070000" filename = "" Region: id = 873 start_va = 0x1848a090000 end_va = 0x1848a091fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a090000" filename = "" Region: id = 874 start_va = 0x1848a0a0000 end_va = 0x1848a0a2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0a0000" filename = "" Region: id = 875 start_va = 0x1848a0b0000 end_va = 0x1848a0b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0b0000" filename = "" Region: id = 876 start_va = 0x1848a0c0000 end_va = 0x1848a0c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0c0000" filename = "" Region: id = 877 start_va = 0x1848a0d0000 end_va = 0x1848a0e6fff monitored = 1 entry_point = 0x1848a2333cc region_type = mapped_file name = "vbe7.dll" filename = "\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\common~1\\micros~1\\vba\\vba7.1\\vbe7.dll") Region: id = 878 start_va = 0x18489f90000 end_va = 0x18489f93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489f90000" filename = "" Region: id = 879 start_va = 0x18489fb0000 end_va = 0x18489fc6fff monitored = 1 entry_point = 0x1848a1133cc region_type = mapped_file name = "vbe7.dll" filename = "\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\common~1\\micros~1\\vba\\vba7.1\\vbe7.dll") Region: id = 880 start_va = 0x7ffa70f50000 end_va = 0x7ffa70f6cfff monitored = 0 entry_point = 0x7ffa70f5a430 region_type = mapped_file name = "winhttpcom.dll" filename = "\\Windows\\System32\\winhttpcom.dll" (normalized: "c:\\windows\\system32\\winhttpcom.dll") Region: id = 881 start_va = 0x7ffa724d0000 end_va = 0x7ffa72597fff monitored = 0 entry_point = 0x7ffa725113f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 882 start_va = 0x7ffa70370000 end_va = 0x7ffa70384fff monitored = 0 entry_point = 0x7ffa70372dc0 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 883 start_va = 0x7ffa71200000 end_va = 0x7ffa71237fff monitored = 0 entry_point = 0x7ffa71218cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 884 start_va = 0x7ffa6b290000 end_va = 0x7ffa6b30ffff monitored = 0 entry_point = 0x7ffa6b2bd280 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 885 start_va = 0x7ffa77d70000 end_va = 0x7ffa77dcbfff monitored = 0 entry_point = 0x7ffa77d86f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 886 start_va = 0x7ffa71010000 end_va = 0x7ffa7101afff monitored = 0 entry_point = 0x7ffa71011d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 887 start_va = 0x7ffa7b280000 end_va = 0x7ffa7b287fff monitored = 0 entry_point = 0x7ffa7b281ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 888 start_va = 0x7ffa76fe0000 end_va = 0x7ffa77089fff monitored = 0 entry_point = 0x7ffa77007910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 889 start_va = 0x7ffa70eb0000 end_va = 0x7ffa70f16fff monitored = 0 entry_point = 0x7ffa70eb63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 890 start_va = 0x7ffa6f830000 end_va = 0x7ffa6f839fff monitored = 0 entry_point = 0x7ffa6f8314c0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 891 start_va = 0x18489fd0000 end_va = 0x18489fd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui") Region: id = 892 start_va = 0x7ffa779f0000 end_va = 0x7ffa77a69fff monitored = 0 entry_point = 0x7ffa77a11a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 893 start_va = 0x18489fe0000 end_va = 0x18489fe1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018489fe0000" filename = "" Region: id = 894 start_va = 0x7ffa6b0e0000 end_va = 0x7ffa6b0f3fff monitored = 0 entry_point = 0x7ffa6b0e3710 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll") Region: id = 895 start_va = 0x7ffa77fd0000 end_va = 0x7ffa78009fff monitored = 0 entry_point = 0x7ffa77fd8d20 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 896 start_va = 0x7ffa78010000 end_va = 0x7ffa78036fff monitored = 0 entry_point = 0x7ffa78020aa0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 897 start_va = 0x7ffa6b190000 end_va = 0x7ffa6b1adfff monitored = 0 entry_point = 0x7ffa6b19ef80 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll") Region: id = 898 start_va = 0x6c83800000 end_va = 0x6c838fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c83800000" filename = "" Region: id = 899 start_va = 0x18489ff0000 end_va = 0x18489ff9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\System32\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\crypt32.dll.mui") Region: id = 900 start_va = 0x7ffa77af0000 end_va = 0x7ffa77af9fff monitored = 0 entry_point = 0x7ffa77af1830 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 901 start_va = 0x1848cf30000 end_va = 0x1848d421fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001848cf30000" filename = "" Region: id = 902 start_va = 0x7ffa635e0000 end_va = 0x7ffa6373bfff monitored = 0 entry_point = 0x7ffa63625be0 region_type = mapped_file name = "uiautomationcore.dll" filename = "\\Windows\\System32\\UIAutomationCore.dll" (normalized: "c:\\windows\\system32\\uiautomationcore.dll") Region: id = 903 start_va = 0x7ffa77c00000 end_va = 0x7ffa77c1efff monitored = 0 entry_point = 0x7ffa77c05d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 904 start_va = 0x18483680000 end_va = 0x18483680fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018483680000" filename = "" Region: id = 905 start_va = 0x1848d430000 end_va = 0x1848d900fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848d430000" filename = "" Region: id = 906 start_va = 0x7ffa61eb0000 end_va = 0x7ffa622fbfff monitored = 0 entry_point = 0x7ffa62120590 region_type = mapped_file name = "d3dcompiler_47.dll" filename = "\\Windows\\System32\\D3DCompiler_47.dll" (normalized: "c:\\windows\\system32\\d3dcompiler_47.dll") Region: id = 907 start_va = 0x18483690000 end_va = 0x1848378ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483690000" filename = "" Region: id = 908 start_va = 0x18483790000 end_va = 0x1848379ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483790000" filename = "" Region: id = 909 start_va = 0x184837a0000 end_va = 0x184837affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184837a0000" filename = "" Region: id = 910 start_va = 0x184837b0000 end_va = 0x184837bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184837b0000" filename = "" Region: id = 911 start_va = 0x184837c0000 end_va = 0x184837cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184837c0000" filename = "" Region: id = 912 start_va = 0x184837d0000 end_va = 0x184837dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184837d0000" filename = "" Region: id = 913 start_va = 0x184837e0000 end_va = 0x184837effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184837e0000" filename = "" Region: id = 914 start_va = 0x184837f0000 end_va = 0x184837fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184837f0000" filename = "" Region: id = 915 start_va = 0x184837f0000 end_va = 0x184838effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184837f0000" filename = "" Region: id = 916 start_va = 0x184837b0000 end_va = 0x184837bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184837b0000" filename = "" Region: id = 917 start_va = 0x184838f0000 end_va = 0x184838fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184838f0000" filename = "" Region: id = 918 start_va = 0x18483900000 end_va = 0x1848390ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483900000" filename = "" Region: id = 919 start_va = 0x18483910000 end_va = 0x1848391ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483910000" filename = "" Region: id = 920 start_va = 0x18483920000 end_va = 0x1848392ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483920000" filename = "" Region: id = 921 start_va = 0x18483930000 end_va = 0x1848393ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483930000" filename = "" Region: id = 922 start_va = 0x18483940000 end_va = 0x1848394ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483940000" filename = "" Region: id = 923 start_va = 0x18483950000 end_va = 0x1848395ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483950000" filename = "" Region: id = 924 start_va = 0x18483960000 end_va = 0x1848396ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483960000" filename = "" Region: id = 925 start_va = 0x18483970000 end_va = 0x1848397ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483970000" filename = "" Region: id = 926 start_va = 0x18483980000 end_va = 0x1848398ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483980000" filename = "" Region: id = 927 start_va = 0x18483990000 end_va = 0x1848399ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483990000" filename = "" Region: id = 928 start_va = 0x18483920000 end_va = 0x1848392ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483920000" filename = "" Region: id = 929 start_va = 0x18483930000 end_va = 0x1848393ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483930000" filename = "" Region: id = 930 start_va = 0x18483940000 end_va = 0x1848394ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483940000" filename = "" Region: id = 931 start_va = 0x18483950000 end_va = 0x1848395ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483950000" filename = "" Region: id = 932 start_va = 0x18483960000 end_va = 0x1848396ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483960000" filename = "" Region: id = 933 start_va = 0x18483970000 end_va = 0x1848397ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483970000" filename = "" Region: id = 934 start_va = 0x18483980000 end_va = 0x1848398ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483980000" filename = "" Region: id = 935 start_va = 0x18483990000 end_va = 0x1848399ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483990000" filename = "" Region: id = 936 start_va = 0x18483920000 end_va = 0x1848392ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483920000" filename = "" Region: id = 937 start_va = 0x18483930000 end_va = 0x1848393ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483930000" filename = "" Region: id = 938 start_va = 0x18483940000 end_va = 0x1848394ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483940000" filename = "" Region: id = 939 start_va = 0x18483950000 end_va = 0x1848395ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483950000" filename = "" Region: id = 940 start_va = 0x18483960000 end_va = 0x1848396ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483960000" filename = "" Region: id = 941 start_va = 0x18483970000 end_va = 0x1848397ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483970000" filename = "" Region: id = 942 start_va = 0x18483980000 end_va = 0x1848398ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483980000" filename = "" Region: id = 943 start_va = 0x18483990000 end_va = 0x1848399ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483990000" filename = "" Region: id = 944 start_va = 0x18483980000 end_va = 0x1848398ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483980000" filename = "" Region: id = 945 start_va = 0x18483990000 end_va = 0x1848399ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483990000" filename = "" Region: id = 946 start_va = 0x184839a0000 end_va = 0x184839affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184839a0000" filename = "" Region: id = 947 start_va = 0x184839b0000 end_va = 0x184839bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184839b0000" filename = "" Region: id = 948 start_va = 0x184839c0000 end_va = 0x184839cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184839c0000" filename = "" Region: id = 949 start_va = 0x184839d0000 end_va = 0x184839dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184839d0000" filename = "" Region: id = 950 start_va = 0x184839e0000 end_va = 0x184839effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184839e0000" filename = "" Region: id = 951 start_va = 0x184839f0000 end_va = 0x184839fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184839f0000" filename = "" Region: id = 952 start_va = 0x18483a00000 end_va = 0x18483a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483a00000" filename = "" Region: id = 953 start_va = 0x18483a10000 end_va = 0x18483a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483a10000" filename = "" Region: id = 954 start_va = 0x18483a20000 end_va = 0x18483a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483a20000" filename = "" Region: id = 955 start_va = 0x18483a30000 end_va = 0x18483a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483a30000" filename = "" Region: id = 956 start_va = 0x18483a40000 end_va = 0x18483a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483a40000" filename = "" Region: id = 957 start_va = 0x18483a50000 end_va = 0x18483a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483a50000" filename = "" Region: id = 958 start_va = 0x18483a60000 end_va = 0x18483a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483a60000" filename = "" Region: id = 959 start_va = 0x18483a70000 end_va = 0x18483a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483a70000" filename = "" Region: id = 960 start_va = 0x7ff661e60000 end_va = 0x7ff661e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff661e60000" filename = "" Region: id = 961 start_va = 0x18483980000 end_va = 0x1848398ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483980000" filename = "" Region: id = 962 start_va = 0x18483990000 end_va = 0x1848399ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483990000" filename = "" Region: id = 963 start_va = 0x184839a0000 end_va = 0x184839affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184839a0000" filename = "" Region: id = 964 start_va = 0x184839b0000 end_va = 0x184839bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184839b0000" filename = "" Region: id = 965 start_va = 0x184839c0000 end_va = 0x184839cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184839c0000" filename = "" Region: id = 966 start_va = 0x184839a0000 end_va = 0x184839affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184839a0000" filename = "" Region: id = 967 start_va = 0x184839b0000 end_va = 0x184839bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184839b0000" filename = "" Region: id = 968 start_va = 0x184839c0000 end_va = 0x184839cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184839c0000" filename = "" Region: id = 969 start_va = 0x184839a0000 end_va = 0x184839adfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184839a0000" filename = "" Region: id = 970 start_va = 0x184839b0000 end_va = 0x184839b8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184839b0000" filename = "" Region: id = 971 start_va = 0x184839c0000 end_va = 0x184839c4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184839c0000" filename = "" Region: id = 972 start_va = 0x184839d0000 end_va = 0x184839e3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184839d0000" filename = "" Region: id = 973 start_va = 0x184839f0000 end_va = 0x184839f5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184839f0000" filename = "" Region: id = 974 start_va = 0x18483a00000 end_va = 0x18483a12fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483a00000" filename = "" Region: id = 975 start_va = 0x18483a20000 end_va = 0x18483a21fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483a20000" filename = "" Region: id = 976 start_va = 0x18483a30000 end_va = 0x18483a31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483a30000" filename = "" Region: id = 977 start_va = 0x18483a40000 end_va = 0x18483a42fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483a40000" filename = "" Region: id = 978 start_va = 0x18483a50000 end_va = 0x18483a51fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483a50000" filename = "" Region: id = 979 start_va = 0x18483a60000 end_va = 0x18483a62fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483a60000" filename = "" Region: id = 980 start_va = 0x18483a70000 end_va = 0x18483a72fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483a70000" filename = "" Region: id = 981 start_va = 0x1848a810000 end_va = 0x1848a981fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a810000" filename = "" Region: id = 982 start_va = 0x1848a990000 end_va = 0x1848aaf9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a990000" filename = "" Region: id = 983 start_va = 0x18483a80000 end_va = 0x18483a81fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483a80000" filename = "" Region: id = 984 start_va = 0x18483a90000 end_va = 0x18483a92fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483a90000" filename = "" Region: id = 985 start_va = 0x18483aa0000 end_va = 0x18483aa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483aa0000" filename = "" Region: id = 986 start_va = 0x18483ab0000 end_va = 0x18483ab0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483ab0000" filename = "" Region: id = 987 start_va = 0x184839a0000 end_va = 0x184839a2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184839a0000" filename = "" Region: id = 988 start_va = 0x184839b0000 end_va = 0x184839b2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184839b0000" filename = "" Region: id = 989 start_va = 0x184839c0000 end_va = 0x184839d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184839c0000" filename = "" Region: id = 990 start_va = 0x184839c0000 end_va = 0x184839cafff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184839c0000" filename = "" Region: id = 991 start_va = 0x184839d0000 end_va = 0x184839dafff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184839d0000" filename = "" Region: id = 992 start_va = 0x184839e0000 end_va = 0x18483ab5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184839e0000" filename = "" Region: id = 993 start_va = 0x18483ac0000 end_va = 0x18483ac0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483ac0000" filename = "" Region: id = 994 start_va = 0x18483ad0000 end_va = 0x18483ae6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483ad0000" filename = "" Region: id = 995 start_va = 0x18483af0000 end_va = 0x18483af2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483af0000" filename = "" Region: id = 996 start_va = 0x18483b00000 end_va = 0x18483b00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b00000" filename = "" Region: id = 997 start_va = 0x18483b10000 end_va = 0x18483b18fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018483b10000" filename = "" Region: id = 998 start_va = 0x18483b20000 end_va = 0x18483b28fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018483b20000" filename = "" Region: id = 999 start_va = 0x184872f0000 end_va = 0x184873c5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184872f0000" filename = "" Region: id = 1000 start_va = 0x184873d0000 end_va = 0x18487756fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184873d0000" filename = "" Region: id = 1001 start_va = 0x18487760000 end_va = 0x18487ae6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487760000" filename = "" Region: id = 1002 start_va = 0x18483ad0000 end_va = 0x18483ad0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018483ad0000" filename = "" Region: id = 1003 start_va = 0x1848d430000 end_va = 0x1848d654fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848d430000" filename = "" Region: id = 1004 start_va = 0x18487af0000 end_va = 0x18487c5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487af0000" filename = "" Region: id = 1005 start_va = 0x7ffa61d40000 end_va = 0x7ffa61eaffff monitored = 0 entry_point = 0x7ffa61e73158 region_type = mapped_file name = "msptls.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\msptls.dll") Region: id = 1006 start_va = 0x1848a810000 end_va = 0x1848a8b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a810000" filename = "" Region: id = 1007 start_va = 0x18483ae0000 end_va = 0x18483aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483ae0000" filename = "" Region: id = 1008 start_va = 0x18483af0000 end_va = 0x18483afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483af0000" filename = "" Region: id = 1009 start_va = 0x18483b00000 end_va = 0x18483b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b00000" filename = "" Region: id = 1010 start_va = 0x18483af0000 end_va = 0x18483afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483af0000" filename = "" Region: id = 1011 start_va = 0x18483b00000 end_va = 0x18483b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b00000" filename = "" Region: id = 1012 start_va = 0x18483b30000 end_va = 0x18483b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b30000" filename = "" Region: id = 1013 start_va = 0x18483b40000 end_va = 0x18483b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b40000" filename = "" Region: id = 1014 start_va = 0x7ff661e50000 end_va = 0x7ff661e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff661e50000" filename = "" Region: id = 1015 start_va = 0x18483b30000 end_va = 0x18483b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b30000" filename = "" Region: id = 1016 start_va = 0x18483b40000 end_va = 0x18483b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b40000" filename = "" Region: id = 1017 start_va = 0x18483b30000 end_va = 0x18483b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b30000" filename = "" Region: id = 1018 start_va = 0x18483b40000 end_va = 0x18483b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b40000" filename = "" Region: id = 1019 start_va = 0x18483b50000 end_va = 0x18483b5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b50000" filename = "" Region: id = 1020 start_va = 0x18483b30000 end_va = 0x18483b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b30000" filename = "" Region: id = 1021 start_va = 0x18483b40000 end_va = 0x18483b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b40000" filename = "" Region: id = 1022 start_va = 0x18483b50000 end_va = 0x18483b5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b50000" filename = "" Region: id = 1023 start_va = 0x18483b60000 end_va = 0x18483b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b60000" filename = "" Region: id = 1024 start_va = 0x18483b70000 end_va = 0x18483b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b70000" filename = "" Region: id = 1025 start_va = 0x18483b50000 end_va = 0x18483b5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b50000" filename = "" Region: id = 1026 start_va = 0x18483b60000 end_va = 0x18483b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b60000" filename = "" Region: id = 1027 start_va = 0x18483b50000 end_va = 0x18483b5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b50000" filename = "" Region: id = 1028 start_va = 0x18483b60000 end_va = 0x18483b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b60000" filename = "" Region: id = 1029 start_va = 0x18483b50000 end_va = 0x18483b5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b50000" filename = "" Region: id = 1030 start_va = 0x18483b60000 end_va = 0x18483b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b60000" filename = "" Region: id = 1031 start_va = 0x18483b70000 end_va = 0x18483b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b70000" filename = "" Region: id = 1032 start_va = 0x18487c60000 end_va = 0x18487c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487c60000" filename = "" Region: id = 1033 start_va = 0x18488600000 end_va = 0x1848860ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488600000" filename = "" Region: id = 1034 start_va = 0x1848a000000 end_va = 0x1848a00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a000000" filename = "" Region: id = 1035 start_va = 0x1848a010000 end_va = 0x1848a01ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a010000" filename = "" Region: id = 1036 start_va = 0x18488600000 end_va = 0x1848860ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488600000" filename = "" Region: id = 1037 start_va = 0x1848a000000 end_va = 0x1848a00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a000000" filename = "" Region: id = 1038 start_va = 0x18483b70000 end_va = 0x18483b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b70000" filename = "" Region: id = 1039 start_va = 0x18488600000 end_va = 0x1848860ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488600000" filename = "" Region: id = 1040 start_va = 0x1848a000000 end_va = 0x1848a00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a000000" filename = "" Region: id = 1041 start_va = 0x1848a010000 end_va = 0x1848a01ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a010000" filename = "" Region: id = 1042 start_va = 0x1848a020000 end_va = 0x1848a02ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a020000" filename = "" Region: id = 1043 start_va = 0x1848a030000 end_va = 0x1848a03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a030000" filename = "" Region: id = 1044 start_va = 0x1848a050000 end_va = 0x1848a05ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a050000" filename = "" Region: id = 1045 start_va = 0x1848a070000 end_va = 0x1848a07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a070000" filename = "" Region: id = 1046 start_va = 0x1848a090000 end_va = 0x1848a09ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a090000" filename = "" Region: id = 1047 start_va = 0x7ff661e40000 end_va = 0x7ff661e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff661e40000" filename = "" Region: id = 1048 start_va = 0x18483b70000 end_va = 0x18483b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018483b70000" filename = "" Region: id = 1049 start_va = 0x18488600000 end_va = 0x1848860ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488600000" filename = "" Region: id = 1050 start_va = 0x1848a000000 end_va = 0x1848a00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a000000" filename = "" Region: id = 1051 start_va = 0x1848a010000 end_va = 0x1848a01ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a010000" filename = "" Region: id = 1052 start_va = 0x1848a000000 end_va = 0x1848a00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a000000" filename = "" Region: id = 1053 start_va = 0x1848a010000 end_va = 0x1848a01ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a010000" filename = "" Region: id = 1054 start_va = 0x1848a000000 end_va = 0x1848a00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a000000" filename = "" Region: id = 1055 start_va = 0x1848a010000 end_va = 0x1848a01ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a010000" filename = "" Region: id = 1056 start_va = 0x1848a020000 end_va = 0x1848a02ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a020000" filename = "" Region: id = 1057 start_va = 0x1848a010000 end_va = 0x1848a01ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a010000" filename = "" Region: id = 1058 start_va = 0x1848a010000 end_va = 0x1848a01ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a010000" filename = "" Region: id = 1059 start_va = 0x1848a020000 end_va = 0x1848a02ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a020000" filename = "" Region: id = 1060 start_va = 0x1848a030000 end_va = 0x1848a03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a030000" filename = "" Region: id = 1061 start_va = 0x1848a050000 end_va = 0x1848a05ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a050000" filename = "" Region: id = 1062 start_va = 0x1848a070000 end_va = 0x1848a07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a070000" filename = "" Region: id = 1063 start_va = 0x1848a090000 end_va = 0x1848a09ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a090000" filename = "" Region: id = 1064 start_va = 0x1848a050000 end_va = 0x1848a05ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a050000" filename = "" Region: id = 1065 start_va = 0x1848a070000 end_va = 0x1848a07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a070000" filename = "" Region: id = 1066 start_va = 0x1848a090000 end_va = 0x1848a09ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a090000" filename = "" Region: id = 1067 start_va = 0x1848a0a0000 end_va = 0x1848a0affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0a0000" filename = "" Region: id = 1068 start_va = 0x1848a0b0000 end_va = 0x1848a0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0b0000" filename = "" Region: id = 1069 start_va = 0x1848a0c0000 end_va = 0x1848a0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0c0000" filename = "" Region: id = 1070 start_va = 0x1848a0f0000 end_va = 0x1848a0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0f0000" filename = "" Region: id = 1071 start_va = 0x1848a100000 end_va = 0x1848a10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a100000" filename = "" Region: id = 1072 start_va = 0x1848a8c0000 end_va = 0x1848aae3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "seguisym.ttf" filename = "\\Windows\\Fonts\\seguisym.ttf" (normalized: "c:\\windows\\fonts\\seguisym.ttf") Region: id = 1073 start_va = 0x1848a050000 end_va = 0x1848a05ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a050000" filename = "" Region: id = 1074 start_va = 0x1848a070000 end_va = 0x1848a07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a070000" filename = "" Region: id = 1075 start_va = 0x1848a070000 end_va = 0x1848a07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a070000" filename = "" Region: id = 1076 start_va = 0x1848a090000 end_va = 0x1848a09ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a090000" filename = "" Region: id = 1077 start_va = 0x1848a070000 end_va = 0x1848a071fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a070000" filename = "" Region: id = 1078 start_va = 0x1848a090000 end_va = 0x1848a090fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a090000" filename = "" Region: id = 1079 start_va = 0x1848a0a0000 end_va = 0x1848a0affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0a0000" filename = "" Region: id = 1080 start_va = 0x1848a0b0000 end_va = 0x1848a0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0b0000" filename = "" Region: id = 1081 start_va = 0x1848a0a0000 end_va = 0x1848a0affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0a0000" filename = "" Region: id = 1082 start_va = 0x7ff661e30000 end_va = 0x7ff661e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff661e30000" filename = "" Region: id = 1083 start_va = 0x1848a0a0000 end_va = 0x1848a0a1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0a0000" filename = "" Region: id = 1084 start_va = 0x18485960000 end_va = 0x18485961fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018485960000" filename = "" Region: id = 1085 start_va = 0x7ffa71100000 end_va = 0x7ffa71115fff monitored = 0 entry_point = 0x7ffa711019f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1086 start_va = 0x7ffa710e0000 end_va = 0x7ffa710f9fff monitored = 0 entry_point = 0x7ffa710e2430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1087 start_va = 0x7ffa6db70000 end_va = 0x7ffa6ddfdfff monitored = 0 entry_point = 0x7ffa6dc40f00 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 1088 start_va = 0x18485970000 end_va = 0x18485970fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "counters.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat") Region: id = 1089 start_va = 0x18487f40000 end_va = 0x18487f41fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487f40000" filename = "" Region: id = 1090 start_va = 0x18487f60000 end_va = 0x18487f62fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487f60000" filename = "" Region: id = 1091 start_va = 0x184880e0000 end_va = 0x184880e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184880e0000" filename = "" Region: id = 1094 start_va = 0x7ffa63fb0000 end_va = 0x7ffa64111fff monitored = 0 entry_point = 0x7ffa64001b30 region_type = mapped_file name = "webservices.dll" filename = "\\Windows\\System32\\webservices.dll" (normalized: "c:\\windows\\system32\\webservices.dll") Region: id = 1095 start_va = 0x18488140000 end_va = 0x18488159fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488140000" filename = "" Region: id = 1096 start_va = 0x1848cf30000 end_va = 0x1848d421fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001848cf30000" filename = "" Region: id = 1097 start_va = 0x18487f60000 end_va = 0x18487f61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487f60000" filename = "" Region: id = 1098 start_va = 0x184880e0000 end_va = 0x184880e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184880e0000" filename = "" Region: id = 1099 start_va = 0x18487f60000 end_va = 0x18487f60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487f60000" filename = "" Region: id = 1100 start_va = 0x184880f0000 end_va = 0x184880f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184880f0000" filename = "" Region: id = 1101 start_va = 0x18488100000 end_va = 0x1848810efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018488100000" filename = "" Region: id = 1102 start_va = 0x18488110000 end_va = 0x1848811efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488110000" filename = "" Region: id = 1103 start_va = 0x18488120000 end_va = 0x1848812ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488120000" filename = "" Region: id = 1104 start_va = 0x18488130000 end_va = 0x1848813ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488130000" filename = "" Region: id = 1105 start_va = 0x18488140000 end_va = 0x1848814ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488140000" filename = "" Region: id = 1106 start_va = 0x18488130000 end_va = 0x18488130fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488130000" filename = "" Region: id = 1107 start_va = 0x18488140000 end_va = 0x18488140fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488140000" filename = "" Region: id = 1108 start_va = 0x18488150000 end_va = 0x18488166fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488150000" filename = "" Region: id = 1109 start_va = 0x18488130000 end_va = 0x1848813ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488130000" filename = "" Region: id = 1110 start_va = 0x18488170000 end_va = 0x18488189fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488170000" filename = "" Region: id = 1111 start_va = 0x18488140000 end_va = 0x1848814ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488140000" filename = "" Region: id = 1112 start_va = 0x18488150000 end_va = 0x1848815ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488150000" filename = "" Region: id = 1113 start_va = 0x18488130000 end_va = 0x1848813ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488130000" filename = "" Region: id = 1114 start_va = 0x18488140000 end_va = 0x1848814ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488140000" filename = "" Region: id = 1115 start_va = 0x18488130000 end_va = 0x184881aefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488130000" filename = "" Region: id = 1116 start_va = 0x184881b0000 end_va = 0x184881dcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184881b0000" filename = "" Region: id = 1117 start_va = 0x18488130000 end_va = 0x18488130fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488130000" filename = "" Region: id = 1118 start_va = 0x18488140000 end_va = 0x18488146fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488140000" filename = "" Region: id = 1119 start_va = 0x18488150000 end_va = 0x18488150fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488150000" filename = "" Region: id = 1120 start_va = 0x18488130000 end_va = 0x18488130fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488130000" filename = "" Region: id = 1121 start_va = 0x1848cf30000 end_va = 0x1848defffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848cf30000" filename = "" Region: id = 1122 start_va = 0x1848ef70000 end_va = 0x1848f133fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848ef70000" filename = "" Region: id = 1123 start_va = 0x18488160000 end_va = 0x18488162fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488160000" filename = "" Region: id = 1124 start_va = 0x1848f140000 end_va = 0x1848f631fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001848f140000" filename = "" Region: id = 1125 start_va = 0x1848f640000 end_va = 0x1848f9c8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848f640000" filename = "" Region: id = 1126 start_va = 0x6c83a00000 end_va = 0x6c83afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c83a00000" filename = "" Region: id = 1127 start_va = 0x18487f60000 end_va = 0x18487f61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487f60000" filename = "" Region: id = 1128 start_va = 0x184880e0000 end_va = 0x184880e1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184880e0000" filename = "" Region: id = 1129 start_va = 0x184880f0000 end_va = 0x184880f4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184880f0000" filename = "" Region: id = 1130 start_va = 0x18488100000 end_va = 0x1848810bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488100000" filename = "" Region: id = 1131 start_va = 0x18488160000 end_va = 0x18488164fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488160000" filename = "" Region: id = 1132 start_va = 0x18488170000 end_va = 0x18488171fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488170000" filename = "" Region: id = 1133 start_va = 0x18488180000 end_va = 0x1848821cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488180000" filename = "" Region: id = 1134 start_va = 0x18488220000 end_va = 0x1848822ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488220000" filename = "" Region: id = 1135 start_va = 0x18488230000 end_va = 0x1848823ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488230000" filename = "" Region: id = 1136 start_va = 0x18488240000 end_va = 0x18488240fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488240000" filename = "" Region: id = 1137 start_va = 0x18488250000 end_va = 0x18488250fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488250000" filename = "" Region: id = 1138 start_va = 0x18488260000 end_va = 0x18488276fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488260000" filename = "" Region: id = 1139 start_va = 0x18488280000 end_va = 0x18488280fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488280000" filename = "" Region: id = 1140 start_va = 0x18488290000 end_va = 0x18488290fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488290000" filename = "" Region: id = 1141 start_va = 0x184885f0000 end_va = 0x184885f4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184885f0000" filename = "" Region: id = 1142 start_va = 0x18489fe0000 end_va = 0x18489febfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489fe0000" filename = "" Region: id = 1143 start_va = 0x1848a070000 end_va = 0x1848a074fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a070000" filename = "" Region: id = 1144 start_va = 0x1848a090000 end_va = 0x1848a091fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a090000" filename = "" Region: id = 1145 start_va = 0x1848a0a0000 end_va = 0x1848a0a2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0a0000" filename = "" Region: id = 1146 start_va = 0x1848a660000 end_va = 0x1848a6fcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a660000" filename = "" Region: id = 1147 start_va = 0x1848f9d0000 end_va = 0x1848fd97fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001848f9d0000" filename = "" Region: id = 1148 start_va = 0x1848fda0000 end_va = 0x18490167fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001848fda0000" filename = "" Region: id = 1149 start_va = 0x18490170000 end_va = 0x18490537fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018490170000" filename = "" Region: id = 1150 start_va = 0x1848a0b0000 end_va = 0x1848a0b2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0b0000" filename = "" Region: id = 1151 start_va = 0x18483b10000 end_va = 0x18483b16fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018483b10000" filename = "" Region: id = 1152 start_va = 0x18483b20000 end_va = 0x18483b26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018483b20000" filename = "" Region: id = 1153 start_va = 0x184873d0000 end_va = 0x184876a4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184873d0000" filename = "" Region: id = 1154 start_va = 0x184876b0000 end_va = 0x18487984fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184876b0000" filename = "" Region: id = 1155 start_va = 0x184879a0000 end_va = 0x184879a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184879a0000" filename = "" Region: id = 1156 start_va = 0x18488160000 end_va = 0x184881fdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018488160000" filename = "" Region: id = 1157 start_va = 0x18488200000 end_va = 0x1848829dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018488200000" filename = "" Region: id = 1158 start_va = 0x184879b0000 end_va = 0x18487a5afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184879b0000" filename = "" Region: id = 1159 start_va = 0x184879b0000 end_va = 0x18487a96fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibri.ttf" filename = "\\Windows\\Fonts\\calibri.ttf" (normalized: "c:\\windows\\fonts\\calibri.ttf") Region: id = 1160 start_va = 0x184879b0000 end_va = 0x18487a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184879b0000" filename = "" Region: id = 1161 start_va = 0x1848f640000 end_va = 0x1848f726fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibri.ttf" filename = "\\Windows\\Fonts\\calibri.ttf" (normalized: "c:\\windows\\fonts\\calibri.ttf") Region: id = 1162 start_va = 0x18487990000 end_va = 0x1848799ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487990000" filename = "" Region: id = 1163 start_va = 0x18487a30000 end_va = 0x18487a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487a30000" filename = "" Region: id = 1164 start_va = 0x18487a40000 end_va = 0x18487a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487a40000" filename = "" Region: id = 1165 start_va = 0x18487a50000 end_va = 0x18487a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487a50000" filename = "" Region: id = 1166 start_va = 0x7ff661e20000 end_va = 0x7ff661e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff661e20000" filename = "" Region: id = 1167 start_va = 0x18487a30000 end_va = 0x18487a33fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487a30000" filename = "" Region: id = 1168 start_va = 0x7ffa76cb0000 end_va = 0x7ffa76cd2fff monitored = 0 entry_point = 0x7ffa76cb3670 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 1169 start_va = 0x7ffa76c30000 end_va = 0x7ffa76c5bfff monitored = 0 entry_point = 0x7ffa76c38210 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 1170 start_va = 0x6c83b00000 end_va = 0x6c83bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006c83b00000" filename = "" Region: id = 1171 start_va = 0x18487a40000 end_va = 0x18487a45fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winmm.dll.mui" filename = "\\Windows\\System32\\en-US\\winmm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winmm.dll.mui") Region: id = 1172 start_va = 0x18487a50000 end_va = 0x18487a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487a50000" filename = "" Region: id = 1173 start_va = 0x18487a50000 end_va = 0x18487a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487a50000" filename = "" Region: id = 1174 start_va = 0x18487a50000 end_va = 0x18487a51fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487a50000" filename = "" Region: id = 1175 start_va = 0x18487a60000 end_va = 0x18487a61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487a60000" filename = "" Region: id = 1176 start_va = 0x18487a70000 end_va = 0x18487a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487a70000" filename = "" Region: id = 1177 start_va = 0x18487a80000 end_va = 0x18487a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487a80000" filename = "" Region: id = 1178 start_va = 0x18487a90000 end_va = 0x18487a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487a90000" filename = "" Region: id = 1179 start_va = 0x18487aa0000 end_va = 0x18487aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487aa0000" filename = "" Region: id = 1180 start_va = 0x18487ab0000 end_va = 0x18487abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487ab0000" filename = "" Region: id = 1181 start_va = 0x18487a80000 end_va = 0x18487a96fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487a80000" filename = "" Region: id = 1182 start_va = 0x18487a50000 end_va = 0x18487a51fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487a50000" filename = "" Region: id = 1183 start_va = 0x18487a60000 end_va = 0x18487a61fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487a60000" filename = "" Region: id = 1184 start_va = 0x18487aa0000 end_va = 0x18487aa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487aa0000" filename = "" Region: id = 1185 start_va = 0x18487ab0000 end_va = 0x18487ab0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487ab0000" filename = "" Region: id = 1186 start_va = 0x18487ac0000 end_va = 0x18487ad6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487ac0000" filename = "" Region: id = 1187 start_va = 0x18487ae0000 end_va = 0x18487ae2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487ae0000" filename = "" Region: id = 1188 start_va = 0x184880f0000 end_va = 0x184880f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184880f0000" filename = "" Region: id = 1189 start_va = 0x18488100000 end_va = 0x18488100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488100000" filename = "" Region: id = 1190 start_va = 0x18488150000 end_va = 0x18488150fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488150000" filename = "" Region: id = 1191 start_va = 0x184885f0000 end_va = 0x184885f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184885f0000" filename = "" Region: id = 1192 start_va = 0x18489fe0000 end_va = 0x18489fe2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489fe0000" filename = "" Region: id = 1193 start_va = 0x1848a070000 end_va = 0x1848a071fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a070000" filename = "" Region: id = 1194 start_va = 0x1848a090000 end_va = 0x1848a092fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a090000" filename = "" Region: id = 1195 start_va = 0x1848a0a0000 end_va = 0x1848a0a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0a0000" filename = "" Region: id = 1196 start_va = 0x1848a0b0000 end_va = 0x1848a0b2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0b0000" filename = "" Region: id = 1197 start_va = 0x1848a0c0000 end_va = 0x1848a0c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0c0000" filename = "" Region: id = 1198 start_va = 0x1848a0f0000 end_va = 0x1848a0f4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0f0000" filename = "" Region: id = 1199 start_va = 0x1848a100000 end_va = 0x1848a101fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a100000" filename = "" Region: id = 1200 start_va = 0x1848a110000 end_va = 0x1848a111fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a110000" filename = "" Region: id = 1201 start_va = 0x18487a80000 end_va = 0x18487a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487a80000" filename = "" Region: id = 1202 start_va = 0x18487a90000 end_va = 0x18487a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487a90000" filename = "" Region: id = 1203 start_va = 0x18487aa0000 end_va = 0x18487aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487aa0000" filename = "" Region: id = 1204 start_va = 0x18487ab0000 end_va = 0x18487abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487ab0000" filename = "" Region: id = 1205 start_va = 0x18487ac0000 end_va = 0x18487acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487ac0000" filename = "" Region: id = 1206 start_va = 0x18487aa0000 end_va = 0x18487aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487aa0000" filename = "" Region: id = 1207 start_va = 0x18487ab0000 end_va = 0x18487abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487ab0000" filename = "" Region: id = 1208 start_va = 0x18487ac0000 end_va = 0x18487acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487ac0000" filename = "" Region: id = 1209 start_va = 0x18487ad0000 end_va = 0x18487adffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487ad0000" filename = "" Region: id = 1210 start_va = 0x18487aa0000 end_va = 0x18487aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487aa0000" filename = "" Region: id = 1211 start_va = 0x18487ab0000 end_va = 0x18487abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487ab0000" filename = "" Region: id = 1212 start_va = 0x1848f140000 end_va = 0x1848f631fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001848f140000" filename = "" Region: id = 1213 start_va = 0x1848f640000 end_va = 0x1848f71cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibrib.ttf" filename = "\\Windows\\Fonts\\calibrib.ttf" (normalized: "c:\\windows\\fonts\\calibrib.ttf") Region: id = 1214 start_va = 0x18487ac0000 end_va = 0x18487acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487ac0000" filename = "" Region: id = 1215 start_va = 0x18487ad0000 end_va = 0x18487adffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487ad0000" filename = "" Region: id = 1216 start_va = 0x18487ac0000 end_va = 0x18487acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487ac0000" filename = "" Region: id = 1217 start_va = 0x18487ad0000 end_va = 0x18487adffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487ad0000" filename = "" Region: id = 1218 start_va = 0x18487ae0000 end_va = 0x18487aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487ae0000" filename = "" Region: id = 1219 start_va = 0x184880f0000 end_va = 0x184880fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184880f0000" filename = "" Region: id = 1220 start_va = 0x18487ac0000 end_va = 0x18487ac3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018487ac0000" filename = "" Region: id = 1221 start_va = 0x18487ad0000 end_va = 0x18487ad1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487ad0000" filename = "" Region: id = 1222 start_va = 0x18487ae0000 end_va = 0x18487ae1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487ae0000" filename = "" Region: id = 1223 start_va = 0x1848f640000 end_va = 0x1848f73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848f640000" filename = "" Region: id = 1224 start_va = 0x184880f0000 end_va = 0x184880fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184880f0000" filename = "" Region: id = 1225 start_va = 0x18488100000 end_va = 0x1848810ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488100000" filename = "" Region: id = 1226 start_va = 0x18488150000 end_va = 0x1848815ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488150000" filename = "" Region: id = 1227 start_va = 0x184885f0000 end_va = 0x184885fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184885f0000" filename = "" Region: id = 1228 start_va = 0x18488150000 end_va = 0x1848815ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488150000" filename = "" Region: id = 1229 start_va = 0x184885f0000 end_va = 0x184885fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184885f0000" filename = "" Region: id = 1230 start_va = 0x7ff661e10000 end_va = 0x7ff661e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff661e10000" filename = "" Region: id = 1231 start_va = 0x18488150000 end_va = 0x1848815ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018488150000" filename = "" Region: id = 1232 start_va = 0x184885f0000 end_va = 0x184885fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184885f0000" filename = "" Region: id = 1233 start_va = 0x18489fe0000 end_va = 0x18489fe3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489fe0000" filename = "" Region: id = 1234 start_va = 0x1848a070000 end_va = 0x1848a07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a070000" filename = "" Region: id = 1235 start_va = 0x1848a090000 end_va = 0x1848a09ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a090000" filename = "" Region: id = 1236 start_va = 0x1848a070000 end_va = 0x1848a07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a070000" filename = "" Region: id = 1237 start_va = 0x1848a090000 end_va = 0x1848a09ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a090000" filename = "" Region: id = 1238 start_va = 0x18489fe0000 end_va = 0x18489feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489fe0000" filename = "" Region: id = 1239 start_va = 0x1848a0a0000 end_va = 0x1848a0affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0a0000" filename = "" Region: id = 1240 start_va = 0x1848a0b0000 end_va = 0x1848a0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0b0000" filename = "" Region: id = 1241 start_va = 0x18489fe0000 end_va = 0x18489fe1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489fe0000" filename = "" Region: id = 1242 start_va = 0x1848a070000 end_va = 0x1848a071fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a070000" filename = "" Region: id = 1243 start_va = 0x18489fe0000 end_va = 0x18489fe1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489fe0000" filename = "" Region: id = 1244 start_va = 0x1848a070000 end_va = 0x1848a070fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a070000" filename = "" Region: id = 1245 start_va = 0x1848a090000 end_va = 0x1848a091fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a090000" filename = "" Region: id = 1246 start_va = 0x1848a0a0000 end_va = 0x1848a0affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0a0000" filename = "" Region: id = 1247 start_va = 0x1848a0b0000 end_va = 0x1848a0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0b0000" filename = "" Region: id = 1248 start_va = 0x1848a0b0000 end_va = 0x1848a0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0b0000" filename = "" Region: id = 1249 start_va = 0x1848a0c0000 end_va = 0x1848a0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0c0000" filename = "" Region: id = 1250 start_va = 0x1848a0f0000 end_va = 0x1848a0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0f0000" filename = "" Region: id = 1251 start_va = 0x1848a0c0000 end_va = 0x1848a0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0c0000" filename = "" Region: id = 1252 start_va = 0x1848a0f0000 end_va = 0x1848a0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0f0000" filename = "" Region: id = 1253 start_va = 0x1848a100000 end_va = 0x1848a10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a100000" filename = "" Region: id = 1254 start_va = 0x1848a0c0000 end_va = 0x1848a0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0c0000" filename = "" Region: id = 1255 start_va = 0x1848a0f0000 end_va = 0x1848a0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a0f0000" filename = "" Region: id = 1256 start_va = 0x1848a100000 end_va = 0x1848a10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a100000" filename = "" Region: id = 1257 start_va = 0x1848a110000 end_va = 0x1848a11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a110000" filename = "" Region: id = 1258 start_va = 0x1848a120000 end_va = 0x1848a12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a120000" filename = "" Region: id = 1259 start_va = 0x1848a130000 end_va = 0x1848a13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a130000" filename = "" Region: id = 1260 start_va = 0x7ff661e00000 end_va = 0x7ff661e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff661e00000" filename = "" Region: id = 1261 start_va = 0x1848a100000 end_va = 0x1848a10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a100000" filename = "" Region: id = 1262 start_va = 0x1848a110000 end_va = 0x1848a11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a110000" filename = "" Region: id = 1263 start_va = 0x1848a120000 end_va = 0x1848a12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a120000" filename = "" Region: id = 1264 start_va = 0x1848a100000 end_va = 0x1848a103fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a100000" filename = "" Region: id = 1265 start_va = 0x1848aaf0000 end_va = 0x1848aba2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848aaf0000" filename = "" Region: id = 1266 start_va = 0x1848f740000 end_va = 0x1849070ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848f740000" filename = "" Region: id = 1267 start_va = 0x184879a0000 end_va = 0x184879a4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000184879a0000" filename = "" Region: id = 1268 start_va = 0x18489fe0000 end_va = 0x18489fe3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018489fe0000" filename = "" Region: id = 1269 start_va = 0x1848a070000 end_va = 0x1848a070fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a070000" filename = "" Region: id = 1270 start_va = 0x1848aaf0000 end_va = 0x1848abb3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cambriab.ttf" filename = "\\Windows\\Fonts\\cambriab.ttf" (normalized: "c:\\windows\\fonts\\cambriab.ttf") Region: id = 1271 start_va = 0x18485960000 end_va = 0x18485963fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018485960000" filename = "" Region: id = 1272 start_va = 0x1848a090000 end_va = 0x1848a09ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a090000" filename = "" Region: id = 1273 start_va = 0x1848a110000 end_va = 0x1848a11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a110000" filename = "" Region: id = 1274 start_va = 0x1848a120000 end_va = 0x1848a12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a120000" filename = "" Region: id = 1275 start_va = 0x1848a130000 end_va = 0x1848a13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a130000" filename = "" Region: id = 1276 start_va = 0x1848a150000 end_va = 0x1848a15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a150000" filename = "" Region: id = 1277 start_va = 0x1848a660000 end_va = 0x1848a66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a660000" filename = "" Region: id = 1278 start_va = 0x1848a130000 end_va = 0x1848a13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a130000" filename = "" Region: id = 1279 start_va = 0x1848a150000 end_va = 0x1848a15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a150000" filename = "" Region: id = 1280 start_va = 0x1848a660000 end_va = 0x1848a66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a660000" filename = "" Region: id = 1281 start_va = 0x1848a670000 end_va = 0x1848a67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a670000" filename = "" Region: id = 1282 start_va = 0x1848a130000 end_va = 0x1848a13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a130000" filename = "" Region: id = 1283 start_va = 0x1848a150000 end_va = 0x1848a15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a150000" filename = "" Region: id = 1284 start_va = 0x1848a660000 end_va = 0x1848a66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a660000" filename = "" Region: id = 1285 start_va = 0x1848a150000 end_va = 0x1848a15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a150000" filename = "" Region: id = 1286 start_va = 0x1848a660000 end_va = 0x1848a66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a660000" filename = "" Region: id = 1287 start_va = 0x1848a670000 end_va = 0x1848a67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a670000" filename = "" Region: id = 1288 start_va = 0x1848a680000 end_va = 0x1848a68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a680000" filename = "" Region: id = 1289 start_va = 0x1848a690000 end_va = 0x1848a69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a690000" filename = "" Region: id = 1290 start_va = 0x1848a6a0000 end_va = 0x1848a6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6a0000" filename = "" Region: id = 1291 start_va = 0x1848a6b0000 end_va = 0x1848a6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6b0000" filename = "" Region: id = 1292 start_va = 0x1848a6c0000 end_va = 0x1848a6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6c0000" filename = "" Region: id = 1293 start_va = 0x1848a6d0000 end_va = 0x1848a6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6d0000" filename = "" Region: id = 1294 start_va = 0x1848a6e0000 end_va = 0x1848a6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6e0000" filename = "" Region: id = 1295 start_va = 0x1848a6f0000 end_va = 0x1848a6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6f0000" filename = "" Region: id = 1296 start_va = 0x1848a680000 end_va = 0x1848a68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a680000" filename = "" Region: id = 1297 start_va = 0x1848a690000 end_va = 0x1848a69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a690000" filename = "" Region: id = 1298 start_va = 0x1848a680000 end_va = 0x1848a68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a680000" filename = "" Region: id = 1299 start_va = 0x1848a690000 end_va = 0x1848a69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a690000" filename = "" Region: id = 1300 start_va = 0x1848a6a0000 end_va = 0x1848a6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6a0000" filename = "" Region: id = 1301 start_va = 0x7ff661df0000 end_va = 0x7ff661dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff661df0000" filename = "" Region: id = 1302 start_va = 0x1848a690000 end_va = 0x1848a69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a690000" filename = "" Region: id = 1303 start_va = 0x18490710000 end_va = 0x184907ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibrib.ttf" filename = "\\Windows\\Fonts\\calibrib.ttf" (normalized: "c:\\windows\\fonts\\calibrib.ttf") Region: id = 1304 start_va = 0x1848a6a0000 end_va = 0x1848a6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6a0000" filename = "" Region: id = 1305 start_va = 0x1848a6b0000 end_va = 0x1848a6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6b0000" filename = "" Region: id = 1306 start_va = 0x1848a6c0000 end_va = 0x1848a6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6c0000" filename = "" Region: id = 1307 start_va = 0x1848a6d0000 end_va = 0x1848a6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6d0000" filename = "" Region: id = 1308 start_va = 0x1848a6a0000 end_va = 0x1848a6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6a0000" filename = "" Region: id = 1309 start_va = 0x1848a6b0000 end_va = 0x1848a6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6b0000" filename = "" Region: id = 1310 start_va = 0x1848a6c0000 end_va = 0x1848a6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6c0000" filename = "" Region: id = 1311 start_va = 0x1848a6b0000 end_va = 0x1848a6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6b0000" filename = "" Region: id = 1312 start_va = 0x1848a6c0000 end_va = 0x1848a6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6c0000" filename = "" Region: id = 1313 start_va = 0x1848a6d0000 end_va = 0x1848a6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6d0000" filename = "" Region: id = 1314 start_va = 0x1848a6e0000 end_va = 0x1848a6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6e0000" filename = "" Region: id = 1315 start_va = 0x1848a6f0000 end_va = 0x1848a6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6f0000" filename = "" Region: id = 1316 start_va = 0x1848a710000 end_va = 0x1848a71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a710000" filename = "" Region: id = 1317 start_va = 0x1848a720000 end_va = 0x1848a72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a720000" filename = "" Region: id = 1318 start_va = 0x1848a730000 end_va = 0x1848a73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a730000" filename = "" Region: id = 1319 start_va = 0x1848a740000 end_va = 0x1848a74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a740000" filename = "" Region: id = 1320 start_va = 0x1848a6d0000 end_va = 0x1848a6d3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6d0000" filename = "" Region: id = 1321 start_va = 0x18490710000 end_va = 0x184908b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cambria.ttc" filename = "\\Windows\\Fonts\\cambria.ttc" (normalized: "c:\\windows\\fonts\\cambria.ttc") Region: id = 1322 start_va = 0x1848a6e0000 end_va = 0x1848a6e3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6e0000" filename = "" Region: id = 1323 start_va = 0x18487f40000 end_va = 0x18487f40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018487f40000" filename = "" Region: id = 1324 start_va = 0x1848a6f0000 end_va = 0x1848a6f3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a6f0000" filename = "" Region: id = 1325 start_va = 0x1848a710000 end_va = 0x1848a710fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001848a710000" filename = "" Region: id = 1326 start_va = 0x1848a760000 end_va = 0x1848a760fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a760000" filename = "" Region: id = 1327 start_va = 0x1848a770000 end_va = 0x1848a770fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001848a770000" filename = "" Region: id = 1328 start_va = 0x1848aaf0000 end_va = 0x1848aba2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848aaf0000" filename = "" Region: id = 1329 start_va = 0x1848a810000 end_va = 0x1848a8adfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001848a810000" filename = "" Region: id = 1330 start_va = 0x1848aaf0000 end_va = 0x1848ab8dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001848aaf0000" filename = "" Region: id = 1331 start_va = 0x1848df00000 end_va = 0x1848df9dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001848df00000" filename = "" Region: id = 1332 start_va = 0x18490710000 end_va = 0x184907acfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018490710000" filename = "" Region: id = 1333 start_va = 0x184907b0000 end_va = 0x18490baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000184907b0000" filename = "" Region: id = 1334 start_va = 0x18490bb0000 end_va = 0x18490c4dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000018490bb0000" filename = "" Region: id = 1335 start_va = 0x1848a070000 end_va = 0x1848a071fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a070000" filename = "" Region: id = 1336 start_va = 0x1848a730000 end_va = 0x1848a730fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a730000" filename = "" Region: id = 1337 start_va = 0x1848a720000 end_va = 0x1848a720fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a720000" filename = "" Region: id = 1338 start_va = 0x1848a740000 end_va = 0x1848a740fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001848a740000" filename = "" Region: id = 1339 start_va = 0x18490bb0000 end_va = 0x18490c62fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000018490bb0000" filename = "" Region: id = 1340 start_va = 0x1848a7f0000 end_va = 0x1848a7f5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001848a7f0000" filename = "" Thread: id = 1 os_tid = 0x2c4 Thread: id = 2 os_tid = 0xb94 Thread: id = 3 os_tid = 0x1084 Thread: id = 4 os_tid = 0x1088 Thread: id = 5 os_tid = 0x1074 Thread: id = 6 os_tid = 0x188 Thread: id = 7 os_tid = 0x554 Thread: id = 8 os_tid = 0x59c Thread: id = 9 os_tid = 0xb54 Thread: id = 10 os_tid = 0x874 Thread: id = 11 os_tid = 0x930 Thread: id = 12 os_tid = 0x688 Thread: id = 13 os_tid = 0x13fc Thread: id = 14 os_tid = 0x13f8 Thread: id = 15 os_tid = 0x13e4 Thread: id = 16 os_tid = 0x13c4 Thread: id = 17 os_tid = 0x13bc Thread: id = 18 os_tid = 0x13b8 Thread: id = 19 os_tid = 0x13b4 Thread: id = 20 os_tid = 0x13ac Thread: id = 21 os_tid = 0x13a8 Thread: id = 22 os_tid = 0x13a4 Thread: id = 23 os_tid = 0x13a0 Thread: id = 24 os_tid = 0x139c Thread: id = 25 os_tid = 0x1398 Thread: id = 26 os_tid = 0x1394 Thread: id = 27 os_tid = 0x1390 Thread: id = 28 os_tid = 0x138c Thread: id = 29 os_tid = 0x1384 [0090.668] DispCallFunc (pvInstance=0x1848c033e28, oVft=0x38, cc=0x4, vtReturn=0xa, cActuals=0x0, prgvt=0x0, prgpvarg=0x0, pvargResult=0x6c81391050) returned 0x0 [0090.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1000, lpStartAddress=0x7ffa5e951498, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x6c81390b00 | out: lpThreadId=0x6c81390b00*=0xcec) returned 0x1014 [0090.684] PeekMessageA (in: lpMsg=0x6c81390aa0, hWnd=0x40426, wMsgFilterMin=0x1045, wMsgFilterMax=0x1045, wRemoveMsg=0x3 | out: lpMsg=0x6c81390aa0) returned 0 [0090.685] GetActiveWindow () returned 0x0 [0090.690] CRetailMalloc_Alloc () returned 0x1848925e720 [0090.690] CRetailMalloc_Alloc () returned 0x18481555e30 [0091.058] CRetailMalloc_Alloc () returned 0x1848925eb40 [0091.058] CRetailMalloc_Alloc () returned 0x18485f6ac10 [0091.440] CRetailMalloc_Alloc () returned 0x1848925eeb0 [0091.440] CRetailMalloc_Alloc () returned 0x18481559430 [0091.737] CRetailMalloc_Alloc () returned 0x184892602a0 [0091.737] CRetailMalloc_Alloc () returned 0x1848c6d4c50 [0091.983] CRetailMalloc_Alloc () returned 0x1848925f220 [0091.983] CRetailMalloc_Alloc () returned 0x1848c6c4e90 [0092.095] CRetailMalloc_Alloc () returned 0x1848925fbc0 [0092.096] CRetailMalloc_Alloc () returned 0x1848c6b8410 [0092.220] CRetailMalloc_Alloc () returned 0x1848925fc70 [0092.220] CRetailMalloc_Alloc () returned 0x1848c548ea0 [0092.660] CRetailMalloc_Alloc () returned 0x1848c572d20 [0092.660] CRetailMalloc_Alloc () returned 0x1848c555e60 [0093.019] CRetailMalloc_Alloc () returned 0x1848c573140 [0093.019] CRetailMalloc_Alloc () returned 0x1848c5475a0 [0093.024] GetUserDefaultLCID () returned 0x409 [0093.024] VarBstrFromI2 (iVal=1, lcid=0x409, dwFlags=0x0, pbstrOut=0x6c81390ba8*="ʟx￿ٱšЊ⦆￿׷\x0cʗク￿Őͧー￿׷\rŐЊィ￿dz࢘") returned 0x0 [0093.024] VarBstrCat (in: bstrLeft="HKCU\\Software\\Microsoft\\Office\\", bstrRight="16.0", pbstrResult=0x6c81390bb0 | out: pbstrResult=0x6c81390bb0) returned 0x0 [0093.024] VarBstrCat (in: bstrLeft="HKCU\\Software\\Microsoft\\Office\\16.0", bstrRight="\\Excel\\Security\\VBAWarnings", pbstrResult=0x6c81390bb0 | out: pbstrResult=0x6c81390bb0) returned 0x0 [0093.026] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x6c813908a8 | out: lpclsid=0x6c813908a8*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0093.029] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0093.029] CoCreateInstance (in: rclsid=0x6c813908a8*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), pUnkOuter=0x0, dwClsContext=0x15, riid=0x7ffa5ecdaa48*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x6c81390858 | out: ppv=0x6c81390858*=0x184870c6788) returned 0x0 [0093.060] WshShell:IUnknown:QueryInterface (in: This=0x184870c6788, riid=0x7ffa5ecf4590*(Data1=0x7fd52380, Data2=0x4e07, Data3=0x101b, Data4=([0]=0xae, [1]=0x2d, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2e, [6]=0xc7, [7]=0x13)), ppvObject=0x6c81390870 | out: ppvObject=0x6c81390870*=0x0) returned 0x80004002 [0093.060] WshShell:IUnknown:QueryInterface (in: This=0x184870c6788, riid=0x7ffa5ecf45a0*(Data1=0x37d84f60, Data2=0x42cb, Data3=0x11ce, Data4=([0]=0x81, [1]=0x35, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xb8, [7]=0x51)), ppvObject=0x6c81390878 | out: ppvObject=0x6c81390878*=0x0) returned 0x80004002 [0093.060] WshShell:IUnknown:QueryInterface (in: This=0x184870c6788, riid=0x7ffa5ecdaa68*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x6c81390938 | out: ppvObject=0x6c81390938*=0x184870c6760) returned 0x0 [0093.060] WshShell:IUnknown:Release (This=0x184870c6788) returned 0x1 [0093.060] WshShell:IUnknown:AddRef (This=0x184870c6760) returned 0x2 [0093.060] WshShell:IUnknown:Release (This=0x184870c6760) returned 0x1 [0093.060] WshShell:IDispatch:GetIDsOfNames (in: This=0x184870c6760, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c81390a40*="RegWrite", cNames=0x1, lcid=0x18400000409, rgDispId=0x6c81390a24 | out: rgDispId=0x6c81390a24*=2001) returned 0x0 [0093.066] WshShell:IDispatch:Invoke (in: This=0x184870c6760, dispIdMember=2001, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x6c813909d8*(rgvarg=([0]=0x18488eeb0e0*(varType=0x4008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18488eeb1b0*="REG_DWORD", varVal2=0x18488eeb1b0), [1]=0x18488eeb0f8*(varType=0x4008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18488eeb1b8*="1", varVal2=0x18488eeb1b8), [2]=0x18488eeb110*(varType=0x4008, wReserved1=0x88ee, wReserved2=0x184, wReserved3=0x0, varVal1=0x18488eeb1c0*="HKCU\\Software\\Microsoft\\Office\\16.0\\Excel\\Security\\VBAWarnings", varVal2=0x18488eeb1c0)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x6c813909f0, puArgErr=0x6c813909d0 | out: pDispParams=0x6c813909d8*(rgvarg=([0]=0x18488eeb0e0*(varType=0x4008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18488eeb1b0*="REG_DWORD", varVal2=0x18488eeb1b0), [1]=0x18488eeb0f8*(varType=0x4008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18488eeb1b8*="1", varVal2=0x18488eeb1b8), [2]=0x18488eeb110*(varType=0x4008, wReserved1=0x88ee, wReserved2=0x184, wReserved3=0x0, varVal1=0x18488eeb1c0*="HKCU\\Software\\Microsoft\\Office\\16.0\\Excel\\Security\\VBAWarnings", varVal2=0x18488eeb1c0)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x6c813909f0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c813909d0*=0x8c0a6dc0) returned 0x0 [0093.066] WshShell:IUnknown:Release (This=0x184870c6760) returned 0x0 [0093.067] GetUserDefaultLCID () returned 0x409 [0093.067] VarBstrFromI2 (iVal=1, lcid=0x409, dwFlags=0x0, pbstrOut=0x6c81390ba8*="ʟx￿ٱšЊ⦆￿׷\x0cʗク￿Őͧー￿׷\x0eŐЊィ￿dz࢘") returned 0x0 [0093.067] VarBstrCat (in: bstrLeft="HKCU\\Software\\Microsoft\\Office\\", bstrRight="16.0", pbstrResult=0x6c81390bb0 | out: pbstrResult=0x6c81390bb0) returned 0x0 [0093.067] VarBstrCat (in: bstrLeft="HKCU\\Software\\Microsoft\\Office\\16.0", bstrRight="\\Word\\Security\\VBAWarnings", pbstrResult=0x6c81390bb0 | out: pbstrResult=0x6c81390bb0) returned 0x0 [0093.067] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x6c813908a8 | out: lpclsid=0x6c813908a8*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0093.067] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0093.067] CoCreateInstance (in: rclsid=0x6c813908a8*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), pUnkOuter=0x0, dwClsContext=0x15, riid=0x7ffa5ecdaa48*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x6c81390858 | out: ppv=0x6c81390858*=0x184870c65a8) returned 0x0 [0093.156] WshShell:IUnknown:QueryInterface (in: This=0x184870c65a8, riid=0x7ffa5ecf4590*(Data1=0x7fd52380, Data2=0x4e07, Data3=0x101b, Data4=([0]=0xae, [1]=0x2d, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2e, [6]=0xc7, [7]=0x13)), ppvObject=0x6c81390870 | out: ppvObject=0x6c81390870*=0x0) returned 0x80004002 [0093.156] WshShell:IUnknown:QueryInterface (in: This=0x184870c65a8, riid=0x7ffa5ecf45a0*(Data1=0x37d84f60, Data2=0x42cb, Data3=0x11ce, Data4=([0]=0x81, [1]=0x35, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xb8, [7]=0x51)), ppvObject=0x6c81390878 | out: ppvObject=0x6c81390878*=0x0) returned 0x80004002 [0093.156] WshShell:IUnknown:QueryInterface (in: This=0x184870c65a8, riid=0x7ffa5ecdaa68*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x6c81390938 | out: ppvObject=0x6c81390938*=0x184870c6580) returned 0x0 [0093.156] WshShell:IUnknown:Release (This=0x184870c65a8) returned 0x1 [0093.156] WshShell:IUnknown:AddRef (This=0x184870c6580) returned 0x2 [0093.156] WshShell:IUnknown:Release (This=0x184870c6580) returned 0x1 [0093.156] WshShell:IDispatch:GetIDsOfNames (in: This=0x184870c6580, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c81390a40*="RegWrite", cNames=0x1, lcid=0x18400000409, rgDispId=0x6c81390a24 | out: rgDispId=0x6c81390a24*=2001) returned 0x0 [0093.158] WshShell:IDispatch:Invoke (in: This=0x184870c6580, dispIdMember=2001, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x6c813909d8*(rgvarg=([0]=0x18488eeb0e0*(varType=0x4008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18488eeb1b0*="REG_DWORD", varVal2=0x18488eeb1b0), [1]=0x18488eeb0f8*(varType=0x4008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18488eeb1b8*="1", varVal2=0x18488eeb1b8), [2]=0x18488eeb110*(varType=0x4008, wReserved1=0x88ee, wReserved2=0x184, wReserved3=0x0, varVal1=0x18488eeb1c0*="HKCU\\Software\\Microsoft\\Office\\16.0\\Word\\Security\\VBAWarnings", varVal2=0x18488eeb1c0)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x6c813909f0, puArgErr=0x6c813909d0 | out: pDispParams=0x6c813909d8*(rgvarg=([0]=0x18488eeb0e0*(varType=0x4008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18488eeb1b0*="REG_DWORD", varVal2=0x18488eeb1b0), [1]=0x18488eeb0f8*(varType=0x4008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18488eeb1b8*="1", varVal2=0x18488eeb1b8), [2]=0x18488eeb110*(varType=0x4008, wReserved1=0x88ee, wReserved2=0x184, wReserved3=0x0, varVal1=0x18488eeb1c0*="HKCU\\Software\\Microsoft\\Office\\16.0\\Word\\Security\\VBAWarnings", varVal2=0x18488eeb1c0)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x6c813909f0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c813909d0*=0x8c0a6dc0) returned 0x0 [0093.159] WshShell:IUnknown:Release (This=0x184870c6580) returned 0x0 [0093.327] memcpy (in: _Dst=0x18488eeb180, _Src=0x18485e031c8, _Size=0x20 | out: _Dst=0x18488eeb180) returned 0x18488eeb180 [0093.327] SafeArrayAllocData (psa=0x18488eeb180) returned 0x0 [0093.328] memcpy (in: _Dst=0x18488eeb140, _Src=0x18485e03210, _Size=0x20 | out: _Dst=0x18488eeb140) returned 0x18488eeb140 [0093.328] SafeArrayAllocData (psa=0x18488eeb140) returned 0x0 [0093.328] CLSIDFromProgIDEx (in: lpszProgID="scripting.filesystemobject", lpclsid=0x6c813908a8 | out: lpclsid=0x6c813908a8*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28))) returned 0x0 [0093.330] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0093.330] CoCreateInstance (in: rclsid=0x6c813908a8*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28)), pUnkOuter=0x0, dwClsContext=0x15, riid=0x7ffa5ecdaa48*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x6c81390858 | out: ppv=0x6c81390858*=0x18487149ba0) returned 0x0 [0093.337] FileSystemObject:IUnknown:QueryInterface (in: This=0x18487149ba0, riid=0x7ffa5ecf4590*(Data1=0x7fd52380, Data2=0x4e07, Data3=0x101b, Data4=([0]=0xae, [1]=0x2d, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2e, [6]=0xc7, [7]=0x13)), ppvObject=0x6c81390870 | out: ppvObject=0x6c81390870*=0x0) returned 0x80004002 [0093.337] FileSystemObject:IUnknown:QueryInterface (in: This=0x18487149ba0, riid=0x7ffa5ecf45a0*(Data1=0x37d84f60, Data2=0x42cb, Data3=0x11ce, Data4=([0]=0x81, [1]=0x35, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xb8, [7]=0x51)), ppvObject=0x6c81390878 | out: ppvObject=0x6c81390878*=0x0) returned 0x80004002 [0093.337] FileSystemObject:IUnknown:QueryInterface (in: This=0x18487149ba0, riid=0x7ffa5ecdaa68*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x6c81390938 | out: ppvObject=0x6c81390938*=0x18487149ba0) returned 0x0 [0093.337] FileSystemObject:IUnknown:Release (This=0x18487149ba0) returned 0x1 [0093.338] FileSystemObject:IUnknown:AddRef (This=0x18487149ba0) returned 0x2 [0093.338] FileSystemObject:IUnknown:Release (This=0x18487149ba0) returned 0x1 [0093.341] VarBstrCat (in: bstrLeft="C:\\Users\\RDhJ0CNFevzX\\Desktop", bstrRight="\\~$cache1", pbstrResult=0x6c81390a50 | out: pbstrResult=0x6c81390a50) returned 0x0 [0093.341] VarBstrCat (in: bstrLeft="C:\\Users\\RDhJ0CNFevzX\\Desktop", bstrRight="\\Synaptics.exe", pbstrResult=0x6c81390a50 | out: pbstrResult=0x6c81390a50) returned 0x0 [0093.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Temp", cchWideChar=5, lpMultiByteStr=0x6c813908b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Temp", lpUsedDefaultChar=0x0) returned 5 [0093.342] getenv_s (in: _ReturnSize=0x6c81390818, _DstBuf=0x0, _DstSize=0x0, _VarName="Temp" | out: _ReturnSize=0x6c81390818, _DstBuf=0x0) returned 0x0 [0093.342] CRetailMalloc_Alloc () returned 0x1848c5e0820 [0093.342] getenv_s (in: _ReturnSize=0x6c81390818, _DstBuf=0x1848c5e0820, _DstSize=0x25, _VarName="Temp" | out: _ReturnSize=0x6c81390818, _DstBuf="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp") returned 0x0 [0093.342] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp", cbMultiByte=37, lpWideCharStr=0x1848c572a68, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp") returned 37 [0093.342] SysReAllocStringLen (in: pbstr=0x6c813907e8*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp", psz=0x0, len=0x24 | out: pbstr=0x6c813907e8*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp") returned 1 [0093.342] CRetailMalloc_Free () returned 0x1 [0093.342] VarBstrCat (in: bstrLeft="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp", bstrRight="\\~$cache1.exe", pbstrResult=0x6c81390a00 | out: pbstrResult=0x6c81390a00) returned 0x0 [0093.343] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x18487149ba0, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c81390a40*="FileExists", cNames=0x1, lcid=0x6c00000409, rgDispId=0x6c81390a24 | out: rgDispId=0x6c81390a24*=10016) returned 0x0 [0093.343] FileSystemObject:IDispatch:Invoke (in: This=0x18487149ba0, dispIdMember=10016, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x6c813909d8*(rgvarg=([0]=0x18488eeb050*(varType=0x400c, wReserved1=0x88ee, wReserved2=0x184, wReserved3=0x0, varVal1=0x18489363960*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\~$cache1", varVal2=0x1848949f6b8), varVal2=0x18489363960)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x18488eeb120, pExcepInfo=0x6c813909f0, puArgErr=0x6c813909d0 | out: pDispParams=0x6c813909d8*(rgvarg=([0]=0x18488eeb050*(varType=0x400c, wReserved1=0x88ee, wReserved2=0x184, wReserved3=0x0, varVal1=0x18489363960*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\~$cache1", varVal2=0x1848949f6b8), varVal2=0x18489363960)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x18488eeb120*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x1848949f6b8), pExcepInfo=0x6c813909f0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c813909d0*=0x81390a24) returned 0x0 [0093.344] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x18487149ba0, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c81390a40*="FileExists", cNames=0x1, lcid=0x409, rgDispId=0x6c81390a24 | out: rgDispId=0x6c81390a24*=10016) returned 0x0 [0093.344] FileSystemObject:IDispatch:Invoke (in: This=0x18487149ba0, dispIdMember=10016, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x6c813909d8*(rgvarg=([0]=0x18488eeb050*(varType=0x400c, wReserved1=0x88ee, wReserved2=0x184, wReserved3=0x0, varVal1=0x18489363978*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Synaptics.exe", varVal2=0x1848949f6b8), varVal2=0x18489363978)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x18488eeb120, pExcepInfo=0x6c813909f0, puArgErr=0x6c813909d0 | out: pDispParams=0x6c813909d8*(rgvarg=([0]=0x18488eeb050*(varType=0x400c, wReserved1=0x88ee, wReserved2=0x184, wReserved3=0x0, varVal1=0x18489363978*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Synaptics.exe", varVal2=0x1848949f6b8), varVal2=0x18489363978)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x18488eeb120*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x1848949f6b8), pExcepInfo=0x6c813909f0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c813909d0*=0x81390a24) returned 0x0 [0093.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE", cchWideChar=16, lpMultiByteStr=0x6c813908b0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE", lpUsedDefaultChar=0x0) returned 16 [0093.344] getenv_s (in: _ReturnSize=0x6c81390818, _DstBuf=0x0, _DstSize=0x0, _VarName="ALLUSERSPROFILE" | out: _ReturnSize=0x6c81390818, _DstBuf=0x0) returned 0x0 [0093.344] CRetailMalloc_Alloc () returned 0x1848c6b1a60 [0093.344] getenv_s (in: _ReturnSize=0x6c81390818, _DstBuf=0x1848c6b1a60, _DstSize=0xf, _VarName="ALLUSERSPROFILE" | out: _ReturnSize=0x6c81390818, _DstBuf="C:\\ProgramData") returned 0x0 [0093.344] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="C:\\ProgramData", cbMultiByte=15, lpWideCharStr=0x18485a0eaa8, cchWideChar=30 | out: lpWideCharStr="C:\\ProgramData") returned 15 [0093.344] SysReAllocStringLen (in: pbstr=0x6c813907e8*="C:\\ProgramData", psz=0x0, len=0xe | out: pbstr=0x6c813907e8*="C:\\ProgramData") returned 1 [0093.344] CRetailMalloc_Free () returned 0x1 [0093.344] VarBstrCat (in: bstrLeft="C:\\ProgramData", bstrRight="\\Synaptics\\Synaptics.exe", pbstrResult=0x6c81390a00 | out: pbstrResult=0x6c81390a00) returned 0x0 [0093.344] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x18487149ba0, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c81390a40*="FileExists", cNames=0x1, lcid=0x6c00000409, rgDispId=0x6c81390a24 | out: rgDispId=0x6c81390a24*=10016) returned 0x0 [0093.344] FileSystemObject:IDispatch:Invoke (in: This=0x18487149ba0, dispIdMember=10016, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x6c813909d8*(rgvarg=([0]=0x18488eeb050*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\ProgramData\\Synaptics\\Synaptics.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x18488eeb070, pExcepInfo=0x6c813909f0, puArgErr=0x6c813909d0 | out: pDispParams=0x6c813909d8*(rgvarg=([0]=0x18488eeb050*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\ProgramData\\Synaptics\\Synaptics.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x18488eeb070*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pExcepInfo=0x6c813909f0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c813909d0*=0x81390a24) returned 0x0 [0093.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WINDIR", cchWideChar=7, lpMultiByteStr=0x6c813908b0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WINDIR", lpUsedDefaultChar=0x0) returned 7 [0093.345] getenv_s (in: _ReturnSize=0x6c81390818, _DstBuf=0x0, _DstSize=0x0, _VarName="WINDIR" | out: _ReturnSize=0x6c81390818, _DstBuf=0x0) returned 0x0 [0093.345] CRetailMalloc_Alloc () returned 0x1848c6b1d60 [0093.345] getenv_s (in: _ReturnSize=0x6c81390818, _DstBuf=0x1848c6b1d60, _DstSize=0xb, _VarName="WINDIR" | out: _ReturnSize=0x6c81390818, _DstBuf="C:\\Windows") returned 0x0 [0093.345] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="C:\\Windows", cbMultiByte=11, lpWideCharStr=0x184893653a8, cchWideChar=22 | out: lpWideCharStr="C:\\Windows") returned 11 [0093.345] SysReAllocStringLen (in: pbstr=0x6c813907e8*="C:\\Windows", psz=0x0, len=0xa | out: pbstr=0x6c813907e8*="C:\\Windows") returned 1 [0093.345] CRetailMalloc_Free () returned 0x1 [0093.345] VarBstrCat (in: bstrLeft="C:\\Windows", bstrRight="\\System32\\Synaptics\\Synaptics.exe", pbstrResult=0x6c81390a00 | out: pbstrResult=0x6c81390a00) returned 0x0 [0093.345] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x18487149ba0, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c81390a40*="FileExists", cNames=0x1, lcid=0x6c00000409, rgDispId=0x6c81390a24 | out: rgDispId=0x6c81390a24*=10016) returned 0x0 [0093.345] FileSystemObject:IDispatch:Invoke (in: This=0x18487149ba0, dispIdMember=10016, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x6c813909d8*(rgvarg=([0]=0x18488eeb050*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\System32\\Synaptics\\Synaptics.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x18488eeb070, pExcepInfo=0x6c813909f0, puArgErr=0x6c813909d0 | out: pDispParams=0x6c813909d8*(rgvarg=([0]=0x18488eeb050*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\System32\\Synaptics\\Synaptics.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x18488eeb070*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pExcepInfo=0x6c813909f0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c813909d0*=0x81390a24) returned 0x0 [0093.345] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x18487149ba0, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c81390a40*="FileExists", cNames=0x1, lcid=0x409, rgDispId=0x6c81390a24 | out: rgDispId=0x6c81390a24*=10016) returned 0x0 [0093.345] FileSystemObject:IDispatch:Invoke (in: This=0x18487149ba0, dispIdMember=10016, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x6c813909d8*(rgvarg=([0]=0x18488eeb050*(varType=0x400c, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18488eeb160*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\~$cache1.exe", varVal2=0x0), varVal2=0x18488eeb160)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x18488eeb120, pExcepInfo=0x6c813909f0, puArgErr=0x6c813909d0 | out: pDispParams=0x6c813909d8*(rgvarg=([0]=0x18488eeb050*(varType=0x400c, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18488eeb160*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\~$cache1.exe", varVal2=0x0), varVal2=0x18488eeb160)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x18488eeb120*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x1848949f6b8), pExcepInfo=0x6c813909f0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c813909d0*=0x81390a24) returned 0x0 [0093.346] VarNot (in: pvarIn=0x18488eeb120, pvarResult=0x18488eeb0e0 | out: pvarResult=0x18488eeb0e0) returned 0x0 [0093.347] CRetailMalloc_Alloc () returned 0x1848c6b1a60 [0093.347] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x6c8139051c, cchData=6 | out: lpLCData="1252") returned 5 [0093.347] atoi (_Str="1252") returned 1252 [0093.349] GetLocalTime (in: lpSystemTime=0x6c81390510 | out: lpSystemTime=0x6c81390510*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xd, wSecond=0x4, wMilliseconds=0x21d)) [0093.349] CRetailMalloc_Alloc () returned 0x1848c03aae0 [0093.349] CRetailMalloc_Alloc () returned 0x18489261b50 [0093.349] CRetailMalloc_Alloc () returned 0x1848c03c160 [0093.349] CRetailMalloc_Alloc () returned 0x1848c5e0340 [0093.349] CRetailMalloc_Alloc () returned 0x1848c03b860 [0093.349] CRetailMalloc_Alloc () returned 0x18489261d90 [0093.349] CRetailMalloc_Alloc () returned 0x18489261b60 [0093.349] strcpy_s (in: _Dst=0x6c813902f0, _DstSize=0xc8, _Src="Software\\Microsoft\\VBA\\" | out: _Dst="Software\\Microsoft\\VBA\\") returned 0x0 [0093.350] strcat_s (in: _Destination="Software\\Microsoft\\VBA\\", _SizeInBytes=0xc8, _Source="7.1\\Common" | out: _Destination="Software\\Microsoft\\VBA\\7.1\\Common") returned 0x0 [0093.350] RegCreateKeyExA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x7ffa000f003f, lpSecurityAttributes=0x0, phkResult=0x7ffa5ed1d500, lpdwDisposition=0x0 | out: phkResult=0x7ffa5ed1d500*=0x1054, lpdwDisposition=0x0) returned 0x0 [0093.350] RegQueryValueExA (in: hKey=0x1054, lpValueName="RequireDeclaration", lpReserved=0x0, lpType=0x6c813903c8, lpData=0x6c813903c0, lpcbData=0x6c813903c4*=0x4 | out: lpType=0x6c813903c8*=0x0, lpData=0x6c813903c0*=0xa5, lpcbData=0x6c813903c4*=0x4) returned 0x2 [0093.350] RegQueryValueExA (in: hKey=0x1054, lpValueName="CompileOnDemand", lpReserved=0x0, lpType=0x6c813903c8, lpData=0x6c813903c0, lpcbData=0x6c813903c4*=0x4 | out: lpType=0x6c813903c8*=0x0, lpData=0x6c813903c0*=0x0, lpcbData=0x6c813903c4*=0x4) returned 0x2 [0093.350] RegQueryValueExA (in: hKey=0x1054, lpValueName="NotifyUserBeforeStateLoss", lpReserved=0x0, lpType=0x6c813903c8, lpData=0x6c813903c0, lpcbData=0x6c813903c4*=0x4 | out: lpType=0x6c813903c8*=0x0, lpData=0x6c813903c0*=0x1, lpcbData=0x6c813903c4*=0x4) returned 0x2 [0093.350] RegQueryValueExA (in: hKey=0x1054, lpValueName="BackGroundCompile", lpReserved=0x0, lpType=0x6c813903c8, lpData=0x6c813903c0, lpcbData=0x6c813903c4*=0x4 | out: lpType=0x6c813903c8*=0x0, lpData=0x6c813903c0*=0x0, lpcbData=0x6c813903c4*=0x4) returned 0x2 [0093.350] RegQueryValueExA (in: hKey=0x1054, lpValueName="BreakOnAllErrors", lpReserved=0x0, lpType=0x6c813903c8, lpData=0x6c813903c0, lpcbData=0x6c813903c4*=0x4 | out: lpType=0x6c813903c8*=0x0, lpData=0x6c813903c0*=0xff, lpcbData=0x6c813903c4*=0x4) returned 0x2 [0093.350] RegQueryValueExA (in: hKey=0x1054, lpValueName="BreakOnServerErrors", lpReserved=0x0, lpType=0x6c813903c8, lpData=0x6c813903c0, lpcbData=0x6c813903c4*=0x4 | out: lpType=0x6c813903c8*=0x0, lpData=0x6c813903c0*=0x0, lpcbData=0x6c813903c4*=0x4) returned 0x2 [0093.350] RegCloseKey (hKey=0x1054) returned 0x0 [0093.350] CRetailMalloc_Alloc () returned 0x18488cf0190 [0093.350] CRetailMalloc_Alloc () returned 0x18488cf0c20 [0093.350] CRetailMalloc_Alloc () returned 0x1848c654480 [0093.350] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x18488610000 [0093.351] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x2000, flProtect=0x4) returned 0x184886b0000 [0093.353] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Left") returned 0x107be5 [0093.353] VirtualAlloc (lpAddress=0x0, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x18488620000 [0093.353] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Object") returned 0x102ec1 [0093.353] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x18488660000 [0093.354] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x18488670000 [0093.354] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x18488690000 [0093.355] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Intrinsics") returned 0x109464 [0093.355] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x184886f0000 [0093.356] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Unknown") returned 0x10a11d [0093.356] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="") returned 0x10c0b3 [0093.356] CRetailMalloc_Alloc () returned 0x18488bd9840 [0093.356] memcpy (in: _Dst=0x6c8139057c, _Src=0x18488bd9858, _Size=0x2 | out: _Dst=0x6c8139057c) returned 0x6c8139057c [0093.356] memcpy (in: _Dst=0x6c8139057c, _Src=0x18488bd985a, _Size=0x2 | out: _Dst=0x6c8139057c) returned 0x6c8139057c [0093.357] memcpy (in: _Dst=0x6c81390574, _Src=0x18488bd985c, _Size=0x1 | out: _Dst=0x6c81390574) returned 0x6c81390574 [0093.357] memcpy (in: _Dst=0x18488df26f6, _Src=0x18488bd985d, _Size=0x2 | out: _Dst=0x18488df26f6) returned 0x18488df26f6 [0093.357] memcpy (in: _Dst=0x6c81390574, _Src=0x18488bd985f, _Size=0x1 | out: _Dst=0x6c81390574) returned 0x6c81390574 [0093.360] memcpy (in: _Dst=0x18488df26f8, _Src=0x18488bd9860, _Size=0x4 | out: _Dst=0x18488df26f8) returned 0x18488df26f8 [0093.360] memcpy (in: _Dst=0x18488df26fc, _Src=0x18488bd9864, _Size=0x4 | out: _Dst=0x18488df26fc) returned 0x18488df26fc [0093.360] memcpy (in: _Dst=0x18488df2702, _Src=0x18488bd9868, _Size=0x2 | out: _Dst=0x18488df2702) returned 0x18488df2702 [0093.360] memcpy (in: _Dst=0x18488df26f6, _Src=0x18488bd986a, _Size=0x2 | out: _Dst=0x18488df26f6) returned 0x18488df26f6 [0093.360] CompareStringA (Locale=0x416, dwCmpFlags=0x3, lpString1="Test", cchCount1=-1, lpString2="Test", cchCount2=-1) returned 2 [0093.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr="", cbMultiByte=2, lpWideCharStr=0x6c81390398, cchWideChar=2 | out: lpWideCharStr="") returned 2 [0093.360] memcpy (in: _Dst=0x6c81390418, _Src=0x18488bd986c, _Size=0x2 | out: _Dst=0x6c81390418) returned 0x6c81390418 [0093.360] memcpy (in: _Dst=0x6c81390418, _Src=0x18488bd986e, _Size=0x2 | out: _Dst=0x6c81390418) returned 0x6c81390418 [0093.360] memcpy (in: _Dst=0x6c81390320, _Src=0x18488bd9870, _Size=0x4 | out: _Dst=0x6c81390320) returned 0x6c81390320 [0093.360] memcpy (in: _Dst=0x6c81390324, _Src=0x18488bd9874, _Size=0x2 | out: _Dst=0x6c81390324) returned 0x6c81390324 [0093.360] memcpy (in: _Dst=0x6c81390434, _Src=0x18488bd9876, _Size=0x2 | out: _Dst=0x6c81390434) returned 0x6c81390434 [0093.360] memcpy (in: _Dst=0x18488df3b20, _Src=0x18488bd9878, _Size=0x2 | out: _Dst=0x18488df3b20) returned 0x18488df3b20 [0093.361] memcpy (in: _Dst=0x6c813903f0, _Src=0x18488bd987a, _Size=0x2 | out: _Dst=0x6c813903f0) returned 0x6c813903f0 [0093.361] CRetailMalloc_Alloc () returned 0x1848c815e20 [0093.361] memcpy (in: _Dst=0x1848c815e20, _Src=0x18488bd987c, _Size=0x120 | out: _Dst=0x1848c815e20) returned 0x1848c815e20 [0093.361] wcscpy_s (in: _Destination=0x18489456658, _SizeInWords=0x91, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications" | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0093.361] CRetailMalloc_Free () returned 0x1 [0093.361] memcpy (in: _Dst=0x6c81390474, _Src=0x18488bd999c, _Size=0x4 | out: _Dst=0x6c81390474) returned 0x6c81390474 [0093.361] memcpy (in: _Dst=0x6c81390430, _Src=0x18488bd99a0, _Size=0x2 | out: _Dst=0x6c81390430) returned 0x6c81390430 [0093.361] memcpy (in: _Dst=0x6c81390470, _Src=0x18488bd99a2, _Size=0x4 | out: _Dst=0x6c81390470) returned 0x6c81390470 [0093.362] wcsncpy_s (in: _Destination=0x6c81390070, _SizeInWords=0x108, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _MaxCount=0x106 | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0093.362] CharLowerBuffW (in: lpsz="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchLength=0x90 | out: lpsz="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications") returned 0x90 [0093.362] CRetailMalloc_Alloc () returned 0x1848c814b20 [0093.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", cchWideChar=145, lpMultiByteStr=0x1848c814b20, cbMultiByte=290, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", lpUsedDefaultChar=0x0) returned 145 [0093.362] CRetailMalloc_Free () returned 0x1 [0093.362] wcscpy_s (in: _Destination=0x18485a5e698, _SizeInWords=0x91, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications" | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0093.362] wcsncpy_s (in: _Destination=0x6c813900b0, _SizeInWords=0x108, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _MaxCount=0x106 | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0093.362] CharLowerBuffW (in: lpsz="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchLength=0x90 | out: lpsz="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications") returned 0x90 [0093.362] CRetailMalloc_Alloc () returned 0x1848c815f50 [0093.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", cchWideChar=145, lpMultiByteStr=0x1848c815f50, cbMultiByte=290, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", lpUsedDefaultChar=0x0) returned 145 [0093.362] CRetailMalloc_Free () returned 0x1 [0093.362] wcsncpy_s (in: _Destination=0x6c81390070, _SizeInWords=0x108, _Source="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm") returned 0x0 [0093.362] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm", cchLength=0x3b | out: lpsz="*\\cc:\\users\\rdhj0cnfevzx\\desktop\\habilitado para macro.xlsm") returned 0x3b [0093.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\rdhj0cnfevzx\\desktop\\habilitado para macro.xlsm", cchWideChar=60, lpMultiByteStr=0x6c8138ffa0, cbMultiByte=120, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\rdhj0cnfevzx\\desktop\\habilitado para macro.xlsm", lpUsedDefaultChar=0x0) returned 60 [0093.362] _wcsicmp (_String1="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm", _String2="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm") returned 0 [0093.362] memcpy (in: _Dst=0x6c81390428, _Src=0x18488bd99a6, _Size=0x2 | out: _Dst=0x6c81390428) returned 0x6c81390428 [0093.362] memcpy (in: _Dst=0x6c813903f0, _Src=0x18488bd99a8, _Size=0x2 | out: _Dst=0x6c813903f0) returned 0x6c813903f0 [0093.362] CRetailMalloc_Alloc () returned 0x1848c733da0 [0093.362] memcpy (in: _Dst=0x1848c733da0, _Src=0x18488bd99aa, _Size=0x110 | out: _Dst=0x1848c733da0) returned 0x1848c733da0 [0093.363] wcscpy_s (in: _Destination=0x1848c6dedc8, _SizeInWords=0x89, _Source="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library" | out: _Destination="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 0x0 [0093.363] CRetailMalloc_Free () returned 0x1 [0093.363] memcpy (in: _Dst=0x6c81390474, _Src=0x18488bd9aba, _Size=0x4 | out: _Dst=0x6c81390474) returned 0x6c81390474 [0093.363] memcpy (in: _Dst=0x6c81390430, _Src=0x18488bd9abe, _Size=0x2 | out: _Dst=0x6c81390430) returned 0x6c81390430 [0093.363] memcpy (in: _Dst=0x6c81390470, _Src=0x18488bd9ac0, _Size=0x4 | out: _Dst=0x6c81390470) returned 0x6c81390470 [0093.363] wcsncpy_s (in: _Destination=0x6c81390070, _SizeInWords=0x108, _Source="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 0x0 [0093.363] CharLowerBuffW (in: lpsz="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", cchLength=0x88 | out: lpsz="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\office16\\excel.exe#microsoft excel 16.0 object library") returned 0x88 [0093.363] CRetailMalloc_Alloc () returned 0x1848c736f20 [0093.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\office16\\excel.exe#microsoft excel 16.0 object library", cchWideChar=137, lpMultiByteStr=0x1848c736f20, cbMultiByte=274, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\office16\\excel.exe#microsoft excel 16.0 object library", lpUsedDefaultChar=0x0) returned 137 [0093.363] CRetailMalloc_Free () returned 0x1 [0093.363] wcscpy_s (in: _Destination=0x1848945fde0, _SizeInWords=0x89, _Source="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library" | out: _Destination="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 0x0 [0093.363] wcsncpy_s (in: _Destination=0x6c813900b0, _SizeInWords=0x108, _Source="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 0x0 [0093.363] CharLowerBuffW (in: lpsz="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", cchLength=0x88 | out: lpsz="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\office16\\excel.exe#microsoft excel 16.0 object library") returned 0x88 [0093.363] CRetailMalloc_Alloc () returned 0x1848c736f20 [0093.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\office16\\excel.exe#microsoft excel 16.0 object library", cchWideChar=137, lpMultiByteStr=0x1848c736f20, cbMultiByte=274, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\office16\\excel.exe#microsoft excel 16.0 object library", lpUsedDefaultChar=0x0) returned 137 [0093.363] CRetailMalloc_Free () returned 0x1 [0093.363] wcsncpy_s (in: _Destination=0x6c81390070, _SizeInWords=0x108, _Source="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm") returned 0x0 [0093.363] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm", cchLength=0x3b | out: lpsz="*\\cc:\\users\\rdhj0cnfevzx\\desktop\\habilitado para macro.xlsm") returned 0x3b [0093.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\rdhj0cnfevzx\\desktop\\habilitado para macro.xlsm", cchWideChar=60, lpMultiByteStr=0x6c8138ffa0, cbMultiByte=120, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\rdhj0cnfevzx\\desktop\\habilitado para macro.xlsm", lpUsedDefaultChar=0x0) returned 60 [0093.363] _wcsicmp (_String1="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm", _String2="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm") returned 0 [0093.363] memcpy (in: _Dst=0x6c81390428, _Src=0x18488bd9ac4, _Size=0x2 | out: _Dst=0x6c81390428) returned 0x6c81390428 [0093.363] memcpy (in: _Dst=0x6c813903f0, _Src=0x18488bd9ac6, _Size=0x2 | out: _Dst=0x6c813903f0) returned 0x6c813903f0 [0093.363] CRetailMalloc_Alloc () returned 0x18488cef7d0 [0093.363] memcpy (in: _Dst=0x18488cef7d0, _Src=0x18488bd9ac8, _Size=0xbc | out: _Dst=0x18488cef7d0) returned 0x18488cef7d0 [0093.364] wcscpy_s (in: _Destination=0x1848c65abb8, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation") returned 0x0 [0093.364] CRetailMalloc_Free () returned 0x1 [0093.364] memcpy (in: _Dst=0x6c81390474, _Src=0x18488bd9b84, _Size=0x4 | out: _Dst=0x6c81390474) returned 0x6c81390474 [0093.364] memcpy (in: _Dst=0x6c81390430, _Src=0x18488bd9b88, _Size=0x2 | out: _Dst=0x6c81390430) returned 0x6c81390430 [0093.364] memcpy (in: _Dst=0x6c81390470, _Src=0x18488bd9b8a, _Size=0x4 | out: _Dst=0x6c81390470) returned 0x6c81390470 [0093.364] wcsncpy_s (in: _Destination=0x6c81390070, _SizeInWords=0x108, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation", _MaxCount=0x106 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation") returned 0x0 [0093.364] CharLowerBuffW (in: lpsz="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation", cchLength=0x5e | out: lpsz="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation") returned 0x5e [0093.364] CRetailMalloc_Alloc () returned 0x18488cf1440 [0093.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation", cchWideChar=95, lpMultiByteStr=0x18488cf1440, cbMultiByte=190, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation", lpUsedDefaultChar=0x0) returned 95 [0093.364] CRetailMalloc_Free () returned 0x1 [0093.364] wcscpy_s (in: _Destination=0x1848945ff28, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation") returned 0x0 [0093.364] wcsncpy_s (in: _Destination=0x6c813900b0, _SizeInWords=0x108, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation", _MaxCount=0x106 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation") returned 0x0 [0093.364] CharLowerBuffW (in: lpsz="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation", cchLength=0x5e | out: lpsz="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation") returned 0x5e [0093.364] CRetailMalloc_Alloc () returned 0x18488cef7d0 [0093.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation", cchWideChar=95, lpMultiByteStr=0x18488cef7d0, cbMultiByte=190, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation", lpUsedDefaultChar=0x0) returned 95 [0093.364] CRetailMalloc_Free () returned 0x1 [0093.364] wcsncpy_s (in: _Destination=0x6c81390070, _SizeInWords=0x108, _Source="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm") returned 0x0 [0093.364] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm", cchLength=0x3b | out: lpsz="*\\cc:\\users\\rdhj0cnfevzx\\desktop\\habilitado para macro.xlsm") returned 0x3b [0093.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\rdhj0cnfevzx\\desktop\\habilitado para macro.xlsm", cchWideChar=60, lpMultiByteStr=0x6c8138ffa0, cbMultiByte=120, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\rdhj0cnfevzx\\desktop\\habilitado para macro.xlsm", lpUsedDefaultChar=0x0) returned 60 [0093.364] _wcsicmp (_String1="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm", _String2="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm") returned 0 [0093.424] memcpy (in: _Dst=0x6c81390428, _Src=0x18488bd9b8e, _Size=0x2 | out: _Dst=0x6c81390428) returned 0x6c81390428 [0093.424] memcpy (in: _Dst=0x6c813903f0, _Src=0x18488bd9b90, _Size=0x2 | out: _Dst=0x6c813903f0) returned 0x6c813903f0 [0093.424] CRetailMalloc_Alloc () returned 0x1848c24ec10 [0093.424] memcpy (in: _Dst=0x1848c24ec10, _Src=0x18488bd9b92, _Size=0xc6 | out: _Dst=0x1848c24ec10) returned 0x1848c24ec10 [0093.424] memcpy (in: _Dst=0x1848c24ecd6, _Src=0x18488bd9858, _Size=0x62 | out: _Dst=0x1848c24ecd6) returned 0x1848c24ecd6 [0093.424] wcscpy_s (in: _Destination=0x1848c65aca0, _SizeInWords=0x95, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0093.424] CRetailMalloc_Free () returned 0x1 [0093.424] memcpy (in: _Dst=0x6c81390474, _Src=0x18488bd98ba, _Size=0x4 | out: _Dst=0x6c81390474) returned 0x6c81390474 [0093.424] memcpy (in: _Dst=0x6c81390430, _Src=0x18488bd98be, _Size=0x2 | out: _Dst=0x6c81390430) returned 0x6c81390430 [0093.424] memcpy (in: _Dst=0x6c81390470, _Src=0x18488bd98c0, _Size=0x4 | out: _Dst=0x6c81390470) returned 0x6c81390470 [0093.424] wcsncpy_s (in: _Destination=0x6c81390070, _SizeInWords=0x108, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0093.424] CharLowerBuffW (in: lpsz="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", cchLength=0x94 | out: lpsz="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library") returned 0x94 [0093.424] CRetailMalloc_Alloc () returned 0x1848c250b50 [0093.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library", cchWideChar=149, lpMultiByteStr=0x1848c250b50, cbMultiByte=298, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library", lpUsedDefaultChar=0x0) returned 149 [0093.425] CRetailMalloc_Free () returned 0x1 [0093.425] wcscpy_s (in: _Destination=0x18485efd058, _SizeInWords=0x95, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0093.425] wcsncpy_s (in: _Destination=0x6c813900b0, _SizeInWords=0x108, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0093.425] CharLowerBuffW (in: lpsz="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", cchLength=0x94 | out: lpsz="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library") returned 0x94 [0093.425] CRetailMalloc_Alloc () returned 0x1848c251190 [0093.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library", cchWideChar=149, lpMultiByteStr=0x1848c251190, cbMultiByte=298, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library", lpUsedDefaultChar=0x0) returned 149 [0093.425] CRetailMalloc_Free () returned 0x1 [0093.425] wcsncpy_s (in: _Destination=0x6c81390070, _SizeInWords=0x108, _Source="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm") returned 0x0 [0093.425] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm", cchLength=0x3b | out: lpsz="*\\cc:\\users\\rdhj0cnfevzx\\desktop\\habilitado para macro.xlsm") returned 0x3b [0093.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\rdhj0cnfevzx\\desktop\\habilitado para macro.xlsm", cchWideChar=60, lpMultiByteStr=0x6c8138ffa0, cbMultiByte=120, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\rdhj0cnfevzx\\desktop\\habilitado para macro.xlsm", lpUsedDefaultChar=0x0) returned 60 [0093.425] _wcsicmp (_String1="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm", _String2="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm") returned 0 [0093.425] memcpy (in: _Dst=0x6c81390428, _Src=0x18488bd98c4, _Size=0x2 | out: _Dst=0x6c81390428) returned 0x6c81390428 [0093.425] memcpy (in: _Dst=0x6c8139042c, _Src=0x18488bd98c6, _Size=0x2 | out: _Dst=0x6c8139042c) returned 0x6c8139042c [0093.426] memcpy (in: _Dst=0x6c81390458, _Src=0x18488bd98c8, _Size=0x2 | out: _Dst=0x6c81390458) returned 0x6c81390458 [0093.426] memcpy (in: _Dst=0x18488df3b22, _Src=0x18488bd98ca, _Size=0x2 | out: _Dst=0x18488df3b22) returned 0x18488df3b22 [0093.426] CRetailMalloc_Alloc () returned 0x1848c6b1ac0 [0093.426] CRetailMalloc_GetSize () returned 0x18 [0093.426] CRetailMalloc_Alloc () returned 0x1848c6b1b20 [0093.426] CRetailMalloc_GetSize () returned 0xc [0093.426] memcpy (in: _Dst=0x6c81390454, _Src=0x18488bd98cc, _Size=0x2 | out: _Dst=0x6c81390454) returned 0x6c81390454 [0093.426] memcpy (in: _Dst=0x1848c6b1b20, _Src=0x18488bd98ce, _Size=0x2 | out: _Dst=0x1848c6b1b20) returned 0x1848c6b1b20 [0093.426] memcpy (in: _Dst=0x6c81390454, _Src=0x18488bd98d0, _Size=0x2 | out: _Dst=0x6c81390454) returned 0x6c81390454 [0093.426] memcpy (in: _Dst=0x1848c6b1b22, _Src=0x18488bd98d2, _Size=0x2 | out: _Dst=0x1848c6b1b22) returned 0x1848c6b1b22 [0093.426] memcpy (in: _Dst=0x6c81390454, _Src=0x18488bd98d4, _Size=0x2 | out: _Dst=0x6c81390454) returned 0x6c81390454 [0093.426] memcpy (in: _Dst=0x1848c6b1b24, _Src=0x18488bd98d6, _Size=0x2 | out: _Dst=0x1848c6b1b24) returned 0x1848c6b1b24 [0093.426] memcpy (in: _Dst=0x6c81390454, _Src=0x18488bd98d8, _Size=0x2 | out: _Dst=0x6c81390454) returned 0x6c81390454 [0093.426] memcpy (in: _Dst=0x1848c6b1b26, _Src=0x18488bd98da, _Size=0x2 | out: _Dst=0x1848c6b1b26) returned 0x1848c6b1b26 [0093.426] memcpy (in: _Dst=0x6c81390454, _Src=0x18488bd98dc, _Size=0x2 | out: _Dst=0x6c81390454) returned 0x6c81390454 [0093.426] memcpy (in: _Dst=0x1848c6b1b28, _Src=0x18488bd98de, _Size=0x2 | out: _Dst=0x1848c6b1b28) returned 0x1848c6b1b28 [0093.426] memcpy (in: _Dst=0x6c81390454, _Src=0x18488bd98e0, _Size=0x2 | out: _Dst=0x6c81390454) returned 0x6c81390454 [0093.426] memcpy (in: _Dst=0x1848c6b1b2a, _Src=0x18488bd98e2, _Size=0x2 | out: _Dst=0x1848c6b1b2a) returned 0x1848c6b1b2a [0093.426] memcpy (in: _Dst=0x6c81390388, _Src=0x18488bd98e4, _Size=0x2 | out: _Dst=0x6c81390388) returned 0x6c81390388 [0093.426] memcpy (in: _Dst=0x6c81390330, _Src=0x18488bd98e6, _Size=0x2 | out: _Dst=0x6c81390330) returned 0x6c81390330 [0093.426] memcpy (in: _Dst=0x6c81390330, _Src=0x18488bd98e8, _Size=0x2 | out: _Dst=0x6c81390330) returned 0x6c81390330 [0093.426] memcpy (in: _Dst=0x6c81390330, _Src=0x18488bd98ea, _Size=0x2 | out: _Dst=0x6c81390330) returned 0x6c81390330 [0093.426] memcpy (in: _Dst=0x18488df26ec, _Src=0x18488bd98ec, _Size=0x4 | out: _Dst=0x18488df26ec) returned 0x18488df26ec [0093.426] memcpy (in: _Dst=0x6c81390388, _Src=0x18488bd98f0, _Size=0x2 | out: _Dst=0x6c81390388) returned 0x6c81390388 [0093.426] memcpy (in: _Dst=0x18488df2700, _Src=0x18488bd98f2, _Size=0x2 | out: _Dst=0x18488df2700) returned 0x18488df2700 [0093.426] memcpy (in: _Dst=0x18488df2728, _Src=0x18488bd98f4, _Size=0x4 | out: _Dst=0x18488df2728) returned 0x18488df2728 [0093.426] memcpy (in: _Dst=0x18488df272c, _Src=0x18488bd98f8, _Size=0x2 | out: _Dst=0x18488df272c) returned 0x18488df272c [0093.426] memcpy (in: _Dst=0x18488df26a0, _Src=0x18488bd98fa, _Size=0x40 | out: _Dst=0x18488df26a0) returned 0x18488df26a0 [0093.426] memcpy (in: _Dst=0x18488df2718, _Src=0x18488bd993a, _Size=0x2 | out: _Dst=0x18488df2718) returned 0x18488df2718 [0093.426] memcpy (in: _Dst=0x18488df271a, _Src=0x18488bd993c, _Size=0x2 | out: _Dst=0x18488df271a) returned 0x18488df271a [0093.427] memcpy (in: _Dst=0x18488df2708, _Src=0x18488bd993e, _Size=0x10 | out: _Dst=0x18488df2708) returned 0x18488df2708 [0093.427] memcpy (in: _Dst=0x18488df272e, _Src=0x18488bd994e, _Size=0x2 | out: _Dst=0x18488df272e) returned 0x18488df272e [0093.427] memcpy (in: _Dst=0x6c81390388, _Src=0x18488bd9950, _Size=0x2 | out: _Dst=0x6c81390388) returned 0x6c81390388 [0093.427] memcpy (in: _Dst=0x6c81390330, _Src=0x18488bd9952, _Size=0x2 | out: _Dst=0x6c81390330) returned 0x6c81390330 [0093.427] memcpy (in: _Dst=0x1848c65add0, _Src=0x18488bd9954, _Size=0x18 | out: _Dst=0x1848c65add0) returned 0x1848c65add0 [0093.427] memcpy (in: _Dst=0x6c81390330, _Src=0x18488bd996c, _Size=0x2 | out: _Dst=0x6c81390330) returned 0x6c81390330 [0093.427] memcpy (in: _Dst=0x1848c65adf0, _Src=0x18488bd996e, _Size=0x14 | out: _Dst=0x1848c65adf0) returned 0x1848c65adf0 [0093.427] memcpy (in: _Dst=0x6c81390330, _Src=0x18488bd9982, _Size=0x2 | out: _Dst=0x6c81390330) returned 0x6c81390330 [0093.428] memcpy (in: _Dst=0x6c81390394, _Src=0x18488bd9984, _Size=0x2 | out: _Dst=0x6c81390394) returned 0x6c81390394 [0093.428] memcpy (in: _Dst=0x6c81390330, _Src=0x18488bd9986, _Size=0x2 | out: _Dst=0x6c81390330) returned 0x6c81390330 [0093.428] memcpy (in: _Dst=0x1848c65ae08, _Src=0x18488bd9988, _Size=0x18 | out: _Dst=0x1848c65ae08) returned 0x1848c65ae08 [0093.428] memcpy (in: _Dst=0x6c81390330, _Src=0x18488bd99a0, _Size=0x2 | out: _Dst=0x6c81390330) returned 0x6c81390330 [0093.428] memcpy (in: _Dst=0x6c8139038c, _Src=0x18488bd99a2, _Size=0x2 | out: _Dst=0x6c8139038c) returned 0x6c8139038c [0093.428] memcpy (in: _Dst=0x6c8139039c, _Src=0x18488bd99a4, _Size=0x4 | out: _Dst=0x6c8139039c) returned 0x6c8139039c [0093.428] memcpy (in: _Dst=0x6c8139038c, _Src=0x18488bd99a8, _Size=0x2 | out: _Dst=0x6c8139038c) returned 0x6c8139038c [0093.428] memcpy (in: _Dst=0x6c8139039c, _Src=0x18488bd99aa, _Size=0x4 | out: _Dst=0x6c8139039c) returned 0x6c8139039c [0093.428] memcpy (in: _Dst=0x1848c3300f5, _Src=0x18488bd99ae, _Size=0x1 | out: _Dst=0x1848c3300f5) returned 0x1848c3300f5 [0093.428] memcpy (in: _Dst=0x1848c3300d8, _Src=0x18488bd99af, _Size=0x4 | out: _Dst=0x1848c3300d8) returned 0x1848c3300d8 [0093.428] memcpy (in: _Dst=0x6c813903a0, _Src=0x18488bd99b3, _Size=0x2 | out: _Dst=0x6c813903a0) returned 0x6c813903a0 [0093.429] memcpy (in: _Dst=0x18488df3be0, _Src=0x18488bd99b5, _Size=0x4 | out: _Dst=0x18488df3be0) returned 0x18488df3be0 [0093.429] memcpy (in: _Dst=0x6c81390320, _Src=0x18488bd99b9, _Size=0x1 | out: _Dst=0x6c81390320) returned 0x6c81390320 [0093.429] memcpy (in: _Dst=0x6c81390328, _Src=0x18488bd99ba, _Size=0x1 | out: _Dst=0x6c81390328) returned 0x6c81390328 [0093.429] memcpy (in: _Dst=0x6c813902f8, _Src=0x18488bd99bb, _Size=0x4 | out: _Dst=0x6c813902f8) returned 0x6c813902f8 [0093.429] memcpy (in: _Dst=0x18485a5e5e0, _Src=0x18488bd99bf, _Size=0x220 | out: _Dst=0x18485a5e5e0) returned 0x18485a5e5e0 [0093.429] memcpy (in: _Dst=0x6c81390340, _Src=0x18488bd9bdf, _Size=0x2 | out: _Dst=0x6c81390340) returned 0x6c81390340 [0093.429] memcpy (in: _Dst=0x18488df3bf8, _Src=0x18488bd9be1, _Size=0x4 | out: _Dst=0x18488df3bf8) returned 0x18488df3bf8 [0093.429] memcpy (in: _Dst=0x6c81390318, _Src=0x18488bd9be5, _Size=0x2 | out: _Dst=0x6c81390318) returned 0x6c81390318 [0093.429] memcpy (in: _Dst=0x6c81390308, _Src=0x18488bd9be7, _Size=0x2 | out: _Dst=0x6c81390308) returned 0x6c81390308 [0093.429] memcpy (in: _Dst=0x6c81390314, _Src=0x18488bd9be9, _Size=0x2 | out: _Dst=0x6c81390314) returned 0x6c81390314 [0093.429] memcpy (in: _Dst=0x6c81390338, _Src=0x18488bd9beb, _Size=0x4 | out: _Dst=0x6c81390338) returned 0x6c81390338 [0093.429] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x18488700000 [0093.430] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x2000, flProtect=0x4) returned 0x184889f0000 [0093.430] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="0") returned 0x101047 [0093.431] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x18488710000 [0093.431] VirtualAlloc (lpAddress=0x184889f0000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x184889f0000 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Abs") returned 0x1072bc [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Access") returned 0x101d98 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="AddressOf") returned 0x10e252 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Alias") returned 0x10bf6d [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="And") returned 0x107469 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Any") returned 0x10747a [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Append") returned 0x108f83 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Array") returned 0x109183 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="As") returned 0x105c8d [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Assert") returned 0x1096e9 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="B") returned 0x101059 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Base") returned 0x10afa9 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="BF") returned 0x105ca5 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Binary") returned 0x1008a0 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Boolean") returned 0x10978e [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="ByRef") returned 0x1074ef [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Byte") returned 0x101a83 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="ByVal") returned 0x1089c5 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Call") returned 0x10744b [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Case") returned 0x107547 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="CBool") returned 0x104c74 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="CByte") returned 0x106d3c [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="CCur") returned 0x108050 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="CDate") returned 0x108dc3 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="CDec") returned 0x10834a [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="CDbl") returned 0x1082e4 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="CDecl") returned 0x10a0b9 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="ChDir") returned 0x10b2fb [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="CInt") returned 0x109f65 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Circle") returned 0x103fd1 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="CLng") returned 0x10af63 [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Close") returned 0x1005ab [0093.432] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Compare") returned 0x10af82 [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Const") returned 0x10517a [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="CSng") returned 0x10d4d2 [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="CStr") returned 0x10d5bb [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="CurDir") returned 0x101bab [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="CurDir$") returned 0x10f7cc [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="CurDir") returned 0x101bab [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="CVar") returned 0x10e307 [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="CVDate") returned 0x10cfd6 [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="CVErr") returned 0x108902 [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Currency") returned 0x10f106 [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Database") returned 0x10eec7 [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Date") returned 0x103b0a [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Date$") returned 0x1031c7 [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Date") returned 0x103b0a [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Debug") returned 0x10eaee [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Decimal") returned 0x1036dd [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Declare") returned 0x104a38 [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="DefBool") returned 0x1091ad [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="DefByte") returned 0x10b275 [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="DefCur") returned 0x10cc45 [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="DefDate") returned 0x10d2fc [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="DefDec") returned 0x10cf3f [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="DefDbl") returned 0x10ced9 [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="DefInt") returned 0x10eb5a [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="DefLng") returned 0x10fb58 [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="DefObj") returned 0x10096b [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="DefSng") returned 0x102088 [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="DefStr") returned 0x102171 [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="DefVar") returned 0x102ebd [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Dim") returned 0x1083c4 [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Dir") returned 0x1083c9 [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Dir$") returned 0x106567 [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Dir") returned 0x1083c9 [0093.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Do") returned 0x105cf8 [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="DoEvents") returned 0x109634 [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Double") returned 0x100d99 [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Each") returned 0x10fe75 [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Else") returned 0x103b56 [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="ElseIf") returned 0x10f307 [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Empty") returned 0x10f4f1 [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="End") returned 0x1089cd [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="EndIf") returned 0x1078bd [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Enum") returned 0x10465a [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Eqv") returned 0x108a4e [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Erase") returned 0x1080da [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Error") returned 0x10db3c [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Error$") returned 0x10cf60 [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Error") returned 0x10db3c [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Event") returned 0x10ac4b [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Exit") returned 0x107a1f [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Explicit") returned 0x10edcb [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="F") returned 0x10105d [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="False") returned 0x102d01 [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Fix") returned 0x108e81 [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="For") returned 0x108f59 [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Format") returned 0x102337 [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Format$") returned 0x10efc7 [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Format") returned 0x102337 [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="FreeFile") returned 0x10483a [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Friend") returned 0x10bd1c [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Function") returned 0x107810 [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Get") returned 0x109342 [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Global") returned 0x10f88f [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Go") returned 0x105d67 [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="GoSub") returned 0x10b425 [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="GoTo") returned 0x10d70b [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="If") returned 0x105da8 [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Imp") returned 0x109f18 [0093.434] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Implements") returned 0x10a988 [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="In") returned 0x105db0 [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Input") returned 0x10022a [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Input$") returned 0x107767 [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Input") returned 0x10022a [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="InputB") returned 0x107785 [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="InputB$") returned 0x100c59 [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="InputB") returned 0x107785 [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="InStr") returned 0x10120e [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="InStrB") returned 0x10c2fb [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Int") returned 0x109f41 [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Integer") returned 0x10b48a [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Is") returned 0x105db5 [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="LBound") returned 0x101e0b [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Left") returned 0x107be5 [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Len") returned 0x10adf9 [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="LenB") returned 0x107cfb [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Let") returned 0x10adff [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Lib") returned 0x10ae81 [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Like") returned 0x1091f3 [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Line") returned 0x109262 [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="LINEINPUT") returned 0x1008f1 [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Load") returned 0x10b096 [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Local") returned 0x10353f [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Lock") returned 0x10b0e7 [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Long") returned 0x10b27a [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Loop") returned 0x10b2a8 [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="LSet") returned 0x10c69e [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Me") returned 0x105e3b [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Mid") returned 0x10b3dc [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Mid$") returned 0x10566d [0093.435] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Mid") returned 0x10b3dc [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="MidB") returned 0x10568b [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="MidB$") returned 0x102a70 [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="MidB") returned 0x10568b [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Mod") returned 0x10b4ba [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Module") returned 0x101ee1 [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Name") returned 0x10f2f0 [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="New") returned 0x10b8b3 [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Next") returned 0x1009bb [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Not") returned 0x10ba23 [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Nothing") returned 0x105f21 [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Null") returned 0x105d87 [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Object") returned 0x102ec1 [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="On") returned 0x105e8e [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Open") returned 0x100767 [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Option") returned 0x10f982 [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Optional") returned 0x10675a [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Or") returned 0x105e92 [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Output") returned 0x10f959 [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="ParamArray") returned 0x105941 [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Preserve") returned 0x10a5fc [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Print") returned 0x10f00d [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Private") returned 0x1073c3 [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Property") returned 0x10d2f6 [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="PSet") returned 0x10dd55 [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Public") returned 0x101287 [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Put") returned 0x10c5b3 [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="RaiseEvent") returned 0x10274a [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Random") returned 0x10f428 [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Randomize") returned 0x10ab02 [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Read") returned 0x101d0f [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="ReDim") returned 0x10eea8 [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Rem") returned 0x10ce0e [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Resume") returned 0x10728b [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Return") returned 0x1038eb [0093.436] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="RGB") returned 0x10ce4d [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="RSet") returned 0x106891 [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Scale") returned 0x10e596 [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Seek") returned 0x10e387 [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Select") returned 0x10cabd [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Set") returned 0x10d36e [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Sgn") returned 0x10d3b2 [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Shared") returned 0x10479e [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Single") returned 0x10a99f [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Spc") returned 0x10d4f4 [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Static") returned 0x1029c6 [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Step") returned 0x103384 [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Stop") returned 0x1034f6 [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="StrComp") returned 0x10274d [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="String") returned 0x10102a [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="String$") returned 0x10c31c [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="String") returned 0x10102a [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Sub") returned 0x10d5ac [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Tab") returned 0x10d821 [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Text") returned 0x10abed [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Then") returned 0x10b933 [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="To") returned 0x105f48 [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="True") returned 0x10f0f4 [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Type") returned 0x100007 [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="TypeOf") returned 0x101832 [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="UBound") returned 0x10ea71 [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Unload") returned 0x104e44 [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Unlock") returned 0x104e95 [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Unknown") returned 0x10a11d [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Until") returned 0x10ecec [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Variant") returned 0x108738 [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Wend") returned 0x1035a7 [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="While") returned 0x10a25c [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Width") returned 0x104e68 [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="With") returned 0x104bed [0093.437] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="WithEvents") returned 0x10f2eb [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Write") returned 0x105c2e [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Xor") returned 0x10ef9b [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="#Const") returned 0x10f8c9 [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="#Else") returned 0x1050dd [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="#ElseIf") returned 0x10e5b5 [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="#End") returned 0x10d478 [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="#If") returned 0x10d383 [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Attribute") returned 0x10ed01 [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_Base") returned 0x109fb8 [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_Control") returned 0x10a946 [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_Creatable") returned 0x101d92 [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_Customizable") returned 0x10c26d [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_Description") returned 0x1009d0 [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_Exposed") returned 0x1030b3 [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_Ext_KEY") returned 0x10a88e [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_HelpID") returned 0x103e41 [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_Invoke_Func") returned 0x10c92c [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_Invoke_Property") returned 0x107f4a [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_Invoke_PropertyPut") returned 0x106658 [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_Invoke_PropertyPutRef") returned 0x105b25 [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_MemberFlags") returned 0x108db7 [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_Name") returned 0x10e2ff [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_PredeclaredId") returned 0x105fc7 [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_ProcData") returned 0x107005 [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_TemplateDerived") returned 0x109f1e [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_VarDescription") returned 0x103303 [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_VarHelpID") returned 0x10a3b6 [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_VarMemberFlags") returned 0x10b6ea [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_VarProcData") returned 0x101b0c [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_UserMemId") returned 0x107b95 [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_VarUserMemId") returned 0x104d5f [0093.438] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="VB_GlobalNameSpace") returned 0x10ce77 [0093.439] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName=",") returned 0x101043 [0093.439] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName=".") returned 0x101045 [0093.439] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="\"") returned 0x101039 [0093.439] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="_") returned 0x101076 [0093.439] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="CLngPtr") returned 0x105ab0 [0093.439] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="DefLngPtr") returned 0x1036f2 [0093.439] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="PtrSafe") returned 0x106f4a [0093.439] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="CLngLng") returned 0x104463 [0093.439] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="DefLngLng") returned 0x1020a5 [0093.439] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="LongLong") returned 0x10378e [0093.439] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="LongPtr") returned 0x10d4e8 [0093.439] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="0") returned 0x101047 [0093.439] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="0") returned 0x101047 [0093.439] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9bef, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.439] memcpy (in: _Dst=0x6c81390310, _Src=0x18488bd9bf1, _Size=0x2 | out: _Dst=0x6c81390310) returned 0x6c81390310 [0093.439] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9bf3, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.439] memcpy (in: _Dst=0x6c8139031c, _Src=0x18488bd9bf5, _Size=0x2 | out: _Dst=0x6c8139031c) returned 0x6c8139031c [0093.439] memcpy (in: _Dst=0x184887109b6, _Src=0x18488bd9bf7, _Size=0x2 | out: _Dst=0x184887109b6) returned 0x184887109b6 [0093.439] memcpy (in: _Dst=0x184887109a0, _Src=0x18488bd9bf9, _Size=0x2 | out: _Dst=0x184887109a0) returned 0x184887109a0 [0093.439] memcpy (in: _Dst=0x184887109ba, _Src=0x18488bd9bfb, _Size=0x3 | out: _Dst=0x184887109ba) returned 0x184887109ba [0093.439] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9bfe, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.439] memcpy (in: _Dst=0x18488712906, _Src=0x18488bd9c00, _Size=0x5 | out: _Dst=0x18488712906) returned 0x18488712906 [0093.439] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9c05, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.439] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9c09, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.439] memcpy (in: _Dst=0x1848871292e, _Src=0x18488bd9c0b, _Size=0x3 | out: _Dst=0x1848871292e) returned 0x1848871292e [0093.439] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9c0e, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.439] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9c12, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.440] memcpy (in: _Dst=0x18488712952, _Src=0x18488bd9c14, _Size=0x5 | out: _Dst=0x18488712952) returned 0x18488712952 [0093.440] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9c19, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.440] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9c1d, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.440] memcpy (in: _Dst=0x1848871297a, _Src=0x18488bd9c1f, _Size=0x5 | out: _Dst=0x1848871297a) returned 0x1848871297a [0093.440] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9c24, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.440] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9c28, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.440] memcpy (in: _Dst=0x184887129a2, _Src=0x18488bd9c2a, _Size=0x5 | out: _Dst=0x184887129a2) returned 0x184887129a2 [0093.440] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9c2f, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.440] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9c33, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.440] memcpy (in: _Dst=0x184887129ca, _Src=0x18488bd9c35, _Size=0x3 | out: _Dst=0x184887129ca) returned 0x184887129ca [0093.440] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9c38, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.440] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9c3c, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.440] memcpy (in: _Dst=0x184887129ee, _Src=0x18488bd9c3e, _Size=0x4 | out: _Dst=0x184887129ee) returned 0x184887129ee [0093.440] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9c42, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.440] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9c46, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.440] memcpy (in: _Dst=0x18488712a16, _Src=0x18488bd9c48, _Size=0x4 | out: _Dst=0x18488712a16) returned 0x18488712a16 [0093.440] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9c4c, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.440] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9c50, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.440] memcpy (in: _Dst=0x18488712a3e, _Src=0x18488bd9c52, _Size=0x6 | out: _Dst=0x18488712a3e) returned 0x18488712a3e [0093.440] memcpy (in: _Dst=0x18488712a44, _Src=0x18488bd9858, _Size=0x4 | out: _Dst=0x18488712a44) returned 0x18488712a44 [0093.440] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd985c, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.440] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9860, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.440] memcpy (in: _Dst=0x18488712a6a, _Src=0x18488bd9862, _Size=0x6 | out: _Dst=0x18488712a6a) returned 0x18488712a6a [0093.440] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9868, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.440] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd986c, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.440] memcpy (in: _Dst=0x18488712a92, _Src=0x18488bd986e, _Size=0x6 | out: _Dst=0x18488712a92) returned 0x18488712a92 [0093.440] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9874, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.440] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9878, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.440] memcpy (in: _Dst=0x18488712aba, _Src=0x18488bd987a, _Size=0xc | out: _Dst=0x18488712aba) returned 0x18488712aba [0093.440] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9886, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.440] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd988a, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.440] memcpy (in: _Dst=0x6c8139031c, _Src=0x18488bd988c, _Size=0x2 | out: _Dst=0x6c8139031c) returned 0x6c8139031c [0093.440] memcpy (in: _Dst=0x18488712ae6, _Src=0x18488bd988e, _Size=0x2 | out: _Dst=0x18488712ae6) returned 0x18488712ae6 [0093.440] memcpy (in: _Dst=0x18488712ad0, _Src=0x18488bd9890, _Size=0x2 | out: _Dst=0x18488712ad0) returned 0x18488712ad0 [0093.440] memcpy (in: _Dst=0x18488712aea, _Src=0x18488bd9892, _Size=0x9 | out: _Dst=0x18488712aea) returned 0x18488712aea [0093.441] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd989b, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.441] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd989f, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.441] memcpy (in: _Dst=0x18488712b16, _Src=0x18488bd98a1, _Size=0xd | out: _Dst=0x18488712b16) returned 0x18488712b16 [0093.441] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd98ae, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.441] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd98b2, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.441] memcpy (in: _Dst=0x18488712b46, _Src=0x18488bd98b4, _Size=0xa | out: _Dst=0x18488712b46) returned 0x18488712b46 [0093.441] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd98be, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.441] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd98c2, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.441] memcpy (in: _Dst=0x18488712b72, _Src=0x18488bd98c4, _Size=0xd | out: _Dst=0x18488712b72) returned 0x18488712b72 [0093.441] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd98d1, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.441] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd98d5, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.441] memcpy (in: _Dst=0x18488712ba2, _Src=0x18488bd98d7, _Size=0x1 | out: _Dst=0x18488712ba2) returned 0x18488712ba2 [0093.441] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd98d8, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.441] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd98dc, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.441] memcpy (in: _Dst=0x18488712bc6, _Src=0x18488bd98de, _Size=0xe | out: _Dst=0x18488712bc6) returned 0x18488712bc6 [0093.441] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd98ec, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.441] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd98f0, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.441] memcpy (in: _Dst=0x18488712bf6, _Src=0x18488bd98f2, _Size=0x6 | out: _Dst=0x18488712bf6) returned 0x18488712bf6 [0093.441] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd98f8, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.441] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd98fc, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.441] memcpy (in: _Dst=0x18488712c1e, _Src=0x18488bd98fe, _Size=0x5 | out: _Dst=0x18488712c1e) returned 0x18488712c1e [0093.441] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9903, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.441] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9907, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.441] memcpy (in: _Dst=0x18488712c46, _Src=0x18488bd9909, _Size=0x7 | out: _Dst=0x18488712c46) returned 0x18488712c46 [0093.441] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9910, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.441] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9914, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.441] memcpy (in: _Dst=0x18488712c6e, _Src=0x18488bd9916, _Size=0xe | out: _Dst=0x18488712c6e) returned 0x18488712c6e [0093.441] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9924, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.441] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9928, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.441] memcpy (in: _Dst=0x18488712c9e, _Src=0x18488bd992a, _Size=0xa | out: _Dst=0x18488712c9e) returned 0x18488712c9e [0093.442] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9934, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.442] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9938, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.442] memcpy (in: _Dst=0x18488712cca, _Src=0x18488bd993a, _Size=0xb | out: _Dst=0x18488712cca) returned 0x18488712cca [0093.442] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9945, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.442] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9949, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.442] memcpy (in: _Dst=0x18488712cf6, _Src=0x18488bd994b, _Size=0x7 | out: _Dst=0x18488712cf6) returned 0x18488712cf6 [0093.442] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9952, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.442] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9956, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.442] memcpy (in: _Dst=0x18488712d1e, _Src=0x18488bd9958, _Size=0xd | out: _Dst=0x18488712d1e) returned 0x18488712d1e [0093.442] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9965, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.442] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9969, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.442] memcpy (in: _Dst=0x18488712d4e, _Src=0x18488bd996b, _Size=0xa | out: _Dst=0x18488712d4e) returned 0x18488712d4e [0093.442] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9975, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.442] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9979, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.442] memcpy (in: _Dst=0x18488712d7a, _Src=0x18488bd997b, _Size=0x3 | out: _Dst=0x18488712d7a) returned 0x18488712d7a [0093.442] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd997e, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.442] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9982, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.442] memcpy (in: _Dst=0x18488712d9e, _Src=0x18488bd9984, _Size=0x14 | out: _Dst=0x18488712d9e) returned 0x18488712d9e [0093.442] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9998, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.442] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd999c, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.442] memcpy (in: _Dst=0x18488712dd6, _Src=0x18488bd999e, _Size=0x6 | out: _Dst=0x18488712dd6) returned 0x18488712dd6 [0093.442] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd99a4, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.442] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd99a8, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.442] memcpy (in: _Dst=0x18488712dfe, _Src=0x18488bd99aa, _Size=0x5 | out: _Dst=0x18488712dfe) returned 0x18488712dfe [0093.442] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd99af, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.442] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd99b3, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.442] memcpy (in: _Dst=0x18488712e26, _Src=0x18488bd99b5, _Size=0x14 | out: _Dst=0x18488712e26) returned 0x18488712e26 [0093.442] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd99c9, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.442] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd99cd, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.442] memcpy (in: _Dst=0x18488712e5e, _Src=0x18488bd99cf, _Size=0x2 | out: _Dst=0x18488712e5e) returned 0x18488712e5e [0093.442] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd99d1, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.442] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd99d5, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.442] memcpy (in: _Dst=0x18488712e82, _Src=0x18488bd99d7, _Size=0x6 | out: _Dst=0x18488712e82) returned 0x18488712e82 [0093.442] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd99dd, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.442] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd99e1, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.442] memcpy (in: _Dst=0x18488712eaa, _Src=0x18488bd99e3, _Size=0x5 | out: _Dst=0x18488712eaa) returned 0x18488712eaa [0093.443] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd99e8, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.443] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd99ec, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.443] memcpy (in: _Dst=0x18488712ed2, _Src=0x18488bd99ee, _Size=0x11 | out: _Dst=0x18488712ed2) returned 0x18488712ed2 [0093.443] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd99ff, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.443] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9a03, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.443] memcpy (in: _Dst=0x18488712f06, _Src=0x18488bd9a05, _Size=0x16 | out: _Dst=0x18488712f06) returned 0x18488712f06 [0093.444] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9a1b, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.444] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9a1f, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.444] memcpy (in: _Dst=0x18488712f3e, _Src=0x18488bd9a21, _Size=0x13 | out: _Dst=0x18488712f3e) returned 0x18488712f3e [0093.444] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9a34, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.444] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9a38, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.444] memcpy (in: _Dst=0x18488712f72, _Src=0x18488bd9a3a, _Size=0x8 | out: _Dst=0x18488712f72) returned 0x18488712f72 [0093.444] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9a42, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.444] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9a46, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.444] memcpy (in: _Dst=0x18488712f9e, _Src=0x18488bd9a48, _Size=0x6 | out: _Dst=0x18488712f9e) returned 0x18488712f9e [0093.444] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9a4e, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.444] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9a52, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.444] memcpy (in: _Dst=0x18488712fc6, _Src=0x18488bd9a54, _Size=0x5 | out: _Dst=0x18488712fc6) returned 0x18488712fc6 [0093.444] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9a59, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.444] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9a5d, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.444] memcpy (in: _Dst=0x18488712fee, _Src=0x18488bd9a5f, _Size=0xb | out: _Dst=0x18488712fee) returned 0x18488712fee [0093.444] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9a6a, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.444] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9a6e, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.444] memcpy (in: _Dst=0x1848871301a, _Src=0x18488bd9a70, _Size=0x5 | out: _Dst=0x1848871301a) returned 0x1848871301a [0093.445] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9a75, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.445] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9a79, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.445] memcpy (in: _Dst=0x18488713042, _Src=0x18488bd9a7b, _Size=0xc | out: _Dst=0x18488713042) returned 0x18488713042 [0093.445] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9a87, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.445] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9a8b, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.445] memcpy (in: _Dst=0x18488713072, _Src=0x18488bd9a8d, _Size=0xe | out: _Dst=0x18488713072) returned 0x18488713072 [0093.445] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9a9b, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.445] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9a9f, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.445] memcpy (in: _Dst=0x184887130a2, _Src=0x18488bd9aa1, _Size=0xd | out: _Dst=0x184887130a2) returned 0x184887130a2 [0093.445] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9aae, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.445] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9ab2, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.445] memcpy (in: _Dst=0x184887130d2, _Src=0x18488bd9ab4, _Size=0x4 | out: _Dst=0x184887130d2) returned 0x184887130d2 [0093.445] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9ab8, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.445] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9abc, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.445] memcpy (in: _Dst=0x184887130fa, _Src=0x18488bd9abe, _Size=0x11 | out: _Dst=0x184887130fa) returned 0x184887130fa [0093.445] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9acf, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.445] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9ad3, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.445] memcpy (in: _Dst=0x1848871312e, _Src=0x18488bd9ad5, _Size=0xa | out: _Dst=0x1848871312e) returned 0x1848871312e [0093.445] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9adf, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.445] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9ae3, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.445] memcpy (in: _Dst=0x1848871315a, _Src=0x18488bd9ae5, _Size=0x6 | out: _Dst=0x1848871315a) returned 0x1848871315a [0093.445] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9aeb, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.445] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9aef, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.445] memcpy (in: _Dst=0x18488713182, _Src=0x18488bd9af1, _Size=0x8 | out: _Dst=0x18488713182) returned 0x18488713182 [0093.445] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9af9, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.445] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9afd, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.445] memcpy (in: _Dst=0x184887131ae, _Src=0x18488bd9aff, _Size=0xa | out: _Dst=0x184887131ae) returned 0x184887131ae [0093.445] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9b09, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.445] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9b0d, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.445] memcpy (in: _Dst=0x184887131da, _Src=0x18488bd9b0f, _Size=0x1d | out: _Dst=0x184887131da) returned 0x184887131da [0093.445] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9b2c, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.445] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9b30, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.445] memcpy (in: _Dst=0x1848871321a, _Src=0x18488bd9b32, _Size=0x9 | out: _Dst=0x1848871321a) returned 0x1848871321a [0093.445] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9b3b, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.445] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9b3f, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.445] memcpy (in: _Dst=0x18488713246, _Src=0x18488bd9b41, _Size=0x4 | out: _Dst=0x18488713246) returned 0x18488713246 [0093.445] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9b45, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.445] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9b49, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.445] memcpy (in: _Dst=0x1848871326e, _Src=0x18488bd9b4b, _Size=0x3 | out: _Dst=0x1848871326e) returned 0x1848871326e [0093.445] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9b4e, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.445] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9b52, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.446] memcpy (in: _Dst=0x18488713292, _Src=0x18488bd9b54, _Size=0x2 | out: _Dst=0x18488713292) returned 0x18488713292 [0093.446] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9b56, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.446] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9b5a, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.446] memcpy (in: _Dst=0x184887132b6, _Src=0x18488bd9b5c, _Size=0xc | out: _Dst=0x184887132b6) returned 0x184887132b6 [0093.446] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9b68, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.446] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9b6c, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.446] memcpy (in: _Dst=0x184887132e6, _Src=0x18488bd9b6e, _Size=0x7 | out: _Dst=0x184887132e6) returned 0x184887132e6 [0093.446] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9b75, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.446] memcpy (in: _Dst=0x6c813902f4, _Src=0x18488bd9b79, _Size=0x2 | out: _Dst=0x6c813902f4) returned 0x6c813902f4 [0093.446] memcpy (in: _Dst=0x1848871330e, _Src=0x18488bd9b7b, _Size=0xa | out: _Dst=0x1848871330e) returned 0x1848871330e [0093.446] memcpy (in: _Dst=0x6c8139030c, _Src=0x18488bd9b85, _Size=0x4 | out: _Dst=0x6c8139030c) returned 0x6c8139030c [0093.448] CRetailMalloc_Free () returned 0x1 [0093.448] CRetailMalloc_Alloc () returned 0x1848c744af0 [0093.449] srand (_Seed=0x5196) [0093.449] rand () returned 2707 [0093.449] rand () returned 5367 [0093.449] rand () returned 3107 [0093.449] rand () returned 25991 [0093.449] rand () returned 22224 [0093.449] rand () returned 7173 [0093.449] rand () returned 3305 [0093.449] rand () returned 5542 [0093.449] rand () returned 21093 [0093.449] rand () returned 7093 [0093.449] rand () returned 29645 [0093.449] rand () returned 30555 [0093.449] rand () returned 4452 [0093.449] rand () returned 15519 [0093.449] rand () returned 22682 [0093.449] rand () returned 20118 [0093.449] rand () returned 26125 [0093.449] rand () returned 28117 [0093.449] rand () returned 31912 [0093.449] rand () returned 27549 [0093.449] rand () returned 25247 [0093.449] rand () returned 12135 [0093.449] rand () returned 31572 [0093.449] rand () returned 27055 [0093.449] rand () returned 11630 [0093.449] rand () returned 26157 [0093.449] rand () returned 24237 [0093.449] rand () returned 16615 [0093.449] rand () returned 23350 [0093.449] rand () returned 7360 [0093.449] rand () returned 27760 [0093.449] rand () returned 12132 [0093.449] rand () returned 17327 [0093.449] rand () returned 21962 [0093.449] rand () returned 16183 [0093.449] rand () returned 15783 [0093.450] rand () returned 1121 [0093.450] rand () returned 21376 [0093.450] rand () returned 32749 [0093.450] rand () returned 25148 [0093.450] rand () returned 9658 [0093.450] rand () returned 30828 [0093.450] rand () returned 21381 [0093.450] rand () returned 2205 [0093.450] rand () returned 5726 [0093.450] rand () returned 9584 [0093.450] rand () returned 20715 [0093.450] rand () returned 32595 [0093.450] rand () returned 28862 [0093.450] rand () returned 14600 [0093.450] rand () returned 4923 [0093.450] rand () returned 4446 [0093.450] rand () returned 16108 [0093.450] rand () returned 5071 [0093.450] rand () returned 15410 [0093.450] rand () returned 20183 [0093.450] rand () returned 12462 [0093.450] rand () returned 17989 [0093.450] rand () returned 31458 [0093.450] rand () returned 18644 [0093.450] rand () returned 30673 [0093.450] rand () returned 19407 [0093.450] rand () returned 27305 [0093.450] rand () returned 17548 [0093.450] rand () returned 16063 [0093.450] rand () returned 30463 [0093.450] rand () returned 24163 [0093.450] rand () returned 10684 [0093.450] rand () returned 27988 [0093.450] rand () returned 29462 [0093.450] rand () returned 27615 [0093.450] rand () returned 12361 [0093.450] rand () returned 12270 [0093.450] rand () returned 32455 [0093.450] rand () returned 19344 [0093.451] rand () returned 4390 [0093.451] rand () returned 29891 [0093.451] rand () returned 17470 [0093.451] rand () returned 24709 [0093.451] rand () returned 15992 [0093.451] rand () returned 21368 [0093.451] rand () returned 29281 [0093.451] rand () returned 31899 [0093.451] rand () returned 26360 [0093.451] rand () returned 4847 [0093.451] rand () returned 31574 [0093.451] rand () returned 13554 [0093.451] rand () returned 18585 [0093.451] rand () returned 16736 [0093.451] rand () returned 7237 [0093.451] rand () returned 23197 [0093.451] rand () returned 5740 [0093.451] rand () returned 4779 [0093.451] rand () returned 4703 [0093.451] rand () returned 27550 [0093.451] rand () returned 30144 [0093.451] rand () returned 30956 [0093.451] rand () returned 8479 [0093.451] rand () returned 4113 [0093.451] rand () returned 22157 [0093.451] rand () returned 11088 [0093.451] rand () returned 19919 [0093.451] rand () returned 30631 [0093.451] rand () returned 11027 [0093.451] rand () returned 3880 [0093.451] rand () returned 29775 [0093.451] rand () returned 11094 [0093.451] rand () returned 17086 [0093.451] rand () returned 14140 [0093.451] rand () returned 6418 [0093.451] rand () returned 10063 [0093.451] rand () returned 19533 [0093.451] rand () returned 28002 [0093.451] rand () returned 7273 [0093.452] rand () returned 20785 [0093.452] rand () returned 17203 [0093.452] rand () returned 31311 [0093.452] rand () returned 13060 [0093.452] rand () returned 7804 [0093.452] rand () returned 19517 [0093.452] rand () returned 8108 [0093.452] rand () returned 18357 [0093.452] rand () returned 32584 [0093.452] rand () returned 17782 [0093.452] rand () returned 30829 [0093.452] rand () returned 10872 [0093.452] rand () returned 24887 [0093.452] rand () returned 3400 [0093.452] rand () returned 13150 [0093.452] rand () returned 12465 [0093.452] rand () returned 24232 [0093.452] rand () returned 17635 [0093.452] rand () returned 23550 [0093.452] rand () returned 10932 [0093.452] rand () returned 28205 [0093.452] rand () returned 4579 [0093.452] rand () returned 9617 [0093.452] rand () returned 21130 [0093.452] rand () returned 9792 [0093.452] rand () returned 9004 [0093.452] rand () returned 27761 [0093.452] rand () returned 6131 [0093.452] rand () returned 26929 [0093.452] rand () returned 32025 [0093.452] rand () returned 24997 [0093.452] rand () returned 28071 [0093.452] rand () returned 3427 [0093.452] rand () returned 20695 [0093.452] rand () returned 5300 [0093.452] rand () returned 31713 [0093.452] rand () returned 21944 [0093.452] rand () returned 25355 [0093.452] rand () returned 20411 [0093.452] rand () returned 23582 [0093.452] rand () returned 20042 [0093.453] rand () returned 17851 [0093.453] rand () returned 31166 [0093.453] rand () returned 16930 [0093.453] rand () returned 24924 [0093.453] rand () returned 26987 [0093.453] rand () returned 29500 [0093.453] rand () returned 13885 [0093.453] rand () returned 14480 [0093.453] rand () returned 18822 [0093.453] rand () returned 8454 [0093.453] rand () returned 17612 [0093.453] rand () returned 15962 [0093.453] rand () returned 14336 [0093.453] rand () returned 6481 [0093.453] rand () returned 18178 [0093.453] rand () returned 21428 [0093.453] rand () returned 3130 [0093.453] rand () returned 9993 [0093.453] rand () returned 10473 [0093.453] rand () returned 3603 [0093.453] rand () returned 14630 [0093.453] rand () returned 5992 [0093.453] rand () returned 20643 [0093.453] rand () returned 4506 [0093.453] rand () returned 3755 [0093.453] rand () returned 1480 [0093.453] rand () returned 2806 [0093.453] rand () returned 23438 [0093.453] rand () returned 10827 [0093.453] rand () returned 6581 [0093.453] rand () returned 8456 [0093.453] rand () returned 4363 [0093.453] rand () returned 23299 [0093.453] rand () returned 27463 [0093.453] rand () returned 31590 [0093.453] rand () returned 9717 [0093.453] rand () returned 31858 [0093.453] rand () returned 430 [0093.454] rand () returned 30283 [0093.454] rand () returned 28720 [0093.454] rand () returned 3390 [0093.454] rand () returned 8207 [0093.454] rand () returned 19232 [0093.454] rand () returned 31508 [0093.454] rand () returned 1204 [0093.454] rand () returned 21647 [0093.454] rand () returned 13119 [0093.454] rand () returned 12059 [0093.454] rand () returned 11182 [0093.454] rand () returned 32173 [0093.454] rand () returned 10236 [0093.454] rand () returned 8669 [0093.454] rand () returned 31930 [0093.454] rand () returned 14804 [0093.454] rand () returned 25574 [0093.454] rand () returned 8767 [0093.454] rand () returned 20344 [0093.454] rand () returned 30000 [0093.454] rand () returned 2378 [0093.454] rand () returned 21735 [0093.454] rand () returned 21316 [0093.454] rand () returned 2498 [0093.454] rand () returned 4601 [0093.454] rand () returned 29939 [0093.454] rand () returned 7445 [0093.454] rand () returned 9647 [0093.454] rand () returned 27723 [0093.454] rand () returned 3306 [0093.454] rand () returned 19621 [0093.454] rand () returned 27614 [0093.454] rand () returned 26980 [0093.454] rand () returned 15346 [0093.454] rand () returned 3283 [0093.454] rand () returned 705 [0093.454] rand () returned 24758 [0093.454] rand () returned 23364 [0093.454] rand () returned 29509 [0093.454] rand () returned 1395 [0093.455] rand () returned 11463 [0093.455] rand () returned 6110 [0093.455] rand () returned 849 [0093.455] rand () returned 2820 [0093.455] rand () returned 25909 [0093.455] rand () returned 21623 [0093.455] rand () returned 22558 [0093.455] rand () returned 14353 [0093.455] rand () returned 31223 [0093.455] rand () returned 26552 [0093.455] rand () returned 14854 [0093.455] rand () returned 3735 [0093.455] rand () returned 5093 [0093.455] rand () returned 2729 [0093.455] rand () returned 9023 [0093.455] rand () returned 28680 [0093.460] CRetailMalloc_Alloc () returned 0x18485ee4bb0 [0093.460] CRetailMalloc_Alloc () returned 0x1848c5e0340 [0093.460] CRetailMalloc_Alloc () returned 0x1848c6b1d60 [0093.460] CRetailMalloc_Alloc () returned 0x1848c03bfb0 [0093.460] CRetailMalloc_Alloc () returned 0x18489261d50 [0093.460] CRetailMalloc_Alloc () returned 0x18489261ce0 [0093.461] CRetailMalloc_Alloc () returned 0x1848c6527f0 [0093.461] memcpy (in: _Dst=0x6c81390535, _Src=0x1848c652808, _Size=0x1 | out: _Dst=0x6c81390535) returned 0x6c81390535 [0093.461] memcpy (in: _Dst=0x6c81390534, _Src=0x1848c652809, _Size=0x1 | out: _Dst=0x6c81390534) returned 0x6c81390534 [0093.462] memcpy (in: _Dst=0x6c8139053c, _Src=0x1848c65280a, _Size=0x2 | out: _Dst=0x6c8139053c) returned 0x6c8139053c [0093.462] memcpy (in: _Dst=0x6c81390374, _Src=0x1848c65280c, _Size=0x1 | out: _Dst=0x6c81390374) returned 0x6c81390374 [0093.462] memcpy (in: _Dst=0x18485ee4cdc, _Src=0x1848c65280d, _Size=0x34 | out: _Dst=0x18485ee4cdc) returned 0x18485ee4cdc [0093.462] memcpy (in: _Dst=0x6c81390320, _Src=0x1848c652841, _Size=0x1 | out: _Dst=0x6c81390320) returned 0x6c81390320 [0093.462] memcpy (in: _Dst=0x6c81390321, _Src=0x1848c652842, _Size=0x1 | out: _Dst=0x6c81390321) returned 0x6c81390321 [0093.462] memcpy (in: _Dst=0x18485ee4e18, _Src=0x1848c652843, _Size=0x2 | out: _Dst=0x18485ee4e18) returned 0x18485ee4e18 [0093.462] memcpy (in: _Dst=0x6c81390300, _Src=0x1848c652845, _Size=0x1 | out: _Dst=0x6c81390300) returned 0x6c81390300 [0093.462] memcpy (in: _Dst=0x6c81390308, _Src=0x1848c652846, _Size=0x1 | out: _Dst=0x6c81390308) returned 0x6c81390308 [0093.462] memcpy (in: _Dst=0x6c813902d8, _Src=0x1848c652847, _Size=0x4 | out: _Dst=0x6c813902d8) returned 0x6c813902d8 [0093.462] CRetailMalloc_Alloc () returned 0x18489261a50 [0093.462] memcpy (in: _Dst=0x18485ee4e38, _Src=0x1848c65284b, _Size=0x10 | out: _Dst=0x18485ee4e38) returned 0x18485ee4e38 [0093.462] memcpy (in: _Dst=0x18485ee4e70, _Src=0x1848c65285b, _Size=0x10 | out: _Dst=0x18485ee4e70) returned 0x18485ee4e70 [0093.462] memcpy (in: _Dst=0x18485ee4eb0, _Src=0x1848c65286b, _Size=0x10 | out: _Dst=0x18485ee4eb0) returned 0x18485ee4eb0 [0093.462] memcpy (in: _Dst=0x18485ee4ec0, _Src=0x1848c65287b, _Size=0x10 | out: _Dst=0x18485ee4ec0) returned 0x18485ee4ec0 [0093.462] memcpy (in: _Dst=0x18485ee4e90, _Src=0x1848c65288b, _Size=0x2 | out: _Dst=0x18485ee4e90) returned 0x18485ee4e90 [0093.462] memcpy (in: _Dst=0x18485ee4ea0, _Src=0x1848c65288d, _Size=0x2 | out: _Dst=0x18485ee4ea0) returned 0x18485ee4ea0 [0093.462] CRetailMalloc_Alloc () returned 0x1848c6b1bc0 [0093.462] memcpy (in: _Dst=0x1848c6b1bc4, _Src=0x1848c65288f, _Size=0x10 | out: _Dst=0x1848c6b1bc4) returned 0x1848c6b1bc4 [0093.462] memcpy (in: _Dst=0x6c813902d8, _Src=0x1848c65289f, _Size=0x4 | out: _Dst=0x6c813902d8) returned 0x6c813902d8 [0093.462] memcpy (in: _Dst=0x1848c6b1c40, _Src=0x1848c6528a3, _Size=0x10 | out: _Dst=0x1848c6b1c40) returned 0x1848c6b1c40 [0093.462] memcpy (in: _Dst=0x18485ee4dc8, _Src=0x1848c6528b3, _Size=0x4 | out: _Dst=0x18485ee4dc8) returned 0x18485ee4dc8 [0093.462] memcpy (in: _Dst=0x6c813902d0, _Src=0x1848c6528b7, _Size=0x1 | out: _Dst=0x6c813902d0) returned 0x6c813902d0 [0093.462] memcpy (in: _Dst=0x6c813902d8, _Src=0x1848c6528b8, _Size=0x1 | out: _Dst=0x6c813902d8) returned 0x6c813902d8 [0093.463] memcpy (in: _Dst=0x6c813902a8, _Src=0x1848c6528b9, _Size=0x4 | out: _Dst=0x6c813902a8) returned 0x6c813902a8 [0093.463] memcpy (in: _Dst=0x18489261c50, _Src=0x1848c6528bd, _Size=0x8 | out: _Dst=0x18489261c50) returned 0x18489261c50 [0093.463] memcpy (in: _Dst=0x6c81390374, _Src=0x1848c6528c5, _Size=0x1 | out: _Dst=0x6c81390374) returned 0x6c81390374 [0093.463] memcpy (in: _Dst=0x18485ee4f1c, _Src=0x1848c6528c6, _Size=0x10 | out: _Dst=0x18485ee4f1c) returned 0x18485ee4f1c [0093.463] memcpy (in: _Dst=0x18485ee4f2c, _Src=0x1848c6528d6, _Size=0x10 | out: _Dst=0x18485ee4f2c) returned 0x18485ee4f2c [0093.463] memcpy (in: _Dst=0x18485ee4c48, _Src=0x1848c6528e6, _Size=0x2 | out: _Dst=0x18485ee4c48) returned 0x18485ee4c48 [0093.463] memcpy (in: _Dst=0x18485ee4c4a, _Src=0x1848c6528e8, _Size=0x2 | out: _Dst=0x18485ee4c4a) returned 0x18485ee4c4a [0093.463] memcpy (in: _Dst=0x18485ee4bdc, _Src=0x1848c6528ea, _Size=0x2 | out: _Dst=0x18485ee4bdc) returned 0x18485ee4bdc [0093.463] CRetailMalloc_Alloc () returned 0x1848c655790 [0093.463] CRetailMalloc_Alloc () returned 0x1848c5e0340 [0093.463] memcpy (in: _Dst=0x6c813902e0, _Src=0x1848c6528ec, _Size=0x2 | out: _Dst=0x6c813902e0) returned 0x6c813902e0 [0093.463] memcpy (in: _Dst=0x6c813902e0, _Src=0x1848c6528ee, _Size=0x2 | out: _Dst=0x6c813902e0) returned 0x6c813902e0 [0093.463] memcpy (in: _Dst=0x1848c655a70, _Src=0x1848c6528f0, _Size=0x10 | out: _Dst=0x1848c655a70) returned 0x1848c655a70 [0093.463] memcpy (in: _Dst=0x1848c655aa8, _Src=0x1848c652900, _Size=0x2 | out: _Dst=0x1848c655aa8) returned 0x1848c655aa8 [0093.463] memcpy (in: _Dst=0x6c813902c0, _Src=0x1848c652902, _Size=0x1 | out: _Dst=0x6c813902c0) returned 0x6c813902c0 [0093.463] memcpy (in: _Dst=0x6c813902c8, _Src=0x1848c652903, _Size=0x1 | out: _Dst=0x6c813902c8) returned 0x6c813902c8 [0093.463] memcpy (in: _Dst=0x6c81390298, _Src=0x1848c652904, _Size=0x4 | out: _Dst=0x6c81390298) returned 0x6c81390298 [0093.464] CRetailMalloc_Alloc () returned 0x18489261c30 [0093.464] CRetailMalloc_Alloc () returned 0x18489261c40 [0093.464] CRetailMalloc_Alloc () returned 0x18489261d90 [0093.464] CRetailMalloc_Alloc () returned 0x1848c5e0340 [0093.508] memcpy (in: _Dst=0x6c81390275, _Src=0x1848c652908, _Size=0x1 | out: _Dst=0x6c81390275) returned 0x6c81390275 [0093.508] memcpy (in: _Dst=0x6c81390274, _Src=0x1848c652909, _Size=0x1 | out: _Dst=0x6c81390274) returned 0x6c81390274 [0093.508] memcpy (in: _Dst=0x1848c6558b0, _Src=0x1848c65290a, _Size=0x2 | out: _Dst=0x1848c6558b0) returned 0x1848c6558b0 [0093.508] memcpy (in: _Dst=0x6c81390258, _Src=0x1848c65290c, _Size=0x4 | out: _Dst=0x6c81390258) returned 0x6c81390258 [0093.509] CRetailMalloc_Alloc () returned 0x18489261d20 [0093.509] CRetailMalloc_Alloc () returned 0x18489261b50 [0093.509] memcpy (in: _Dst=0x1848c655820, _Src=0x1848c652910, _Size=0x2 | out: _Dst=0x1848c655820) returned 0x1848c655820 [0093.513] memcpy (in: _Dst=0x1848c6557e0, _Src=0x1848c652912, _Size=0x40 | out: _Dst=0x1848c6557e0) returned 0x1848c6557e0 [0093.513] memcpy (in: _Dst=0x1848c655870, _Src=0x1848c652952, _Size=0x40 | out: _Dst=0x1848c655870) returned 0x1848c655870 [0093.513] memcpy (in: _Dst=0x6c81390258, _Src=0x1848c652992, _Size=0x4 | out: _Dst=0x6c81390258) returned 0x6c81390258 [0093.513] memcpy (in: _Dst=0x1848c5736c0, _Src=0x1848c652996, _Size=0xa0 | out: _Dst=0x1848c5736c0) returned 0x1848c5736c0 [0093.513] memcpy (in: _Dst=0x1848c655850, _Src=0x1848c652a36, _Size=0x2 | out: _Dst=0x1848c655850) returned 0x1848c655850 [0093.513] memcpy (in: _Dst=0x6c81390250, _Src=0x1848c652a38, _Size=0x1 | out: _Dst=0x6c81390250) returned 0x6c81390250 [0093.513] memcpy (in: _Dst=0x6c81390258, _Src=0x1848c652a39, _Size=0x1 | out: _Dst=0x6c81390258) returned 0x6c81390258 [0093.513] memcpy (in: _Dst=0x6c81390228, _Src=0x1848c652a3a, _Size=0x4 | out: _Dst=0x6c81390228) returned 0x6c81390228 [0093.513] CRetailMalloc_Alloc () returned 0x18489261c40 [0093.513] memcpy (in: _Dst=0x1848c6558e8, _Src=0x1848c652a3e, _Size=0x2 | out: _Dst=0x1848c6558e8) returned 0x1848c6558e8 [0093.515] memcpy (in: _Dst=0x6c81390250, _Src=0x1848c652a40, _Size=0x2 | out: _Dst=0x6c81390250) returned 0x6c81390250 [0093.515] CRetailMalloc_Alloc () returned 0x18485a0eaa0 [0093.515] memcpy (in: _Dst=0x18485a0eaa0, _Src=0x1848c652a42, _Size=0x4e | out: _Dst=0x18485a0eaa0) returned 0x18485a0eaa0 [0093.516] CRetailMalloc_Alloc () returned 0x18485a0a3c0 [0093.516] CRetailMalloc_Free () returned 0x1 [0093.517] CRetailMalloc_Alloc () returned 0x1848c03b110 [0093.517] memcpy (in: _Dst=0x1848c655a60, _Src=0x1848c652a90, _Size=0x2 | out: _Dst=0x1848c655a60) returned 0x1848c655a60 [0093.517] memcpy (in: _Dst=0x1848c655a64, _Src=0x1848c652a92, _Size=0x4 | out: _Dst=0x1848c655a64) returned 0x1848c655a64 [0093.517] memcpy (in: _Dst=0x1848c655928, _Src=0x1848c652a96, _Size=0x4 | out: _Dst=0x1848c655928) returned 0x1848c655928 [0093.517] memcpy (in: _Dst=0x6c81390240, _Src=0x1848c652a9a, _Size=0x1 | out: _Dst=0x6c81390240) returned 0x6c81390240 [0093.517] memcpy (in: _Dst=0x6c81390248, _Src=0x1848c652a9b, _Size=0x1 | out: _Dst=0x6c81390248) returned 0x6c81390248 [0093.517] memcpy (in: _Dst=0x6c81390218, _Src=0x1848c652a9c, _Size=0x4 | out: _Dst=0x6c81390218) returned 0x6c81390218 [0093.517] memcpy (in: _Dst=0x1848c658160, _Src=0x1848c652aa0, _Size=0x168 | out: _Dst=0x1848c658160) returned 0x1848c658160 [0104.375] NtdllDefWindowProc_A (hWnd=0x40426, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0106.355] memcpy (in: _Dst=0x1848c655948, _Src=0x1848c652808, _Size=0x2 | out: _Dst=0x1848c655948) returned 0x1848c655948 [0106.355] memcpy (in: _Dst=0x1848c65594a, _Src=0x1848c65280a, _Size=0x2 | out: _Dst=0x1848c65594a) returned 0x1848c65594a [0106.355] memcpy (in: _Dst=0x1848c65594c, _Src=0x1848c65280c, _Size=0x2 | out: _Dst=0x1848c65594c) returned 0x1848c65594c [0106.355] memcpy (in: _Dst=0x1848c65594e, _Src=0x1848c65280e, _Size=0x2 | out: _Dst=0x1848c65594e) returned 0x1848c65594e [0106.355] memcpy (in: _Dst=0x1848c655950, _Src=0x1848c652810, _Size=0x2 | out: _Dst=0x1848c655950) returned 0x1848c655950 [0106.355] memcpy (in: _Dst=0x1848c655952, _Src=0x1848c652812, _Size=0x2 | out: _Dst=0x1848c655952) returned 0x1848c655952 [0106.355] memcpy (in: _Dst=0x1848c655954, _Src=0x1848c652814, _Size=0x2 | out: _Dst=0x1848c655954) returned 0x1848c655954 [0106.355] memcpy (in: _Dst=0x1848c655956, _Src=0x1848c652816, _Size=0x2 | out: _Dst=0x1848c655956) returned 0x1848c655956 [0106.355] memcpy (in: _Dst=0x1848c65595c, _Src=0x1848c652818, _Size=0x4 | out: _Dst=0x1848c65595c) returned 0x1848c65595c [0106.355] memcpy (in: _Dst=0x1848c655960, _Src=0x1848c65281c, _Size=0x4 | out: _Dst=0x1848c655960) returned 0x1848c655960 [0106.355] memcpy (in: _Dst=0x1848c655964, _Src=0x1848c652820, _Size=0x4 | out: _Dst=0x1848c655964) returned 0x1848c655964 [0106.355] memcpy (in: _Dst=0x1848c655968, _Src=0x1848c652824, _Size=0x4 | out: _Dst=0x1848c655968) returned 0x1848c655968 [0106.355] memcpy (in: _Dst=0x1848c65596c, _Src=0x1848c652828, _Size=0x4 | out: _Dst=0x1848c65596c) returned 0x1848c65596c [0106.355] memcpy (in: _Dst=0x1848c655970, _Src=0x1848c65282c, _Size=0x4 | out: _Dst=0x1848c655970) returned 0x1848c655970 [0106.355] memcpy (in: _Dst=0x1848c655974, _Src=0x1848c652830, _Size=0x4 | out: _Dst=0x1848c655974) returned 0x1848c655974 [0106.355] memcpy (in: _Dst=0x1848c655978, _Src=0x1848c652834, _Size=0x4 | out: _Dst=0x1848c655978) returned 0x1848c655978 [0106.355] memcpy (in: _Dst=0x1848c65597c, _Src=0x1848c652838, _Size=0x4 | out: _Dst=0x1848c65597c) returned 0x1848c65597c [0106.355] memcpy (in: _Dst=0x1848c655980, _Src=0x1848c65283c, _Size=0x4 | out: _Dst=0x1848c655980) returned 0x1848c655980 [0106.355] memcpy (in: _Dst=0x1848c655984, _Src=0x1848c652840, _Size=0x4 | out: _Dst=0x1848c655984) returned 0x1848c655984 [0106.355] memcpy (in: _Dst=0x1848c655988, _Src=0x1848c652844, _Size=0x4 | out: _Dst=0x1848c655988) returned 0x1848c655988 [0106.355] memcpy (in: _Dst=0x1848c655990, _Src=0x1848c652848, _Size=0x4 | out: _Dst=0x1848c655990) returned 0x1848c655990 [0106.355] memcpy (in: _Dst=0x1848c6559a8, _Src=0x1848c65284c, _Size=0x4 | out: _Dst=0x1848c6559a8) returned 0x1848c6559a8 [0106.355] memcpy (in: _Dst=0x1848c6559ac, _Src=0x1848c652850, _Size=0x4 | out: _Dst=0x1848c6559ac) returned 0x1848c6559ac [0106.355] memcpy (in: _Dst=0x1848c655958, _Src=0x1848c652854, _Size=0x4 | out: _Dst=0x1848c655958) returned 0x1848c655958 [0106.355] memcpy (in: _Dst=0x6c81390260, _Src=0x1848c652858, _Size=0x2 | out: _Dst=0x6c81390260) returned 0x6c81390260 [0106.356] memcpy (in: _Dst=0x6c81390250, _Src=0x1848c65285a, _Size=0x2 | out: _Dst=0x6c81390250) returned 0x6c81390250 [0106.356] memcpy (in: _Dst=0x6c8139025c, _Src=0x1848c65285c, _Size=0x4 | out: _Dst=0x6c8139025c) returned 0x6c8139025c [0106.356] memcpy (in: _Dst=0x6c81390254, _Src=0x1848c652860, _Size=0x2 | out: _Dst=0x6c81390254) returned 0x6c81390254 [0106.356] memcpy (in: _Dst=0x6c81390260, _Src=0x1848c652862, _Size=0x4 | out: _Dst=0x6c81390260) returned 0x6c81390260 [0106.356] memcpy (in: _Dst=0x1848c6559f4, _Src=0x1848c652866, _Size=0x2 | out: _Dst=0x1848c6559f4) returned 0x1848c6559f4 [0106.356] memcpy (in: _Dst=0x1848c6559f6, _Src=0x1848c652868, _Size=0x2 | out: _Dst=0x1848c6559f6) returned 0x1848c6559f6 [0106.356] memcpy (in: _Dst=0x1848c6559f8, _Src=0x1848c65286a, _Size=0x2 | out: _Dst=0x1848c6559f8) returned 0x1848c6559f8 [0106.356] memcpy (in: _Dst=0x1848c6559c0, _Src=0x1848c65286c, _Size=0x4 | out: _Dst=0x1848c6559c0) returned 0x1848c6559c0 [0106.356] memcpy (in: _Dst=0x1848c6559c4, _Src=0x1848c652870, _Size=0x4 | out: _Dst=0x1848c6559c4) returned 0x1848c6559c4 [0106.356] memcpy (in: _Dst=0x1848c6559c8, _Src=0x1848c652874, _Size=0x4 | out: _Dst=0x1848c6559c8) returned 0x1848c6559c8 [0106.356] memcpy (in: _Dst=0x1848c6559cc, _Src=0x1848c652878, _Size=0x4 | out: _Dst=0x1848c6559cc) returned 0x1848c6559cc [0106.356] memcpy (in: _Dst=0x1848c6559d0, _Src=0x1848c65287c, _Size=0x4 | out: _Dst=0x1848c6559d0) returned 0x1848c6559d0 [0106.356] memcpy (in: _Dst=0x1848c655a28, _Src=0x1848c652880, _Size=0x4 | out: _Dst=0x1848c655a28) returned 0x1848c655a28 [0106.356] memcpy (in: _Dst=0x6c81390210, _Src=0x1848c652884, _Size=0x2 | out: _Dst=0x6c81390210) returned 0x6c81390210 [0106.356] memcpy (in: _Dst=0x1848c655a10, _Src=0x1848c652886, _Size=0x4 | out: _Dst=0x1848c655a10) returned 0x1848c655a10 [0106.357] memcpy (in: _Dst=0x6c813902ec, _Src=0x1848c65288a, _Size=0x4 | out: _Dst=0x6c813902ec) returned 0x6c813902ec [0106.357] memcpy (in: _Dst=0x6c813902d4, _Src=0x1848c65288e, _Size=0x2 | out: _Dst=0x6c813902d4) returned 0x6c813902d4 [0106.357] CRetailMalloc_Alloc () returned 0x18489408350 [0106.358] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x6c8138fa00 | out: phkResult=0x6c8138fa00*=0xc22) returned 0x0 [0106.358] RegOpenKeyW (in: hKey=0xc22, lpSubKey="{000204EF-0000-0000-C000-000000000046}", phkResult=0x6c8138f9f8 | out: phkResult=0x6c8138f9f8*=0x1086) returned 0x0 [0106.358] RegEnumKeyW (in: hKey=0x1086, dwIndex=0x0, lpName=0x6c8138fa28, cchName=0xa | out: lpName="2.1") returned 0x0 [0106.359] RegEnumKeyW (in: hKey=0x1086, dwIndex=0x1, lpName=0x6c8138fa28, cchName=0xa | out: lpName="4.2") returned 0x0 [0106.359] wcscpy_s (in: _Destination=0x6c8138fa10, _SizeInWords=0xa, _Source="4.2" | out: _Destination="4.2") returned 0x0 [0106.359] RegOpenKeyW (in: hKey=0x1086, lpSubKey="4.2", phkResult=0x6c8138fab8 | out: phkResult=0x6c8138fab8*=0xfe6) returned 0x0 [0106.359] _ultoa_s (in: _Val=0x9, _DstBuf=0x6c8138fa30, _Size=0xa, _Radix=16 | out: _DstBuf="9") returned 0x0 [0106.359] RegOpenKeyA (in: hKey=0xfe6, lpSubKey="9", phkResult=0x6c8138fa20 | out: phkResult=0x6c8138fa20*=0xfe2) returned 0x0 [0106.359] RegOpenKeyW (in: hKey=0xfe2, lpSubKey="win64", phkResult=0x6c8138fa28 | out: phkResult=0x6c8138fa28*=0xfde) returned 0x0 [0106.360] RegCloseKey (hKey=0xfde) returned 0x0 [0106.360] RegCloseKey (hKey=0xfe2) returned 0x0 [0106.360] _ultow_s (in: _Value=0x9, _Buffer=0x6c8138fac0, _BufferCount=0x9, _Radix=16 | out: _Buffer="9") returned 0x0 [0106.360] RegOpenKeyW (in: hKey=0xfe6, lpSubKey="9", phkResult=0x6c8138fa98 | out: phkResult=0x6c8138fa98*=0xfe2) returned 0x0 [0106.360] RegQueryValueW (in: hKey=0xfe2, lpSubKey="win64", lpData=0x6c8138fae0, lpcbData=0x6c8138fa94 | out: lpData="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\VBE7.DLL", lpcbData=0x6c8138fa94) returned 0x0 [0106.360] wcscpy_s (in: _Destination=0x18489408350, _SizeInWords=0x104, _Source="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\VBE7.DLL" | out: _Destination="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\VBE7.DLL") returned 0x0 [0106.360] RegCloseKey (hKey=0xfe2) returned 0x0 [0106.360] RegCloseKey (hKey=0xfe6) returned 0x0 [0106.360] RegCloseKey (hKey=0x1086) returned 0x0 [0106.360] RegCloseKey (hKey=0xc22) returned 0x0 [0106.410] StringFromGUID2 (in: rguid=0x18485a219a0*(Data1=0x204ef, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x6c8138ff20, cchMax=39 | out: lpsz="{000204EF-0000-0000-C000-000000000046}") returned 39 [0106.410] _ultow_s (in: _Value=0x4, _Buffer=0x6c8138fe6a, _BufferCount=0x10, _Radix=16 | out: _Buffer="4") returned 0x0 [0106.410] _ultow_s (in: _Value=0x2, _Buffer=0x6c8138fe6e, _BufferCount=0xe, _Radix=16 | out: _Buffer="2") returned 0x0 [0106.410] _ultow_s (in: _Value=0x9, _Buffer=0x6c8138fe72, _BufferCount=0xc, _Radix=16 | out: _Buffer="9") returned 0x0 [0106.410] wcscpy_s (in: _Destination=0x18486110f78, _SizeInWords=0x80, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0106.410] wcscpy_s (in: _Destination=0x18486110f7e, _SizeInWords=0x7d, _Source="{000204EF-0000-0000-C000-000000000046}" | out: _Destination="{000204EF-0000-0000-C000-000000000046}") returned 0x0 [0106.410] wcscpy_s (in: _Destination=0x18486110fca, _SizeInWords=0x57, _Source="#4.2#9#" | out: _Destination="#4.2#9#") returned 0x0 [0106.410] wcscpy_s (in: _Destination=0x18486110fd8, _SizeInWords=0x50, _Source="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\VBE7.DLL" | out: _Destination="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\VBE7.DLL") returned 0x0 [0106.410] wcscpy_s (in: _Destination=0x1848611103c, _SizeInWords=0x1e, _Source="Visual Basic For Applications" | out: _Destination="Visual Basic For Applications") returned 0x0 [0106.410] wcscpy_s (in: _Destination=0x1848c65ae28, _SizeInWords=0x80, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications" | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0106.410] CRetailMalloc_Free () returned 0x1 [0106.411] CRetailMalloc_Alloc () returned 0x184894091c0 [0106.411] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x6c8138fa00 | out: phkResult=0x6c8138fa00*=0xfe6) returned 0x0 [0106.411] RegOpenKeyW (in: hKey=0xfe6, lpSubKey="{00020813-0000-0000-C000-000000000046}", phkResult=0x6c8138f9f8 | out: phkResult=0x6c8138f9f8*=0xfe2) returned 0x0 [0106.411] RegEnumKeyW (in: hKey=0xfe2, dwIndex=0x0, lpName=0x6c8138fa28, cchName=0xa | out: lpName="1.9") returned 0x0 [0106.412] wcscpy_s (in: _Destination=0x6c8138fa10, _SizeInWords=0xa, _Source="1.9" | out: _Destination="1.9") returned 0x0 [0106.412] RegOpenKeyW (in: hKey=0xfe2, lpSubKey="1.9", phkResult=0x6c8138fab8 | out: phkResult=0x6c8138fab8*=0xfde) returned 0x0 [0106.412] _ultoa_s (in: _Val=0x0, _DstBuf=0x6c8138fa30, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0106.412] RegOpenKeyA (in: hKey=0xfde, lpSubKey="0", phkResult=0x6c8138fa20 | out: phkResult=0x6c8138fa20*=0xfda) returned 0x0 [0106.412] RegOpenKeyW (in: hKey=0xfda, lpSubKey="win64", phkResult=0x6c8138fa28 | out: phkResult=0x6c8138fa28*=0xfd6) returned 0x0 [0106.412] RegCloseKey (hKey=0xfd6) returned 0x0 [0106.412] RegCloseKey (hKey=0xfda) returned 0x0 [0106.412] _ultow_s (in: _Value=0x0, _Buffer=0x6c8138fac0, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0106.412] RegOpenKeyW (in: hKey=0xfde, lpSubKey="0", phkResult=0x6c8138fa98 | out: phkResult=0x6c8138fa98*=0xfda) returned 0x0 [0106.412] RegQueryValueW (in: hKey=0xfda, lpSubKey="win64", lpData=0x6c8138fae0, lpcbData=0x6c8138fa94 | out: lpData="C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE", lpcbData=0x6c8138fa94) returned 0x0 [0106.412] wcscpy_s (in: _Destination=0x184894091c0, _SizeInWords=0x104, _Source="C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE" | out: _Destination="C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE") returned 0x0 [0106.413] RegCloseKey (hKey=0xfda) returned 0x0 [0106.413] RegCloseKey (hKey=0xfde) returned 0x0 [0106.413] RegCloseKey (hKey=0xfe2) returned 0x0 [0106.413] RegCloseKey (hKey=0xfe6) returned 0x0 [0106.413] CRetailMalloc_Free () returned 0x1 [0106.413] CRetailMalloc_Alloc () returned 0x18489408fb0 [0106.414] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x6c8138fa00 | out: phkResult=0x6c8138fa00*=0xfe6) returned 0x0 [0106.414] RegOpenKeyW (in: hKey=0xfe6, lpSubKey="{00020430-0000-0000-C000-000000000046}", phkResult=0x6c8138f9f8 | out: phkResult=0x6c8138f9f8*=0xfe2) returned 0x0 [0106.414] RegEnumKeyW (in: hKey=0xfe2, dwIndex=0x0, lpName=0x6c8138fa28, cchName=0xa | out: lpName="1.0") returned 0x0 [0106.414] RegEnumKeyW (in: hKey=0xfe2, dwIndex=0x1, lpName=0x6c8138fa28, cchName=0xa | out: lpName="2.0") returned 0x0 [0106.414] wcscpy_s (in: _Destination=0x6c8138fa10, _SizeInWords=0xa, _Source="2.0" | out: _Destination="2.0") returned 0x0 [0106.414] RegOpenKeyW (in: hKey=0xfe2, lpSubKey="2.0", phkResult=0x6c8138fab8 | out: phkResult=0x6c8138fab8*=0xfde) returned 0x0 [0106.414] _ultoa_s (in: _Val=0x0, _DstBuf=0x6c8138fa30, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0106.414] RegOpenKeyA (in: hKey=0xfde, lpSubKey="0", phkResult=0x6c8138fa20 | out: phkResult=0x6c8138fa20*=0xfda) returned 0x0 [0106.414] RegOpenKeyW (in: hKey=0xfda, lpSubKey="win64", phkResult=0x6c8138fa28 | out: phkResult=0x6c8138fa28*=0xfd6) returned 0x0 [0106.414] RegCloseKey (hKey=0xfd6) returned 0x0 [0106.415] RegCloseKey (hKey=0xfda) returned 0x0 [0106.415] _ultow_s (in: _Value=0x0, _Buffer=0x6c8138fac0, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0106.415] RegOpenKeyW (in: hKey=0xfde, lpSubKey="0", phkResult=0x6c8138fa98 | out: phkResult=0x6c8138fa98*=0xfda) returned 0x0 [0106.415] RegQueryValueW (in: hKey=0xfda, lpSubKey="win64", lpData=0x6c8138fae0, lpcbData=0x6c8138fa94 | out: lpData="C:\\Windows\\System32\\stdole2.tlb", lpcbData=0x6c8138fa94) returned 0x0 [0106.415] wcscpy_s (in: _Destination=0x18489408fb0, _SizeInWords=0x104, _Source="C:\\Windows\\System32\\stdole2.tlb" | out: _Destination="C:\\Windows\\System32\\stdole2.tlb") returned 0x0 [0106.415] RegCloseKey (hKey=0xfda) returned 0x0 [0106.415] RegCloseKey (hKey=0xfde) returned 0x0 [0106.415] RegCloseKey (hKey=0xfe2) returned 0x0 [0106.415] RegCloseKey (hKey=0xfe6) returned 0x0 [0106.415] CRetailMalloc_Free () returned 0x1 [0106.416] CRetailMalloc_Alloc () returned 0x18489409e20 [0106.416] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x6c8138fa00 | out: phkResult=0x6c8138fa00*=0xfe6) returned 0x0 [0106.416] RegOpenKeyW (in: hKey=0xfe6, lpSubKey="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}", phkResult=0x6c8138f9f8 | out: phkResult=0x6c8138f9f8*=0xfe2) returned 0x0 [0106.416] RegEnumKeyW (in: hKey=0xfe2, dwIndex=0x0, lpName=0x6c8138fa28, cchName=0xa | out: lpName="2.6") returned 0x0 [0106.416] RegEnumKeyW (in: hKey=0xfe2, dwIndex=0x1, lpName=0x6c8138fa28, cchName=0xa | out: lpName="2.8") returned 0x0 [0106.416] wcscpy_s (in: _Destination=0x6c8138fa10, _SizeInWords=0xa, _Source="2.8" | out: _Destination="2.8") returned 0x0 [0106.417] RegOpenKeyW (in: hKey=0xfe2, lpSubKey="2.8", phkResult=0x6c8138fab8 | out: phkResult=0x6c8138fab8*=0xfde) returned 0x0 [0106.417] _ultoa_s (in: _Val=0x0, _DstBuf=0x6c8138fa30, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0106.417] RegOpenKeyA (in: hKey=0xfde, lpSubKey="0", phkResult=0x6c8138fa20 | out: phkResult=0x6c8138fa20*=0xfda) returned 0x0 [0106.417] RegOpenKeyW (in: hKey=0xfda, lpSubKey="win64", phkResult=0x6c8138fa28 | out: phkResult=0x6c8138fa28*=0xfd6) returned 0x0 [0106.417] RegCloseKey (hKey=0xfd6) returned 0x0 [0106.417] RegCloseKey (hKey=0xfda) returned 0x0 [0106.417] _ultow_s (in: _Value=0x0, _Buffer=0x6c8138fac0, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0106.417] RegOpenKeyW (in: hKey=0xfde, lpSubKey="0", phkResult=0x6c8138fa98 | out: phkResult=0x6c8138fa98*=0xfda) returned 0x0 [0106.417] RegQueryValueW (in: hKey=0xfda, lpSubKey="win64", lpData=0x6c8138fae0, lpcbData=0x6c8138fa94 | out: lpData="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", lpcbData=0x6c8138fa94) returned 0x0 [0106.417] wcscpy_s (in: _Destination=0x18489409e20, _SizeInWords=0x104, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0106.417] RegCloseKey (hKey=0xfda) returned 0x0 [0106.417] RegCloseKey (hKey=0xfde) returned 0x0 [0106.417] RegCloseKey (hKey=0xfe2) returned 0x0 [0106.418] RegCloseKey (hKey=0xfe6) returned 0x0 [0106.418] CRetailMalloc_Free () returned 0x1 [0106.418] memcpy (in: _Dst=0x6c813902b4, _Src=0x1848c652890, _Size=0x1 | out: _Dst=0x6c813902b4) returned 0x6c813902b4 [0106.418] memcpy (in: _Dst=0x6c81390290, _Src=0x1848c652891, _Size=0x2 | out: _Dst=0x6c81390290) returned 0x6c81390290 [0106.418] CRetailMalloc_Alloc () returned 0x1848c6b2520 [0106.418] memcpy (in: _Dst=0x1848c6b2520, _Src=0x1848c652893, _Size=0x12 | out: _Dst=0x1848c6b2520) returned 0x1848c6b2520 [0106.419] CRetailMalloc_Free () returned 0x1 [0106.419] memcpy (in: _Dst=0x6c813902b4, _Src=0x1848c6528a5, _Size=0x1 | out: _Dst=0x6c813902b4) returned 0x6c813902b4 [0106.419] memcpy (in: _Dst=0x6c81390290, _Src=0x1848c6528a6, _Size=0x2 | out: _Dst=0x6c81390290) returned 0x6c81390290 [0106.419] CRetailMalloc_Alloc () returned 0x1848c5d1bb0 [0106.419] memcpy (in: _Dst=0x1848c5d1bb0, _Src=0x1848c6528a8, _Size=0x24 | out: _Dst=0x1848c5d1bb0) returned 0x1848c5d1bb0 [0106.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="02671158c2", cchWideChar=11, lpMultiByteStr=0x6c81390050, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="02671158c2", lpUsedDefaultChar=0x0) returned 11 [0106.422] wcscpy_s (in: _Destination=0x1848c56cc38, _SizeInWords=0x48, _Source="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm" | out: _Destination="*\\CC:\\Users\\RDhJ0CNFevzX\\Desktop\\habilitado para macro.xlsm") returned 0x0 [0106.422] wcscpy_s (in: _Destination=0x1848c56ccb0, _SizeInWords=0xb, _Source="02671158c2" | out: _Destination="02671158c2") returned 0x0 [0106.422] _wcsicmp (_String1="02671158c2", _String2="02671158c2") returned 0 [0106.422] CRetailMalloc_Free () returned 0x1 [0106.423] memcpy (in: _Dst=0x6c813902b4, _Src=0x1848c6528cc, _Size=0x1 | out: _Dst=0x6c813902b4) returned 0x6c813902b4 [0106.423] memcpy (in: _Dst=0x6c81390290, _Src=0x1848c6528cd, _Size=0x2 | out: _Dst=0x6c81390290) returned 0x6c81390290 [0106.423] CRetailMalloc_Alloc () returned 0x1848c6b2520 [0106.423] memcpy (in: _Dst=0x1848c6b2520, _Src=0x1848c6528cf, _Size=0x12 | out: _Dst=0x1848c6b2520) returned 0x1848c6b2520 [0106.423] CRetailMalloc_Free () returned 0x1 [0106.423] memcpy (in: _Dst=0x6c813902b4, _Src=0x1848c6528e1, _Size=0x1 | out: _Dst=0x6c813902b4) returned 0x6c813902b4 [0106.423] memcpy (in: _Dst=0x6c81390290, _Src=0x1848c6528e2, _Size=0x2 | out: _Dst=0x6c81390290) returned 0x6c81390290 [0106.423] CRetailMalloc_Alloc () returned 0x1848c6b2520 [0106.423] memcpy (in: _Dst=0x1848c6b2520, _Src=0x1848c6528e4, _Size=0x12 | out: _Dst=0x1848c6b2520) returned 0x1848c6b2520 [0106.424] CRetailMalloc_Free () returned 0x1 [0106.424] memcpy (in: _Dst=0x6c813902b4, _Src=0x1848c6528f6, _Size=0x1 | out: _Dst=0x6c813902b4) returned 0x6c813902b4 [0106.424] memcpy (in: _Dst=0x6c81390290, _Src=0x1848c6528f7, _Size=0x2 | out: _Dst=0x6c81390290) returned 0x6c81390290 [0106.424] CRetailMalloc_Alloc () returned 0x1848c6b2520 [0106.424] memcpy (in: _Dst=0x1848c6b2520, _Src=0x1848c6528f9, _Size=0x12 | out: _Dst=0x1848c6b2520) returned 0x1848c6b2520 [0106.424] CRetailMalloc_Free () returned 0x1 [0106.424] memcpy (in: _Dst=0x6c813902b4, _Src=0x1848c65290b, _Size=0x1 | out: _Dst=0x6c813902b4) returned 0x6c813902b4 [0106.424] memcpy (in: _Dst=0x6c81390290, _Src=0x1848c65290c, _Size=0x2 | out: _Dst=0x6c81390290) returned 0x6c81390290 [0106.424] CRetailMalloc_Alloc () returned 0x1848c6b2520 [0106.424] memcpy (in: _Dst=0x1848c6b2520, _Src=0x1848c65290e, _Size=0x10 | out: _Dst=0x1848c6b2520) returned 0x1848c6b2520 [0106.425] CRetailMalloc_Free () returned 0x1 [0106.425] memcpy (in: _Dst=0x6c813902b4, _Src=0x1848c65291e, _Size=0x1 | out: _Dst=0x6c813902b4) returned 0x6c813902b4 [0106.425] memcpy (in: _Dst=0x6c81390290, _Src=0x1848c65291f, _Size=0x2 | out: _Dst=0x6c81390290) returned 0x6c81390290 [0106.425] CRetailMalloc_Alloc () returned 0x1848c6b2520 [0106.425] memcpy (in: _Dst=0x1848c6b2520, _Src=0x1848c652921, _Size=0x12 | out: _Dst=0x1848c6b2520) returned 0x1848c6b2520 [0106.425] CRetailMalloc_Free () returned 0x1 [0106.425] memcpy (in: _Dst=0x6c813902b4, _Src=0x1848c652933, _Size=0x1 | out: _Dst=0x6c813902b4) returned 0x6c813902b4 [0106.425] memcpy (in: _Dst=0x6c81390290, _Src=0x1848c652934, _Size=0x2 | out: _Dst=0x6c81390290) returned 0x6c81390290 [0106.425] CRetailMalloc_Alloc () returned 0x1848c6b2520 [0106.425] memcpy (in: _Dst=0x1848c6b2520, _Src=0x1848c652936, _Size=0x10 | out: _Dst=0x1848c6b2520) returned 0x1848c6b2520 [0106.426] CRetailMalloc_Free () returned 0x1 [0106.426] memcpy (in: _Dst=0x6c813902b4, _Src=0x1848c652946, _Size=0x1 | out: _Dst=0x6c813902b4) returned 0x6c813902b4 [0106.426] memcpy (in: _Dst=0x6c81390290, _Src=0x1848c652947, _Size=0x2 | out: _Dst=0x6c81390290) returned 0x6c81390290 [0106.426] CRetailMalloc_Alloc () returned 0x1848c6b2520 [0106.426] memcpy (in: _Dst=0x1848c6b2520, _Src=0x1848c652949, _Size=0x10 | out: _Dst=0x1848c6b2520) returned 0x1848c6b2520 [0106.426] CRetailMalloc_Free () returned 0x1 [0106.426] memcpy (in: _Dst=0x6c813902b4, _Src=0x1848c652959, _Size=0x1 | out: _Dst=0x6c813902b4) returned 0x6c813902b4 [0106.426] memcpy (in: _Dst=0x6c81390290, _Src=0x1848c65295a, _Size=0x2 | out: _Dst=0x6c81390290) returned 0x6c81390290 [0106.426] CRetailMalloc_Alloc () returned 0x1848c6b2520 [0106.426] memcpy (in: _Dst=0x1848c6b2520, _Src=0x1848c65295c, _Size=0xe | out: _Dst=0x1848c6b2520) returned 0x1848c6b2520 [0106.426] CRetailMalloc_Free () returned 0x1 [0106.426] memcpy (in: _Dst=0x6c813902b4, _Src=0x1848c65296a, _Size=0x1 | out: _Dst=0x6c813902b4) returned 0x6c813902b4 [0106.426] memcpy (in: _Dst=0x6c81390290, _Src=0x1848c65296b, _Size=0x2 | out: _Dst=0x6c81390290) returned 0x6c81390290 [0106.426] CRetailMalloc_Alloc () returned 0x1848c6b2520 [0106.427] memcpy (in: _Dst=0x1848c6b2520, _Src=0x1848c65296d, _Size=0x10 | out: _Dst=0x1848c6b2520) returned 0x1848c6b2520 [0106.427] CRetailMalloc_Free () returned 0x1 [0106.427] memcpy (in: _Dst=0x6c813902b5, _Src=0x1848c65297d, _Size=0x1 | out: _Dst=0x6c813902b5) returned 0x6c813902b5 [0106.427] CRetailMalloc_Alloc () returned 0x18489262090 [0106.427] CRetailMalloc_Alloc () returned 0x1848c6b2520 [0106.427] CLSIDFromString (in: lpsz="{00020819-0000-0000-C000-000000000046}", pclsid=0x1848c6b2520 | out: pclsid=0x1848c6b2520*(Data1=0x20819, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0106.427] CRetailMalloc_Free () returned 0x1 [0106.430] CRetailMalloc_Alloc () returned 0x1848c5d1f10 [0106.431] CRetailMalloc_Alloc () returned 0x1848c5d1bb0 [0106.431] CRetailMalloc_Free () returned 0x1 [0106.432] CRetailMalloc_Free () returned 0x1 [0106.432] CRetailMalloc_Free () returned 0x1 [0106.432] CRetailMalloc_Alloc () returned 0x1848c5d2270 [0106.432] CRetailMalloc_Alloc () returned 0x1848c5d1d60 [0106.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Workbook", cchWideChar=9, lpMultiByteStr=0x6c8138ff20, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workbook", lpUsedDefaultChar=0x0) returned 9 [0106.433] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Workbook") returned 0x10186b [0106.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Workbook", cchWideChar=9, lpMultiByteStr=0x6c8138ff20, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workbook", lpUsedDefaultChar=0x0) returned 9 [0106.447] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="Workbook") returned 0x10186b [0106.447] memcpy (in: _Dst=0x1848c3313c0, _Src=0x1848c331360, _Size=0x0 | out: _Dst=0x1848c3313c0) returned 0x1848c3313c0 [0106.448] memcpy (in: _Dst=0x6c81390310, _Src=0x1848c65297e, _Size=0x2 | out: _Dst=0x6c81390310) returned 0x6c81390310 [0106.448] memcpy (in: _Dst=0x6c813902fc, _Src=0x1848c652980, _Size=0x2 | out: _Dst=0x6c813902fc) returned 0x6c813902fc [0106.448] memcpy (in: _Dst=0x6c81390300, _Src=0x1848c652982, _Size=0x2 | out: _Dst=0x6c81390300) returned 0x6c81390300 [0106.448] memcpy (in: _Dst=0x6c81390324, _Src=0x1848c652984, _Size=0x4 | out: _Dst=0x6c81390324) returned 0x6c81390324 [0106.448] memcpy (in: _Dst=0x6c81390328, _Src=0x1848c652988, _Size=0x4 | out: _Dst=0x6c81390328) returned 0x6c81390328 [0106.466] CRetailMalloc_Alloc () returned 0x1848c03e320 [0106.467] CRetailMalloc_Alloc () returned 0x18488df7770 [0106.467] CRetailMalloc_Alloc () returned 0x1848c03d630 [0106.467] CRetailMalloc_Alloc () returned 0x1848922bde0 [0106.467] CRetailMalloc_Alloc () returned 0x18489224810 [0106.467] CRetailMalloc_Alloc () returned 0x18489228910 [0106.467] memcpy (in: _Dst=0x18488df77be, _Src=0x1848c65298c, _Size=0x2 | out: _Dst=0x18488df77be) returned 0x18488df77be [0106.467] memcpy (in: _Dst=0x18488df7788, _Src=0x1848c65298e, _Size=0x2 | out: _Dst=0x18488df7788) returned 0x18488df7788 [0106.467] memcpy (in: _Dst=0x18488df77c0, _Src=0x1848c652990, _Size=0x2 | out: _Dst=0x18488df77c0) returned 0x18488df77c0 [0106.467] memcpy (in: _Dst=0x18488df778a, _Src=0x1848c652992, _Size=0x2 | out: _Dst=0x18488df778a) returned 0x18488df778a [0106.468] memcpy (in: _Dst=0x18488df778c, _Src=0x1848c652994, _Size=0x2 | out: _Dst=0x18488df778c) returned 0x18488df778c [0106.537] memcpy (in: _Dst=0x18488df778e, _Src=0x1848c652996, _Size=0x2 | out: _Dst=0x18488df778e) returned 0x18488df778e [0106.537] memcpy (in: _Dst=0x18488df7790, _Src=0x1848c652998, _Size=0x2 | out: _Dst=0x18488df7790) returned 0x18488df7790 [0106.537] memcpy (in: _Dst=0x18488df7792, _Src=0x1848c65299a, _Size=0x2 | out: _Dst=0x18488df7792) returned 0x18488df7792 [0106.537] memcpy (in: _Dst=0x18488df7794, _Src=0x1848c65299c, _Size=0x2 | out: _Dst=0x18488df7794) returned 0x18488df7794 [0106.537] memcpy (in: _Dst=0x18488df7796, _Src=0x1848c65299e, _Size=0x2 | out: _Dst=0x18488df7796) returned 0x18488df7796 [0106.537] memcpy (in: _Dst=0x18488df7798, _Src=0x1848c6529a0, _Size=0x2 | out: _Dst=0x18488df7798) returned 0x18488df7798 [0106.537] memcpy (in: _Dst=0x18488df779a, _Src=0x1848c6529a2, _Size=0x2 | out: _Dst=0x18488df779a) returned 0x18488df779a [0106.537] memcpy (in: _Dst=0x18488df779c, _Src=0x1848c6529a4, _Size=0x2 | out: _Dst=0x18488df779c) returned 0x18488df779c [0106.537] memcpy (in: _Dst=0x18488df779e, _Src=0x1848c6529a6, _Size=0x2 | out: _Dst=0x18488df779e) returned 0x18488df779e [0106.537] memcpy (in: _Dst=0x18488df77a0, _Src=0x1848c6529a8, _Size=0x2 | out: _Dst=0x18488df77a0) returned 0x18488df77a0 [0106.537] memcpy (in: _Dst=0x18488df77a2, _Src=0x1848c6529aa, _Size=0x2 | out: _Dst=0x18488df77a2) returned 0x18488df77a2 [0106.537] memcpy (in: _Dst=0x18488df77a4, _Src=0x1848c6529ac, _Size=0x2 | out: _Dst=0x18488df77a4) returned 0x18488df77a4 [0106.537] memcpy (in: _Dst=0x18488df77a6, _Src=0x1848c6529ae, _Size=0x2 | out: _Dst=0x18488df77a6) returned 0x18488df77a6 [0106.538] memcpy (in: _Dst=0x18488df77a8, _Src=0x1848c6529b0, _Size=0x2 | out: _Dst=0x18488df77a8) returned 0x18488df77a8 [0106.538] memcpy (in: _Dst=0x18488df77aa, _Src=0x1848c6529b2, _Size=0x2 | out: _Dst=0x18488df77aa) returned 0x18488df77aa [0106.538] memcpy (in: _Dst=0x18488df77ac, _Src=0x1848c6529b4, _Size=0x2 | out: _Dst=0x18488df77ac) returned 0x18488df77ac [0106.538] memcpy (in: _Dst=0x18488df77ae, _Src=0x1848c6529b6, _Size=0x2 | out: _Dst=0x18488df77ae) returned 0x18488df77ae [0106.538] memcpy (in: _Dst=0x18488df77b0, _Src=0x1848c6529b8, _Size=0x2 | out: _Dst=0x18488df77b0) returned 0x18488df77b0 [0106.538] memcpy (in: _Dst=0x18488df77b2, _Src=0x1848c6529ba, _Size=0x2 | out: _Dst=0x18488df77b2) returned 0x18488df77b2 [0106.538] memcpy (in: _Dst=0x18488df77b4, _Src=0x1848c6529bc, _Size=0x2 | out: _Dst=0x18488df77b4) returned 0x18488df77b4 [0106.538] memcpy (in: _Dst=0x18488df77b6, _Src=0x1848c6529be, _Size=0x2 | out: _Dst=0x18488df77b6) returned 0x18488df77b6 [0106.538] memcpy (in: _Dst=0x18488df77b8, _Src=0x1848c6529c0, _Size=0x2 | out: _Dst=0x18488df77b8) returned 0x18488df77b8 [0106.538] memcpy (in: _Dst=0x18488df77ba, _Src=0x1848c6529c2, _Size=0x2 | out: _Dst=0x18488df77ba) returned 0x18488df77ba [0106.538] memcpy (in: _Dst=0x18488df77bc, _Src=0x1848c6529c4, _Size=0x2 | out: _Dst=0x18488df77bc) returned 0x18488df77bc [0106.538] memcpy (in: _Dst=0x6c81390520, _Src=0x1848c6529c6, _Size=0x2 | out: _Dst=0x6c81390520) returned 0x6c81390520 [0106.538] memcpy (in: _Dst=0x6c813904e0, _Src=0x1848c6529c8, _Size=0x2 | out: _Dst=0x6c813904e0) returned 0x6c813904e0 [0106.538] memcpy (in: _Dst=0x6c813904e4, _Src=0x1848c6529ca, _Size=0x2 | out: _Dst=0x6c813904e4) returned 0x6c813904e4 [0106.538] memcpy (in: _Dst=0x18488df7800, _Src=0x1848c6529cc, _Size=0x2 | out: _Dst=0x18488df7800) returned 0x18488df7800 [0106.538] CRetailMalloc_Alloc () returned 0x1848e68e530 [0106.538] memcpy (in: _Dst=0x1848e68e530, _Src=0x1848c6529ce, _Size=0x23a | out: _Dst=0x1848e68e530) returned 0x1848e68e530 [0106.538] memcpy (in: _Dst=0x18488df77e8, _Src=0x1848c652808, _Size=0x4 | out: _Dst=0x18488df77e8) returned 0x18488df77e8 [0106.538] memcpy (in: _Dst=0x6c813904c0, _Src=0x1848c65280c, _Size=0x1 | out: _Dst=0x6c813904c0) returned 0x6c813904c0 [0106.538] memcpy (in: _Dst=0x6c813904c8, _Src=0x1848c65280d, _Size=0x1 | out: _Dst=0x6c813904c8) returned 0x6c813904c8 [0106.538] memcpy (in: _Dst=0x6c81390498, _Src=0x1848c65280e, _Size=0x4 | out: _Dst=0x6c81390498) returned 0x6c81390498 [0106.538] memcpy (in: _Dst=0x184861ce080, _Src=0x1848c652812, _Size=0x3f6 | out: _Dst=0x184861ce080) returned 0x184861ce080 [0106.539] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="_Evaluate") returned 0x10d918 [0106.540] memcpy (in: _Dst=0x1848c655d68, _Src=0x1848c652808, _Size=0x4 | out: _Dst=0x1848c655d68) returned 0x1848c655d68 [0106.540] memcpy (in: _Dst=0x6c813906c0, _Src=0x1848c65280c, _Size=0x2 | out: _Dst=0x6c813906c0) returned 0x6c813906c0 [0106.541] CRetailMalloc_Alloc () returned 0x184861ceed0 [0106.541] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x18488a30000 [0106.560] memcpy (in: _Dst=0x184891b9260, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b9260) returned 0x184891b9260 [0106.561] memcpy (in: _Dst=0x184891b9278, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b9278) returned 0x184891b9278 [0106.565] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="WinHttp.WinHttpRequest.5.1$", cbMultiByte=26, lpWideCharStr=0x18488a300dc, cchWideChar=54 | out: lpWideCharStr="WinHttp.WinHttpRequest.5.1") returned 26 [0106.565] realloc (_Block=0x0, _Size=0x200) returned 0x18488659260 [0106.567] CRetailMalloc_Alloc () returned 0x18485a0d540 [0106.567] CRetailMalloc_Alloc () returned 0x184894342a0 [0106.567] CRetailMalloc_Alloc () returned 0x18485ee5750 [0106.567] CRetailMalloc_Alloc () returned 0x1848c5d0590 [0106.567] CRetailMalloc_Alloc () returned 0x1848c6afdc0 [0106.567] CRetailMalloc_Alloc () returned 0x1848c03d090 [0106.567] CRetailMalloc_Alloc () returned 0x18489261e20 [0106.567] CRetailMalloc_Alloc () returned 0x18489262040 [0106.568] CRetailMalloc_Alloc () returned 0x1848c53a3e0 [0106.568] CRetailMalloc_Alloc () returned 0x1848c53ab60 [0106.568] CRetailMalloc_Alloc () returned 0x1848c53ae20 [0106.568] CRetailMalloc_Alloc () returned 0x1848c53ac60 [0106.569] CRetailMalloc_Alloc () returned 0x1848c53a420 [0106.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="CreateObject", cbMultiByte=13, lpWideCharStr=0x6c8138ef80, cchWideChar=14 | out: lpWideCharStr="CreateObject") returned 13 [0106.569] CRetailMalloc_Alloc () returned 0x184892d6710 [0106.569] CRetailMalloc_Alloc () returned 0x1848c5d0890 [0106.570] CRetailMalloc_Alloc () returned 0x18489261e70 [0106.570] CRetailMalloc_Alloc () returned 0x18489261eb0 [0106.570] CRetailMalloc_Alloc () returned 0x1848c5d0230 [0106.570] CRetailMalloc_Alloc () returned 0x1848c03e9e0 [0106.571] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="CreateObject", cbMultiByte=13, lpWideCharStr=0x6c8138efc0, cchWideChar=14 | out: lpWideCharStr="CreateObject") returned 13 [0106.580] memcpy (in: _Dst=0x1848c03e9e8, _Src=0x7ffa5ed1a8e0, _Size=0x14 | out: _Dst=0x1848c03e9e8) returned 0x1848c03e9e8 [0106.580] memcpy (in: _Dst=0x1848c03e9e0, _Src=0x7ffa5ed1a930, _Size=0x58 | out: _Dst=0x1848c03e9e0) returned 0x1848c03e9e0 [0106.581] memcpy (in: _Dst=0x1848c03ea38, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x1848c03ea38) returned 0x1848c03ea38 [0106.581] memcpy (in: _Dst=0x1848c03ea38, _Src=0x7ffa5ed1b468, _Size=0x20 | out: _Dst=0x1848c03ea38) returned 0x1848c03ea38 [0106.581] memcpy (in: _Dst=0x18481584e88, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x18481584e88) returned 0x18481584e88 [0106.581] memcpy (in: _Dst=0x18481584e88, _Src=0x7ffa5ed1b468, _Size=0x20 | out: _Dst=0x18481584e88) returned 0x18481584e88 [0106.581] SysStringByteLen (bstr="") returned 0x0 [0106.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x6c8138ecf0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pî8\x81l", lpUsedDefaultChar=0x0) returned 0 [0106.582] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="", cbMultiByte=0, lpWideCharStr=0x18488a302a6, cchWideChar=2 | out: lpWideCharStr="") returned 0 [0106.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7ffa5ed19cd0, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0106.583] memcpy (in: _Dst=0x18488e0c988, _Src=0x18488e0c830, _Size=0x2b0 | out: _Dst=0x18488e0c988) returned 0x18488e0c988 [0106.583] memcpy (in: _Dst=0x184891b92c8, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b92c8) returned 0x184891b92c8 [0106.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="WinHttpReq", cbMultiByte=11, lpWideCharStr=0x6c8138ef80, cchWideChar=12 | out: lpWideCharStr="WinHttpReq") returned 11 [0106.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="WinHttpReq", cbMultiByte=11, lpWideCharStr=0x6c8138efc0, cchWideChar=12 | out: lpWideCharStr="WinHttpReq") returned 11 [0106.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="WinHttpReq", cbMultiByte=11, lpWideCharStr=0x6c8138efc0, cchWideChar=12 | out: lpWideCharStr="WinHttpReq") returned 11 [0106.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="WinHttpReq", cbMultiByte=11, lpWideCharStr=0x6c8138efc0, cchWideChar=12 | out: lpWideCharStr="WinHttpReq") returned 11 [0106.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="WinHttpReq", cbMultiByte=11, lpWideCharStr=0x6c8138efc0, cchWideChar=12 | out: lpWideCharStr="WinHttpReq") returned 11 [0106.585] CRetailMalloc_Alloc () returned 0x1848c6af760 [0106.585] _mbscpy_s (in: _Dst=0x1848c6af760, _DstSizeInBytes=0xb, _Src=0x18488713692 | out: _Dst=0x1848c6af760) returned 0x0 [0106.585] memcpy (in: _Dst=0x1848c6af767, _Src=0x1848c6af760, _Size=0xb | out: _Dst=0x1848c6af767) returned 0x1848c6af767 [0106.586] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="_B_var_WinHttpReq") returned 0x102eb6 [0106.586] strcpy_s (in: _Dst=0x6c8138f0d0, _DstSize=0x12, _Src="_B_var_WinHttpReq" | out: _Dst="_B_var_WinHttpReq") returned 0x0 [0106.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="_B_var_WinHttpReq", cbMultiByte=18, lpWideCharStr=0x6c8138ef20, cchWideChar=18 | out: lpWideCharStr="_B_var_WinHttpReq") returned 18 [0106.587] GetModuleFileNameW (in: hModule=0x7ffa5e950000, lpFilename=0x7ffa5ed1a9f0, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll")) returned 0x42 [0106.587] QueryPathOfRegTypeLib (in: guid=0x7ffa5ecf26a0*(Data1=0x204ef, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), wMaj=0x4, wMin=0x0, lcid=0x409, lpbstrPathName=0x6c8138f1e0 | out: lpbstrPathName=0x6c8138f1e0) returned 0x0 [0106.589] LoadTypeLibEx (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL", regkind=0x2, pptlib=0x6c8138f228 | out: pptlib=0x6c8138f228*=0x18489235330) returned 0x0 [0106.593] IUnknown:AddRef (This=0x18489235330) returned 0x2 [0106.593] CRetailMalloc_Alloc () returned 0x1848c558920 [0106.593] IUnknown:Release (This=0x18489235330) returned 0x2 [0106.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="_B_var_WinHttpReq", cbMultiByte=18, lpWideCharStr=0x6c8138ef80, cchWideChar=19 | out: lpWideCharStr="_B_var_WinHttpReq") returned 18 [0106.594] _mbscpy_s (in: _Dst=0x6c8138f140, _DstSizeInBytes=0xb, _Src=0x18488713692 | out: _Dst=0x6c8138f140) returned 0x0 [0106.594] memcpy (in: _Dst=0x184891b92e0, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b92e0) returned 0x184891b92e0 [0106.594] CRetailMalloc_Free () returned 0x1 [0106.599] realloc (_Block=0x0, _Size=0xc0) returned 0x184886578c0 [0106.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="WinHttp.WinHttpRequest.5$", cbMultiByte=24, lpWideCharStr=0x18488a3092c, cchWideChar=50 | out: lpWideCharStr="WinHttp.WinHttpRequest.5") returned 24 [0106.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="", cbMultiByte=0, lpWideCharStr=0x18488a30af2, cchWideChar=2 | out: lpWideCharStr="") returned 0 [0106.600] ITypeLib:RemoteGetLibAttr (in: This=0x18489236930, ppTLibAttr=0x6c8138ea60, pDummy=0x0 | out: ppTLibAttr=0x6c8138ea60, pDummy=0x0) returned 0x0 [0106.600] ITypeLib:LocalReleaseTLibAttr (This=0x18489236930) returned 0x0 [0106.600] IUnknown:Release (This=0x18489236930) returned 0x6 [0106.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7ffa5ed19cd0, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0106.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)¬", cbMultiByte=50, lpWideCharStr=0x18488a30fc8, cchWideChar=102 | out: lpWideCharStr="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)") returned 50 [0106.601] memcpy (in: _Dst=0x184891b92f8, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b92f8) returned 0x184891b92f8 [0106.601] memcpy (in: _Dst=0x184891b9310, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b9310) returned 0x184891b9310 [0106.601] memcpy (in: _Dst=0x184891b9328, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b9328) returned 0x184891b9328 [0106.602] memcpy (in: _Dst=0x184891b9340, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b9340) returned 0x184891b9340 [0106.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="Option", cbMultiByte=8, lpWideCharStr=0x6c8138ede0, cchWideChar=7 | out: lpWideCharStr="Option") returned 0 [0106.602] wcscpy_s (in: _Destination=0x1848946ba40, _SizeInWords=0x7, _Source="Option" | out: _Destination="Option") returned 0x0 [0106.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="AllowRedirects", cbMultiByte=15, lpWideCharStr=0x6c8138ef80, cchWideChar=16 | out: lpWideCharStr="AllowRedirects") returned 15 [0106.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="AllowRedirects", cbMultiByte=15, lpWideCharStr=0x6c8138efc0, cchWideChar=16 | out: lpWideCharStr="AllowRedirects") returned 15 [0106.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="AllowRedirects", cbMultiByte=15, lpWideCharStr=0x6c8138efc0, cchWideChar=16 | out: lpWideCharStr="AllowRedirects") returned 15 [0106.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="AllowRedirects", cbMultiByte=15, lpWideCharStr=0x6c8138efc0, cchWideChar=16 | out: lpWideCharStr="AllowRedirects") returned 15 [0106.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="AllowRedirects", cbMultiByte=15, lpWideCharStr=0x6c8138efc0, cchWideChar=16 | out: lpWideCharStr="AllowRedirects") returned 15 [0106.602] CRetailMalloc_Alloc () returned 0x1848c6af760 [0106.602] _mbscpy_s (in: _Dst=0x1848c6af760, _DstSizeInBytes=0xf, _Src=0x184887136be | out: _Dst=0x1848c6af760) returned 0x0 [0106.602] memcpy (in: _Dst=0x1848c6af767, _Src=0x1848c6af760, _Size=0xf | out: _Dst=0x1848c6af767) returned 0x1848c6af767 [0106.602] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="_B_var_AllowRedirects") returned 0x108fa6 [0106.602] strcpy_s (in: _Dst=0x6c8138f0d0, _DstSize=0x16, _Src="_B_var_AllowRedirects" | out: _Dst="_B_var_AllowRedirects") returned 0x0 [0106.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="_B_var_AllowRedirects", cbMultiByte=22, lpWideCharStr=0x6c8138ef20, cchWideChar=22 | out: lpWideCharStr="_B_var_AllowRedirects") returned 22 [0106.603] IUnknown:AddRef (This=0x18489236930) returned 0x7 [0106.603] ITypeLib:RemoteIsName (in: This=0x18489236930, szNameBuf="_B_var_AllowRedirects", lHashVal=0x108fa6, pfName=0x6c8138eff0, pBstrLibName=0x6c8138ef20 | out: pfName=0x6c8138eff0*=0, pBstrLibName=0x6c8138ef20) returned 0x0 [0106.603] IUnknown:Release (This=0x18489236930) returned 0x6 [0106.603] IUnknown:AddRef (This=0x18488a7bcf0) returned 0x12 [0106.603] ITypeLib:RemoteIsName (in: This=0x18488a7bcf0, szNameBuf="_B_var_AllowRedirects", lHashVal=0x108fa6, pfName=0x6c8138eff0, pBstrLibName=0x6c8138ef20 | out: pfName=0x6c8138eff0*=0, pBstrLibName=0x6c8138ef20) returned 0x0 [0106.603] IUnknown:Release (This=0x18488a7bcf0) returned 0x11 [0106.603] IUnknown:AddRef (This=0x18488a7d030) returned 0x7 [0106.603] ITypeLib:RemoteIsName (in: This=0x18488a7d030, szNameBuf="_B_var_AllowRedirects", lHashVal=0x108fa6, pfName=0x6c8138eff0, pBstrLibName=0x6c8138ef20 | out: pfName=0x6c8138eff0*=0, pBstrLibName=0x6c8138ef20) returned 0x0 [0106.603] IUnknown:Release (This=0x18488a7d030) returned 0x6 [0106.603] IUnknown:AddRef (This=0x18488a7e0b0) returned 0x4 [0106.603] ITypeLib:RemoteIsName (in: This=0x18488a7e0b0, szNameBuf="_B_var_AllowRedirects", lHashVal=0x108fa6, pfName=0x6c8138eff0, pBstrLibName=0x6c8138ef20 | out: pfName=0x6c8138eff0*=0, pBstrLibName=0x6c8138ef20) returned 0x0 [0106.603] IUnknown:Release (This=0x18488a7e0b0) returned 0x3 [0106.603] IUnknown:AddRef (This=0x18489235330) returned 0x3 [0106.603] IUnknown:Release (This=0x18489235330) returned 0x2 [0106.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="_B_var_AllowRedirects", cbMultiByte=22, lpWideCharStr=0x6c8138ef80, cchWideChar=23 | out: lpWideCharStr="_B_var_AllowRedirects") returned 22 [0106.603] _mbscpy_s (in: _Dst=0x6c8138f140, _DstSizeInBytes=0xf, _Src=0x184887136be | out: _Dst=0x6c8138f140) returned 0x0 [0106.603] memcpy (in: _Dst=0x184891b9358, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b9358) returned 0x184891b9358 [0106.603] CRetailMalloc_Free () returned 0x1 [0106.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="Option", cbMultiByte=8, lpWideCharStr=0x6c8138ede0, cchWideChar=7 | out: lpWideCharStr="Option") returned 0 [0106.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="GET", cbMultiByte=3, lpWideCharStr=0x18488a3192a, cchWideChar=8 | out: lpWideCharStr="GET") returned 3 [0106.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="Open", cbMultiByte=6, lpWideCharStr=0x6c8138ede0, cchWideChar=5 | out: lpWideCharStr="Open") returned 0 [0106.604] wcscpy_s (in: _Destination=0x1848946ba70, _SizeInWords=0x5, _Source="Open" | out: _Destination="Open") returned 0x0 [0106.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="Send", cbMultiByte=6, lpWideCharStr=0x6c8138ede0, cchWideChar=5 | out: lpWideCharStr="Send") returned 0 [0106.604] wcscpy_s (in: _Destination=0x1848946ba88, _SizeInWords=0x5, _Source="Send" | out: _Destination="Send") returned 0x0 [0106.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="Status", cbMultiByte=8, lpWideCharStr=0x6c8138ede0, cchWideChar=7 | out: lpWideCharStr="Status") returned 0 [0106.604] wcscpy_s (in: _Destination=0x1848946b588, _SizeInWords=0x7, _Source="Status" | out: _Destination="Status") returned 0x0 [0106.604] memcpy (in: _Dst=0x184891b9370, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b9370) returned 0x184891b9370 [0106.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="ResponseText", cbMultiByte=14, lpWideCharStr=0x6c8138ede0, cchWideChar=13 | out: lpWideCharStr="ResponseText") returned 0 [0106.604] wcscpy_s (in: _Destination=0x1848946b5a0, _SizeInWords=0xd, _Source="ResponseText" | out: _Destination="ResponseText") returned 0x0 [0106.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="404 Not Found", cbMultiByte=13, lpWideCharStr=0x18488a32846, cchWideChar=28 | out: lpWideCharStr="404 Not Found") returned 13 [0106.605] memcpy (in: _Dst=0x184891b9388, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b9388) returned 0x184891b9388 [0106.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="ResponseText", cbMultiByte=14, lpWideCharStr=0x6c8138ede0, cchWideChar=13 | out: lpWideCharStr="ResponseText") returned 0 [0106.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=">Not Found<", cbMultiByte=11, lpWideCharStr=0x18488a32ef6, cchWideChar=24 | out: lpWideCharStr=">Not Found<") returned 11 [0106.605] memcpy (in: _Dst=0x184891b93a0, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b93a0) returned 0x184891b93a0 [0106.605] memcpy (in: _Dst=0x184891b93b8, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b93b8) returned 0x184891b93b8 [0106.605] memcpy (in: _Dst=0x184891b93d0, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b93d0) returned 0x184891b93d0 [0106.605] memcpy (in: _Dst=0x184891b93e8, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b93e8) returned 0x184891b93e8 [0106.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="ResponseText", cbMultiByte=14, lpWideCharStr=0x6c8138ede0, cchWideChar=13 | out: lpWideCharStr="ResponseText") returned 0 [0106.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="Dropbox - Error", cbMultiByte=15, lpWideCharStr=0x18488a335b2, cchWideChar=32 | out: lpWideCharStr="Dropbox - Error") returned 15 [0106.605] memcpy (in: _Dst=0x184891b9400, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b9400) returned 0x184891b9400 [0106.605] memcpy (in: _Dst=0x184891b9418, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b9418) returned 0x184891b9418 [0106.605] memcpy (in: _Dst=0x184891b9430, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b9430) returned 0x184891b9430 [0106.606] memcpy (in: _Dst=0x184891b9448, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b9448) returned 0x184891b9448 [0106.606] memcpy (in: _Dst=0x184891b9460, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b9460) returned 0x184891b9460 [0106.606] memcpy (in: _Dst=0x184891b9478, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b9478) returned 0x184891b9478 [0106.606] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x18489f90000 [0106.607] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="ADODB.Stream$", cbMultiByte=12, lpWideCharStr=0x18489f9060c, cchWideChar=26 | out: lpWideCharStr="ADODB.Stream") returned 12 [0106.607] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="", cbMultiByte=0, lpWideCharStr=0x18489f907ba, cchWideChar=2 | out: lpWideCharStr="") returned 0 [0106.608] ITypeLib:RemoteGetLibAttr (in: This=0x18489236930, ppTLibAttr=0x6c8138ea60, pDummy=0x0 | out: ppTLibAttr=0x6c8138ea60, pDummy=0x0) returned 0x0 [0106.608] ITypeLib:LocalReleaseTLibAttr (This=0x18489236930) returned 0x0 [0106.608] IUnknown:Release (This=0x18489236930) returned 0x6 [0106.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7ffa5ed19cd0, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0106.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="oStream", cbMultiByte=8, lpWideCharStr=0x6c8138ef80, cchWideChar=9 | out: lpWideCharStr="oStream") returned 8 [0106.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="oStream", cbMultiByte=8, lpWideCharStr=0x6c8138efc0, cchWideChar=9 | out: lpWideCharStr="oStream") returned 8 [0106.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="oStream", cbMultiByte=8, lpWideCharStr=0x6c8138efc0, cchWideChar=9 | out: lpWideCharStr="oStream") returned 8 [0106.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="oStream", cbMultiByte=8, lpWideCharStr=0x6c8138efc0, cchWideChar=9 | out: lpWideCharStr="oStream") returned 8 [0106.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="oStream", cbMultiByte=8, lpWideCharStr=0x6c8138efc0, cchWideChar=9 | out: lpWideCharStr="oStream") returned 8 [0106.609] CRetailMalloc_Alloc () returned 0x1848c6af760 [0106.609] _mbscpy_s (in: _Dst=0x1848c6af760, _DstSizeInBytes=0x8, _Src=0x1848871376e | out: _Dst=0x1848c6af760) returned 0x0 [0106.609] memcpy (in: _Dst=0x1848c6af767, _Src=0x1848c6af760, _Size=0x8 | out: _Dst=0x1848c6af767) returned 0x1848c6af767 [0106.609] LHashValOfNameSysA (syskind=0x3, lcid=0x416, szName="_B_var_oStream") returned 0x1096f8 [0106.609] strcpy_s (in: _Dst=0x6c8138f0d0, _DstSize=0xf, _Src="_B_var_oStream" | out: _Dst="_B_var_oStream") returned 0x0 [0106.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="_B_var_oStream", cbMultiByte=15, lpWideCharStr=0x6c8138ef20, cchWideChar=15 | out: lpWideCharStr="_B_var_oStream") returned 15 [0106.609] IUnknown:AddRef (This=0x18489236930) returned 0x7 [0106.609] ITypeLib:RemoteIsName (in: This=0x18489236930, szNameBuf="_B_var_oStream", lHashVal=0x1096f8, pfName=0x6c8138eff0, pBstrLibName=0x6c8138ef20 | out: pfName=0x6c8138eff0*=0, pBstrLibName=0x6c8138ef20) returned 0x0 [0106.609] IUnknown:Release (This=0x18489236930) returned 0x6 [0106.609] IUnknown:AddRef (This=0x18488a7bcf0) returned 0x12 [0106.609] ITypeLib:RemoteIsName (in: This=0x18488a7bcf0, szNameBuf="_B_var_oStream", lHashVal=0x1096f8, pfName=0x6c8138eff0, pBstrLibName=0x6c8138ef20 | out: pfName=0x6c8138eff0*=0, pBstrLibName=0x6c8138ef20) returned 0x0 [0106.609] IUnknown:Release (This=0x18488a7bcf0) returned 0x11 [0106.609] IUnknown:AddRef (This=0x18488a7d030) returned 0x7 [0106.609] ITypeLib:RemoteIsName (in: This=0x18488a7d030, szNameBuf="_B_var_oStream", lHashVal=0x1096f8, pfName=0x6c8138eff0, pBstrLibName=0x6c8138ef20 | out: pfName=0x6c8138eff0*=0, pBstrLibName=0x6c8138ef20) returned 0x0 [0106.609] IUnknown:Release (This=0x18488a7d030) returned 0x6 [0106.609] IUnknown:AddRef (This=0x18488a7e0b0) returned 0x4 [0106.609] ITypeLib:RemoteIsName (in: This=0x18488a7e0b0, szNameBuf="_B_var_oStream", lHashVal=0x1096f8, pfName=0x6c8138eff0, pBstrLibName=0x6c8138ef20 | out: pfName=0x6c8138eff0*=0, pBstrLibName=0x6c8138ef20) returned 0x0 [0106.609] IUnknown:Release (This=0x18488a7e0b0) returned 0x3 [0106.609] IUnknown:AddRef (This=0x18489235330) returned 0x3 [0106.609] IUnknown:Release (This=0x18489235330) returned 0x2 [0106.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="_B_var_oStream", cbMultiByte=15, lpWideCharStr=0x6c8138ef80, cchWideChar=16 | out: lpWideCharStr="_B_var_oStream") returned 15 [0106.609] _mbscpy_s (in: _Dst=0x6c8138f140, _DstSizeInBytes=0x8, _Src=0x1848871376e | out: _Dst=0x6c8138f140) returned 0x0 [0106.609] memcpy (in: _Dst=0x184891b9490, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b9490) returned 0x184891b9490 [0106.609] CRetailMalloc_Free () returned 0x1 [0106.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="Open", cbMultiByte=6, lpWideCharStr=0x6c8138ede0, cchWideChar=5 | out: lpWideCharStr="Open") returned 0 [0106.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="Type", cbMultiByte=6, lpWideCharStr=0x6c8138ede0, cchWideChar=5 | out: lpWideCharStr="Type") returned 0 [0106.610] wcscpy_s (in: _Destination=0x1848946b1a0, _SizeInWords=0x5, _Source="Type" | out: _Destination="Type") returned 0x0 [0106.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="ResponseBody", cbMultiByte=14, lpWideCharStr=0x6c8138ede0, cchWideChar=13 | out: lpWideCharStr="ResponseBody") returned 0 [0106.610] wcscpy_s (in: _Destination=0x1848946b1b8, _SizeInWords=0xd, _Source="ResponseBody" | out: _Destination="ResponseBody") returned 0x0 [0106.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="Write", cbMultiByte=7, lpWideCharStr=0x6c8138ede0, cchWideChar=6 | out: lpWideCharStr="Write") returned 0 [0106.610] wcscpy_s (in: _Destination=0x1848946b1e0, _SizeInWords=0x6, _Source="Write" | out: _Destination="Write") returned 0x0 [0106.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="SaveToFile", cbMultiByte=12, lpWideCharStr=0x6c8138ede0, cchWideChar=11 | out: lpWideCharStr="SaveToFile") returned 0 [0106.610] wcscpy_s (in: _Destination=0x1848946afd0, _SizeInWords=0xb, _Source="SaveToFile" | out: _Destination="SaveToFile") returned 0x0 [0106.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="Close", cbMultiByte=7, lpWideCharStr=0x6c8138ede0, cchWideChar=6 | out: lpWideCharStr="Close") returned 0 [0106.610] wcscpy_s (in: _Destination=0x1848946ad80, _SizeInWords=0x6, _Source="Close" | out: _Destination="Close") returned 0x0 [0106.611] ITypeLib:RemoteGetLibAttr (in: This=0x18489236930, ppTLibAttr=0x6c8138ee30, pDummy=0x0 | out: ppTLibAttr=0x6c8138ee30, pDummy=0x0) returned 0x0 [0106.611] ITypeLib:LocalReleaseTLibAttr (This=0x18489236930) returned 0x0 [0106.611] IUnknown:Release (This=0x18489236930) returned 0x6 [0106.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7ffa5ed19cd0, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0106.612] ITypeLib:RemoteGetLibAttr (in: This=0x18489236930, ppTLibAttr=0x6c8138ee30, pDummy=0x0 | out: ppTLibAttr=0x6c8138ee30, pDummy=0x0) returned 0x0 [0106.612] ITypeLib:LocalReleaseTLibAttr (This=0x18489236930) returned 0x0 [0106.612] IUnknown:Release (This=0x18489236930) returned 0x6 [0106.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7ffa5ed19cd0, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0106.613] ITypeLib:RemoteGetLibAttr (in: This=0x18489236930, ppTLibAttr=0x6c8138ee30, pDummy=0x0 | out: ppTLibAttr=0x6c8138ee30, pDummy=0x0) returned 0x0 [0106.613] ITypeLib:LocalReleaseTLibAttr (This=0x18489236930) returned 0x0 [0106.613] IUnknown:Release (This=0x18489236930) returned 0x6 [0106.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7ffa5ed19cd0, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0106.614] CRetailMalloc_Free () returned 0x1 [0106.614] GetCurrentProcess () returned 0xffffffffffffffff [0106.614] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8c19, dwSize=0x8) returned 1 [0106.614] GetCurrentProcess () returned 0xffffffffffffffff [0106.614] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8c18, dwSize=0x8) returned 1 [0106.614] GetCurrentProcess () returned 0xffffffffffffffff [0106.614] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8179, dwSize=0x8) returned 1 [0106.614] GetCurrentProcess () returned 0xffffffffffffffff [0106.614] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8178, dwSize=0x8) returned 1 [0106.614] GetCurrentProcess () returned 0xffffffffffffffff [0106.614] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8188, dwSize=0x2) returned 1 [0106.614] GetCurrentProcess () returned 0xffffffffffffffff [0106.615] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c81dc, dwSize=0x45) returned 1 [0106.615] VirtualProtect (in: lpAddress=0x1848c2c81dc, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x6c8138f19c | out: lpflOldProtect=0x6c8138f19c*=0x40) returned 1 [0106.615] GetCurrentProcess () returned 0xffffffffffffffff [0106.615] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c829c, dwSize=0x45) returned 1 [0106.615] VirtualProtect (in: lpAddress=0x1848c2c829c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x6c8138f19c | out: lpflOldProtect=0x6c8138f19c*=0x40) returned 1 [0106.615] GetCurrentProcess () returned 0xffffffffffffffff [0106.615] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8319, dwSize=0x8) returned 1 [0106.615] GetCurrentProcess () returned 0xffffffffffffffff [0106.615] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8318, dwSize=0x8) returned 1 [0106.615] GetCurrentProcess () returned 0xffffffffffffffff [0106.615] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8328, dwSize=0x2) returned 1 [0106.615] GetCurrentProcess () returned 0xffffffffffffffff [0106.615] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c837c, dwSize=0x4d) returned 1 [0106.615] VirtualProtect (in: lpAddress=0x1848c2c837c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x6c8138f19c | out: lpflOldProtect=0x6c8138f19c*=0x40) returned 1 [0106.615] GetCurrentProcess () returned 0xffffffffffffffff [0106.615] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c840c, dwSize=0x4d) returned 1 [0106.615] VirtualProtect (in: lpAddress=0x1848c2c840c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x6c8138f19c | out: lpflOldProtect=0x6c8138f19c*=0x40) returned 1 [0106.615] GetCurrentProcess () returned 0xffffffffffffffff [0106.615] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8491, dwSize=0x8) returned 1 [0106.615] GetCurrentProcess () returned 0xffffffffffffffff [0106.615] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8490, dwSize=0x8) returned 1 [0106.615] GetCurrentProcess () returned 0xffffffffffffffff [0106.615] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c84a0, dwSize=0x2) returned 1 [0106.616] GetCurrentProcess () returned 0xffffffffffffffff [0106.616] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c84f4, dwSize=0x55) returned 1 [0106.616] VirtualProtect (in: lpAddress=0x1848c2c84f4, dwSize=0x58, flNewProtect=0x40, lpflOldProtect=0x6c8138f19c | out: lpflOldProtect=0x6c8138f19c*=0x40) returned 1 [0106.616] GetCurrentProcess () returned 0xffffffffffffffff [0106.616] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c858c, dwSize=0x55) returned 1 [0106.616] VirtualProtect (in: lpAddress=0x1848c2c858c, dwSize=0x58, flNewProtect=0x40, lpflOldProtect=0x6c8138f19c | out: lpflOldProtect=0x6c8138f19c*=0x40) returned 1 [0106.616] GetCurrentProcess () returned 0xffffffffffffffff [0106.616] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8619, dwSize=0x8) returned 1 [0106.616] GetCurrentProcess () returned 0xffffffffffffffff [0106.616] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8618, dwSize=0x8) returned 1 [0106.616] GetCurrentProcess () returned 0xffffffffffffffff [0106.616] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8628, dwSize=0x2) returned 1 [0106.616] GetCurrentProcess () returned 0xffffffffffffffff [0106.616] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c869c, dwSize=0x4d) returned 1 [0106.616] VirtualProtect (in: lpAddress=0x1848c2c869c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x6c8138f19c | out: lpflOldProtect=0x6c8138f19c*=0x40) returned 1 [0106.616] GetCurrentProcess () returned 0xffffffffffffffff [0106.616] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c872c, dwSize=0x4d) returned 1 [0106.616] VirtualProtect (in: lpAddress=0x1848c2c872c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x6c8138f19c | out: lpflOldProtect=0x6c8138f19c*=0x40) returned 1 [0106.616] GetCurrentProcess () returned 0xffffffffffffffff [0106.616] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c87b1, dwSize=0x8) returned 1 [0106.616] GetCurrentProcess () returned 0xffffffffffffffff [0106.616] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c87b0, dwSize=0x8) returned 1 [0106.616] GetCurrentProcess () returned 0xffffffffffffffff [0106.617] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c87c0, dwSize=0x2) returned 1 [0106.617] GetCurrentProcess () returned 0xffffffffffffffff [0106.617] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c889c, dwSize=0x4d) returned 1 [0106.617] VirtualProtect (in: lpAddress=0x1848c2c889c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x6c8138f19c | out: lpflOldProtect=0x6c8138f19c*=0x40) returned 1 [0106.617] GetCurrentProcess () returned 0xffffffffffffffff [0106.617] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c892c, dwSize=0x4d) returned 1 [0106.617] VirtualProtect (in: lpAddress=0x1848c2c892c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x6c8138f19c | out: lpflOldProtect=0x6c8138f19c*=0x40) returned 1 [0106.617] GetCurrentProcess () returned 0xffffffffffffffff [0106.617] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c89b1, dwSize=0x8) returned 1 [0106.617] GetCurrentProcess () returned 0xffffffffffffffff [0106.617] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c89b0, dwSize=0x8) returned 1 [0106.617] GetCurrentProcess () returned 0xffffffffffffffff [0106.617] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c89c0, dwSize=0x2) returned 1 [0106.617] GetCurrentProcess () returned 0xffffffffffffffff [0106.617] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8a9c, dwSize=0x55) returned 1 [0106.617] VirtualProtect (in: lpAddress=0x1848c2c8a9c, dwSize=0x58, flNewProtect=0x40, lpflOldProtect=0x6c8138f19c | out: lpflOldProtect=0x6c8138f19c*=0x40) returned 1 [0106.617] GetCurrentProcess () returned 0xffffffffffffffff [0106.617] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8b34, dwSize=0x55) returned 1 [0106.617] VirtualProtect (in: lpAddress=0x1848c2c8b34, dwSize=0x58, flNewProtect=0x40, lpflOldProtect=0x6c8138f19c | out: lpflOldProtect=0x6c8138f19c*=0x40) returned 1 [0106.617] GetCurrentProcess () returned 0xffffffffffffffff [0106.617] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8bc1, dwSize=0x8) returned 1 [0106.617] GetCurrentProcess () returned 0xffffffffffffffff [0106.617] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8bc0, dwSize=0x8) returned 1 [0106.617] GetCurrentProcess () returned 0xffffffffffffffff [0106.617] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8bd0, dwSize=0x2) returned 1 [0106.618] GetCurrentProcess () returned 0xffffffffffffffff [0106.618] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8c9c, dwSize=0x4d) returned 1 [0106.618] VirtualProtect (in: lpAddress=0x1848c2c8c9c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x6c8138f19c | out: lpflOldProtect=0x6c8138f19c*=0x40) returned 1 [0106.618] GetCurrentProcess () returned 0xffffffffffffffff [0106.618] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8c19, dwSize=0x8) returned 1 [0106.618] GetCurrentProcess () returned 0xffffffffffffffff [0106.618] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8c18, dwSize=0x8) returned 1 [0106.618] GetCurrentProcess () returned 0xffffffffffffffff [0106.618] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8c28, dwSize=0x2) returned 1 [0106.618] GetCurrentProcess () returned 0xffffffffffffffff [0106.618] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c90a0, dwSize=0x5d) returned 1 [0106.618] VirtualProtect (in: lpAddress=0x1848c2c90a0, dwSize=0x60, flNewProtect=0x40, lpflOldProtect=0x6c8138f19c | out: lpflOldProtect=0x6c8138f19c*=0x40) returned 1 [0106.618] GetCurrentProcess () returned 0xffffffffffffffff [0106.618] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8d21, dwSize=0x8) returned 1 [0106.618] GetCurrentProcess () returned 0xffffffffffffffff [0106.618] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8d20, dwSize=0x8) returned 1 [0106.618] GetCurrentProcess () returned 0xffffffffffffffff [0106.618] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8d30, dwSize=0x2) returned 1 [0106.618] GetCurrentProcess () returned 0xffffffffffffffff [0106.618] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8d84, dwSize=0x55) returned 1 [0106.618] VirtualProtect (in: lpAddress=0x1848c2c8d84, dwSize=0x58, flNewProtect=0x40, lpflOldProtect=0x6c8138f19c | out: lpflOldProtect=0x6c8138f19c*=0x40) returned 1 [0106.618] GetCurrentProcess () returned 0xffffffffffffffff [0106.618] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8e11, dwSize=0x8) returned 1 [0106.618] GetCurrentProcess () returned 0xffffffffffffffff [0106.618] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8e10, dwSize=0x8) returned 1 [0106.618] GetCurrentProcess () returned 0xffffffffffffffff [0106.618] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8e20, dwSize=0x2) returned 1 [0106.618] GetCurrentProcess () returned 0xffffffffffffffff [0106.619] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8e9c, dwSize=0x55) returned 1 [0106.619] VirtualProtect (in: lpAddress=0x1848c2c8e9c, dwSize=0x58, flNewProtect=0x40, lpflOldProtect=0x6c8138f19c | out: lpflOldProtect=0x6c8138f19c*=0x40) returned 1 [0106.619] GetCurrentProcess () returned 0xffffffffffffffff [0106.619] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8f29, dwSize=0x8) returned 1 [0106.619] GetCurrentProcess () returned 0xffffffffffffffff [0106.619] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8f28, dwSize=0x8) returned 1 [0106.619] GetCurrentProcess () returned 0xffffffffffffffff [0106.619] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8f38, dwSize=0x2) returned 1 [0106.619] GetCurrentProcess () returned 0xffffffffffffffff [0106.619] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8f90, dwSize=0x5d) returned 1 [0106.619] VirtualProtect (in: lpAddress=0x1848c2c8f90, dwSize=0x60, flNewProtect=0x40, lpflOldProtect=0x6c8138f19c | out: lpflOldProtect=0x6c8138f19c*=0x40) returned 1 [0106.619] GetCurrentProcess () returned 0xffffffffffffffff [0106.619] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c9021, dwSize=0x8) returned 1 [0106.619] GetCurrentProcess () returned 0xffffffffffffffff [0106.619] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c9020, dwSize=0x8) returned 1 [0106.619] GetCurrentProcess () returned 0xffffffffffffffff [0106.619] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c9030, dwSize=0x2) returned 1 [0106.619] GetCurrentProcess () returned 0xffffffffffffffff [0106.619] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8a14, dwSize=0x45) returned 1 [0106.619] VirtualProtect (in: lpAddress=0x1848c2c8a14, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x6c8138f19c | out: lpflOldProtect=0x6c8138f19c*=0x40) returned 1 [0106.619] CRetailMalloc_Alloc () returned 0x1848c6af760 [0106.620] CRetailMalloc_Alloc () returned 0x1848c5d2870 [0106.620] CRetailMalloc_Free () returned 0x1 [0106.620] CRetailMalloc_Alloc () returned 0x1848c5d2780 [0106.621] CRetailMalloc_Free () returned 0x1 [0106.621] CRetailMalloc_Free () returned 0x1 [0106.623] CLSIDFromProgIDEx (in: lpszProgID="WinHttp.WinHttpRequest.5.1", lpclsid=0x6c81390748 | out: lpclsid=0x6c81390748*(Data1=0x2087c2f4, Data2=0x2cef, Data3=0x4953, Data4=([0]=0xa8, [1]=0xab, [2]=0x66, [3]=0x77, [4]=0x9b, [5]=0x67, [6]=0x4, [7]=0x95))) returned 0x0 [0106.629] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0106.629] CoCreateInstance (in: rclsid=0x6c81390748*(Data1=0x2087c2f4, Data2=0x2cef, Data3=0x4953, Data4=([0]=0xa8, [1]=0xab, [2]=0x66, [3]=0x77, [4]=0x9b, [5]=0x67, [6]=0x4, [7]=0x95)), pUnkOuter=0x0, dwClsContext=0x15, riid=0x7ffa5ecdaa48*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x6c813906f8 | out: ppv=0x6c813906f8*=0x1848c249b70) returned 0x0 [0106.648] WinHttpRequest:IUnknown:QueryInterface (in: This=0x1848c249b70, riid=0x7ffa5ecf4590*(Data1=0x7fd52380, Data2=0x4e07, Data3=0x101b, Data4=([0]=0xae, [1]=0x2d, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2e, [6]=0xc7, [7]=0x13)), ppvObject=0x6c81390710 | out: ppvObject=0x6c81390710*=0x0) returned 0x80004002 [0106.648] WinHttpRequest:IUnknown:QueryInterface (in: This=0x1848c249b70, riid=0x7ffa5ecf45a0*(Data1=0x37d84f60, Data2=0x42cb, Data3=0x11ce, Data4=([0]=0x81, [1]=0x35, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xb8, [7]=0x51)), ppvObject=0x6c81390718 | out: ppvObject=0x6c81390718*=0x0) returned 0x80004002 [0106.648] WinHttpRequest:IUnknown:QueryInterface (in: This=0x1848c249b70, riid=0x7ffa5ecdaa68*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x6c813907d8 | out: ppvObject=0x6c813907d8*=0x1848c249b70) returned 0x0 [0106.648] WinHttpRequest:IUnknown:Release (This=0x1848c249b70) returned 0x1 [0106.649] WinHttpRequest:IDispatch:GetIDsOfNames (in: This=0x1848c249b70, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c81390840*="Option", cNames=0x1, lcid=0x409, rgDispId=0x6c81390824 | out: rgDispId=0x6c81390824*=6) returned 0x0 [0106.649] WinHttpRequest:IDispatch:Invoke (in: This=0x1848c249b70, dispIdMember=6, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x6c813907b8*(rgvarg=([0]=0x18488eeae30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)", varVal2=0x0), [1]=0x18488eeae48*(varType=0x2, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)), rgdispidNamedArgs=([0]=0x6c813907ac*=-3), cArgs=0x2, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x6c813907f0, puArgErr=0x6c813907b0 | out: pDispParams=0x6c813907b8*(rgvarg=([0]=0x18488eeae30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)", varVal2=0x0), [1]=0x18488eeae48*(varType=0x2, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)), rgdispidNamedArgs=([0]=0x6c813907ac*=-3), cArgs=0x2, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x6c813907f0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c813907b0*=0x5ed15000) returned 0x0 [0106.649] WinHttpRequest:IDispatch:GetIDsOfNames (in: This=0x1848c249b70, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c81390840*="Option", cNames=0x1, lcid=0x409, rgDispId=0x6c81390824 | out: rgDispId=0x6c81390824*=6) returned 0x0 [0106.649] WinHttpRequest:IDispatch:Invoke (in: This=0x1848c249b70, dispIdMember=6, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x6c813907b8*(rgvarg=([0]=0x18488eeae30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), [1]=0x18488eeae48*(varType=0x2, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6, varVal2=0x0)), rgdispidNamedArgs=([0]=0x6c813907ac*=-3), cArgs=0x2, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x6c813907f0, puArgErr=0x6c813907b0 | out: pDispParams=0x6c813907b8*(rgvarg=([0]=0x18488eeae30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), [1]=0x18488eeae48*(varType=0x2, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6, varVal2=0x0)), rgdispidNamedArgs=([0]=0x6c813907ac*=-3), cArgs=0x2, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x6c813907f0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c813907b0*=0x5ed15000) returned 0x0 [0106.650] WinHttpRequest:IDispatch:GetIDsOfNames (in: This=0x1848c249b70, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c813908e0*="Open", cNames=0x1, lcid=0x18400000409, rgDispId=0x6c813908c4 | out: rgDispId=0x6c813908c4*=1) returned 0x0 [0106.650] WinHttpRequest:IDispatch:Invoke (in: This=0x1848c249b70, dispIdMember=1, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x6c81390878*(rgvarg=([0]=0x18488eeae18*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18489460000, varVal2=0x0), [1]=0x18488eeae30*(varType=0x400c, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18488eeb120*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", varVal2=0x1848949f6b8), varVal2=0x1848949f6b8), [2]=0x18488eeae48*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="GET", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x6c81390890, puArgErr=0x6c81390870 | out: pDispParams=0x6c81390878*(rgvarg=([0]=0x18488eeae18*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18489460000, varVal2=0x0), [1]=0x18488eeae30*(varType=0x400c, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18488eeb120*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", varVal2=0x1848949f6b8), varVal2=0x1848949f6b8), [2]=0x18488eeae48*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="GET", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x6c81390890*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c81390870*=0x70f602a0) returned 0x0 [0106.670] WinHttpRequest:IDispatch:GetIDsOfNames (in: This=0x1848c249b70, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c813908e0*="Send", cNames=0x1, lcid=0x409, rgDispId=0x6c813908c4 | out: rgDispId=0x6c813908c4*=5) returned 0x0 [0106.671] WinHttpRequest:IDispatch:Invoke (in: This=0x1848c249b70, dispIdMember=5, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x6c81390878*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x6c81390890, puArgErr=0x6c81390870 | out: pDispParams=0x6c81390878*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x6c81390890*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c81390870*=0x70f602d8) returned 0x0 [0107.596] WinHttpRequest:IDispatch:GetIDsOfNames (in: This=0x1848c249b70, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c81390840*="Status", cNames=0x1, lcid=0x18400000409, rgDispId=0x6c81390824 | out: rgDispId=0x6c81390824*=7) returned 0x0 [0107.596] WinHttpRequest:IDispatch:Invoke (in: This=0x1848c249b70, dispIdMember=7, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x6c813907d8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x18488eeb028, pExcepInfo=0x6c813907f0, puArgErr=0x6c813907d0 | out: pDispParams=0x6c813907d8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x18488eeb028*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x194, varVal2=0x0), pExcepInfo=0x6c813907f0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c813907d0*=0x70f602e8) returned 0x0 [0107.596] VarCmp (pvarLeft=0x18488eeb028, pvarRight=0x18488eeaff8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0107.597] WinHttpRequest:IUnknown:Release (This=0x1848c249b70) returned 0x0 [0107.597] CLSIDFromProgIDEx (in: lpszProgID="WinHttp.WinHttpRequest.5.1", lpclsid=0x6c81390748 | out: lpclsid=0x6c81390748*(Data1=0x2087c2f4, Data2=0x2cef, Data3=0x4953, Data4=([0]=0xa8, [1]=0xab, [2]=0x66, [3]=0x77, [4]=0x9b, [5]=0x67, [6]=0x4, [7]=0x95))) returned 0x0 [0107.597] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0107.597] CoCreateInstance (in: rclsid=0x6c81390748*(Data1=0x2087c2f4, Data2=0x2cef, Data3=0x4953, Data4=([0]=0xa8, [1]=0xab, [2]=0x66, [3]=0x77, [4]=0x9b, [5]=0x67, [6]=0x4, [7]=0x95)), pUnkOuter=0x0, dwClsContext=0x15, riid=0x7ffa5ecdaa48*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x6c813906f8 | out: ppv=0x6c813906f8*=0x1848c248c70) returned 0x0 [0107.597] WinHttpRequest:IUnknown:QueryInterface (in: This=0x1848c248c70, riid=0x7ffa5ecf4590*(Data1=0x7fd52380, Data2=0x4e07, Data3=0x101b, Data4=([0]=0xae, [1]=0x2d, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2e, [6]=0xc7, [7]=0x13)), ppvObject=0x6c81390710 | out: ppvObject=0x6c81390710*=0x0) returned 0x80004002 [0107.598] WinHttpRequest:IUnknown:QueryInterface (in: This=0x1848c248c70, riid=0x7ffa5ecf45a0*(Data1=0x37d84f60, Data2=0x42cb, Data3=0x11ce, Data4=([0]=0x81, [1]=0x35, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xb8, [7]=0x51)), ppvObject=0x6c81390718 | out: ppvObject=0x6c81390718*=0x0) returned 0x80004002 [0107.598] WinHttpRequest:IUnknown:QueryInterface (in: This=0x1848c248c70, riid=0x7ffa5ecdaa68*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x6c813907d8 | out: ppvObject=0x6c813907d8*=0x1848c248c70) returned 0x0 [0107.598] WinHttpRequest:IUnknown:Release (This=0x1848c248c70) returned 0x1 [0107.598] WinHttpRequest:IDispatch:GetIDsOfNames (in: This=0x1848c248c70, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c81390840*="Option", cNames=0x1, lcid=0x18400000409, rgDispId=0x6c81390824 | out: rgDispId=0x6c81390824*=6) returned 0x0 [0107.598] WinHttpRequest:IDispatch:Invoke (in: This=0x1848c248c70, dispIdMember=6, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x6c813907b8*(rgvarg=([0]=0x18488eeae30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)", varVal2=0x0), [1]=0x18488eeae48*(varType=0x2, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)), rgdispidNamedArgs=([0]=0x6c813907ac*=-3), cArgs=0x2, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x6c813907f0, puArgErr=0x6c813907b0 | out: pDispParams=0x6c813907b8*(rgvarg=([0]=0x18488eeae30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)", varVal2=0x0), [1]=0x18488eeae48*(varType=0x2, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)), rgdispidNamedArgs=([0]=0x6c813907ac*=-3), cArgs=0x2, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x6c813907f0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c813907b0*=0x5ed15000) returned 0x0 [0107.598] WinHttpRequest:IDispatch:GetIDsOfNames (in: This=0x1848c248c70, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c81390840*="Option", cNames=0x1, lcid=0x409, rgDispId=0x6c81390824 | out: rgDispId=0x6c81390824*=6) returned 0x0 [0107.598] WinHttpRequest:IDispatch:Invoke (in: This=0x1848c248c70, dispIdMember=6, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x6c813907b8*(rgvarg=([0]=0x18488eeae30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), [1]=0x18488eeae48*(varType=0x2, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6, varVal2=0x0)), rgdispidNamedArgs=([0]=0x6c813907ac*=-3), cArgs=0x2, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x6c813907f0, puArgErr=0x6c813907b0 | out: pDispParams=0x6c813907b8*(rgvarg=([0]=0x18488eeae30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), [1]=0x18488eeae48*(varType=0x2, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6, varVal2=0x0)), rgdispidNamedArgs=([0]=0x6c813907ac*=-3), cArgs=0x2, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x6c813907f0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c813907b0*=0x5ed15000) returned 0x0 [0107.598] WinHttpRequest:IDispatch:GetIDsOfNames (in: This=0x1848c248c70, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c813908e0*="Open", cNames=0x1, lcid=0x18400000409, rgDispId=0x6c813908c4 | out: rgDispId=0x6c813908c4*=1) returned 0x0 [0107.598] WinHttpRequest:IDispatch:Invoke (in: This=0x1848c248c70, dispIdMember=1, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x6c81390878*(rgvarg=([0]=0x18488eeae18*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18489460000, varVal2=0x0), [1]=0x18488eeae30*(varType=0x400c, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18488eeb120*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", varVal2=0x1848949f6b8), varVal2=0x1848949f6b8), [2]=0x18488eeae48*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="GET", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x6c81390890, puArgErr=0x6c81390870 | out: pDispParams=0x6c81390878*(rgvarg=([0]=0x18488eeae18*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18489460000, varVal2=0x0), [1]=0x18488eeae30*(varType=0x400c, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18488eeb120*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", varVal2=0x1848949f6b8), varVal2=0x1848949f6b8), [2]=0x18488eeae48*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="GET", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x6c81390890*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c81390870*=0x70f602a0) returned 0x0 [0107.599] WinHttpRequest:IDispatch:GetIDsOfNames (in: This=0x1848c248c70, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c813908e0*="Send", cNames=0x1, lcid=0x409, rgDispId=0x6c813908c4 | out: rgDispId=0x6c813908c4*=5) returned 0x0 [0107.599] WinHttpRequest:IDispatch:Invoke (in: This=0x1848c248c70, dispIdMember=5, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x6c81390878*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x6c81390890, puArgErr=0x6c81390870 | out: pDispParams=0x6c81390878*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x6c81390890*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c81390870*=0x70f602d8) returned 0x0 [0108.260] WinHttpRequest:IDispatch:GetIDsOfNames (in: This=0x1848c248c70, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c81390840*="Status", cNames=0x1, lcid=0x18400000409, rgDispId=0x6c81390824 | out: rgDispId=0x6c81390824*=7) returned 0x0 [0108.260] WinHttpRequest:IDispatch:Invoke (in: This=0x1848c248c70, dispIdMember=7, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x6c813907d8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x18488eeb028, pExcepInfo=0x6c813907f0, puArgErr=0x6c813907d0 | out: pDispParams=0x6c813907d8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x18488eeb028*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x199, varVal2=0x0), pExcepInfo=0x6c813907f0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c813907d0*=0x70f602e8) returned 0x0 [0108.260] VarCmp (pvarLeft=0x18488eeb028, pvarRight=0x18488eeaff8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0108.260] WinHttpRequest:IUnknown:Release (This=0x1848c248c70) returned 0x0 [0108.260] CLSIDFromProgIDEx (in: lpszProgID="WinHttp.WinHttpRequest.5.1", lpclsid=0x6c81390748 | out: lpclsid=0x6c81390748*(Data1=0x2087c2f4, Data2=0x2cef, Data3=0x4953, Data4=([0]=0xa8, [1]=0xab, [2]=0x66, [3]=0x77, [4]=0x9b, [5]=0x67, [6]=0x4, [7]=0x95))) returned 0x0 [0108.260] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0108.260] CoCreateInstance (in: rclsid=0x6c81390748*(Data1=0x2087c2f4, Data2=0x2cef, Data3=0x4953, Data4=([0]=0xa8, [1]=0xab, [2]=0x66, [3]=0x77, [4]=0x9b, [5]=0x67, [6]=0x4, [7]=0x95)), pUnkOuter=0x0, dwClsContext=0x15, riid=0x7ffa5ecdaa48*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x6c813906f8 | out: ppv=0x6c813906f8*=0x1848c245f70) returned 0x0 [0108.260] WinHttpRequest:IUnknown:QueryInterface (in: This=0x1848c245f70, riid=0x7ffa5ecf4590*(Data1=0x7fd52380, Data2=0x4e07, Data3=0x101b, Data4=([0]=0xae, [1]=0x2d, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2e, [6]=0xc7, [7]=0x13)), ppvObject=0x6c81390710 | out: ppvObject=0x6c81390710*=0x0) returned 0x80004002 [0108.260] WinHttpRequest:IUnknown:QueryInterface (in: This=0x1848c245f70, riid=0x7ffa5ecf45a0*(Data1=0x37d84f60, Data2=0x42cb, Data3=0x11ce, Data4=([0]=0x81, [1]=0x35, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xb8, [7]=0x51)), ppvObject=0x6c81390718 | out: ppvObject=0x6c81390718*=0x0) returned 0x80004002 [0108.260] WinHttpRequest:IUnknown:QueryInterface (in: This=0x1848c245f70, riid=0x7ffa5ecdaa68*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x6c813907d8 | out: ppvObject=0x6c813907d8*=0x1848c245f70) returned 0x0 [0108.261] WinHttpRequest:IUnknown:Release (This=0x1848c245f70) returned 0x1 [0108.261] WinHttpRequest:IDispatch:GetIDsOfNames (in: This=0x1848c245f70, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c81390840*="Option", cNames=0x1, lcid=0x18400000409, rgDispId=0x6c81390824 | out: rgDispId=0x6c81390824*=6) returned 0x0 [0108.261] WinHttpRequest:IDispatch:Invoke (in: This=0x1848c245f70, dispIdMember=6, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x6c813907b8*(rgvarg=([0]=0x18488eeae30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)", varVal2=0x0), [1]=0x18488eeae48*(varType=0x2, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)), rgdispidNamedArgs=([0]=0x6c813907ac*=-3), cArgs=0x2, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x6c813907f0, puArgErr=0x6c813907b0 | out: pDispParams=0x6c813907b8*(rgvarg=([0]=0x18488eeae30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)", varVal2=0x0), [1]=0x18488eeae48*(varType=0x2, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)), rgdispidNamedArgs=([0]=0x6c813907ac*=-3), cArgs=0x2, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x6c813907f0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c813907b0*=0x5ed15000) returned 0x0 [0108.261] WinHttpRequest:IDispatch:GetIDsOfNames (in: This=0x1848c245f70, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c81390840*="Option", cNames=0x1, lcid=0x409, rgDispId=0x6c81390824 | out: rgDispId=0x6c81390824*=6) returned 0x0 [0108.261] WinHttpRequest:IDispatch:Invoke (in: This=0x1848c245f70, dispIdMember=6, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x6c813907b8*(rgvarg=([0]=0x18488eeae30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), [1]=0x18488eeae48*(varType=0x2, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6, varVal2=0x0)), rgdispidNamedArgs=([0]=0x6c813907ac*=-3), cArgs=0x2, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x6c813907f0, puArgErr=0x6c813907b0 | out: pDispParams=0x6c813907b8*(rgvarg=([0]=0x18488eeae30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), [1]=0x18488eeae48*(varType=0x2, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6, varVal2=0x0)), rgdispidNamedArgs=([0]=0x6c813907ac*=-3), cArgs=0x2, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x6c813907f0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c813907b0*=0x5ed15000) returned 0x0 [0108.261] WinHttpRequest:IDispatch:GetIDsOfNames (in: This=0x1848c245f70, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c813908e0*="Open", cNames=0x1, lcid=0x18400000409, rgDispId=0x6c813908c4 | out: rgDispId=0x6c813908c4*=1) returned 0x0 [0108.261] WinHttpRequest:IDispatch:Invoke (in: This=0x1848c245f70, dispIdMember=1, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x6c81390878*(rgvarg=([0]=0x18488eeae18*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18489460000, varVal2=0x0), [1]=0x18488eeae30*(varType=0x400c, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18488eeb120*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", varVal2=0x1848949f6b8), varVal2=0x1848949f6b8), [2]=0x18488eeae48*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="GET", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x6c81390890, puArgErr=0x6c81390870 | out: pDispParams=0x6c81390878*(rgvarg=([0]=0x18488eeae18*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18489460000, varVal2=0x0), [1]=0x18488eeae30*(varType=0x400c, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18488eeb120*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", varVal2=0x1848949f6b8), varVal2=0x1848949f6b8), [2]=0x18488eeae48*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="GET", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x6c81390890*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c81390870*=0x70f602a0) returned 0x0 [0108.261] WinHttpRequest:IDispatch:GetIDsOfNames (in: This=0x1848c245f70, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c813908e0*="Send", cNames=0x1, lcid=0x409, rgDispId=0x6c813908c4 | out: rgDispId=0x6c813908c4*=5) returned 0x0 [0108.261] WinHttpRequest:IDispatch:Invoke (in: This=0x1848c245f70, dispIdMember=5, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x6c81390878*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x6c81390890, puArgErr=0x6c81390870 | out: pDispParams=0x6c81390878*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x6c81390890*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c81390870*=0x70f602d8) returned 0x0 [0108.451] WinHttpRequest:IDispatch:GetIDsOfNames (in: This=0x1848c245f70, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c81390840*="Status", cNames=0x1, lcid=0x18400000409, rgDispId=0x6c81390824 | out: rgDispId=0x6c81390824*=7) returned 0x0 [0108.451] WinHttpRequest:IDispatch:Invoke (in: This=0x1848c245f70, dispIdMember=7, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x6c813907d8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x18488eeb028, pExcepInfo=0x6c813907f0, puArgErr=0x6c813907d0 | out: pDispParams=0x6c813907d8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x18488eeb028*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x199, varVal2=0x0), pExcepInfo=0x6c813907f0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c813907d0*=0x70f602e8) returned 0x0 [0108.451] VarCmp (pvarLeft=0x18488eeb028, pvarRight=0x18488eeaff8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0108.451] WinHttpRequest:IUnknown:Release (This=0x1848c245f70) returned 0x0 [0108.452] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x18487149ba0, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x6c81390a40*="FileExists", cNames=0x1, lcid=0x7ffa00000409, rgDispId=0x6c81390a24 | out: rgDispId=0x6c81390a24*=10016) returned 0x0 [0108.452] FileSystemObject:IDispatch:Invoke (in: This=0x18487149ba0, dispIdMember=10016, riid=0x7ffa5ecdaa58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x6c813909d8*(rgvarg=([0]=0x18488eeb050*(varType=0x400c, wReserved1=0x88ee, wReserved2=0x184, wReserved3=0x0, varVal1=0x18488eeb160*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\~$cache1.exe", varVal2=0x0), varVal2=0x18488eeb160)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x18488eeb120, pExcepInfo=0x6c813909f0, puArgErr=0x6c813909d0 | out: pDispParams=0x6c813909d8*(rgvarg=([0]=0x18488eeb050*(varType=0x400c, wReserved1=0x88ee, wReserved2=0x184, wReserved3=0x0, varVal1=0x18488eeb160*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\~$cache1.exe", varVal2=0x0), varVal2=0x18488eeb160)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x18488eeb120*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x1848949f6b8), pExcepInfo=0x6c813909f0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x6c813909d0*=0x81390a24) returned 0x0 [0108.453] SafeArrayDestroyData (psa=0x18488eeb180) returned 0x0 [0108.453] SafeArrayDestroyData (psa=0x18488eeb140) returned 0x0 [0108.453] FileSystemObject:IUnknown:Release (This=0x18487149ba0) returned 0x0 [0108.621] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0108.621] CRetailMalloc_Alloc () returned 0x1848c036760 [0108.623] DispCallFunc (pvInstance=0x1848c033e28, oVft=0x58, cc=0x4, vtReturn=0xa, cActuals=0x1, prgvt=0x1848c0367e0, prgpvarg=0x1848c0367d0, pvargResult=0x6c8138d230) returned 0x0 [0110.713] DispCallFunc (pvInstance=0x1848c033e28, oVft=0x48, cc=0x4, vtReturn=0xa, cActuals=0x2, prgvt=0x18488cf0660, prgpvarg=0x18488cf0640, pvargResult=0x6c8139df70) returned 0x0 [0110.713] PeekMessageA (in: lpMsg=0x6c8139d9a0, hWnd=0x40426, wMsgFilterMin=0x1045, wMsgFilterMax=0x1045, wRemoveMsg=0x3 | out: lpMsg=0x6c8139d9a0) returned 0 [0110.713] GetActiveWindow () returned 0x0 [0110.714] CRetailMalloc_Alloc () returned 0x18485c3bc50 [0110.715] memcpy (in: _Dst=0x184891b9548, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b9548) returned 0x184891b9548 [0110.716] memcpy (in: _Dst=0x184891b9570, _Src=0x7ffa5ed1a8f8, _Size=0x18 | out: _Dst=0x184891b9570) returned 0x184891b9570 [0110.717] CRetailMalloc_Free () returned 0x1 [0110.717] GetCurrentProcess () returned 0xffffffffffffffff [0110.717] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8491, dwSize=0x8) returned 1 [0110.717] GetCurrentProcess () returned 0xffffffffffffffff [0110.717] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8490, dwSize=0x8) returned 1 [0110.717] GetCurrentProcess () returned 0xffffffffffffffff [0110.717] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8179, dwSize=0x8) returned 1 [0110.717] GetCurrentProcess () returned 0xffffffffffffffff [0110.717] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8178, dwSize=0x8) returned 1 [0110.717] GetCurrentProcess () returned 0xffffffffffffffff [0110.717] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8188, dwSize=0x2) returned 1 [0110.717] GetCurrentProcess () returned 0xffffffffffffffff [0110.717] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c81dc, dwSize=0x45) returned 1 [0110.717] VirtualProtect (in: lpAddress=0x1848c2c81dc, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x6c8139c35c | out: lpflOldProtect=0x6c8139c35c*=0x40) returned 1 [0110.720] GetCurrentProcess () returned 0xffffffffffffffff [0110.720] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c829c, dwSize=0x45) returned 1 [0110.720] VirtualProtect (in: lpAddress=0x1848c2c829c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x6c8139c35c | out: lpflOldProtect=0x6c8139c35c*=0x40) returned 1 [0110.721] GetCurrentProcess () returned 0xffffffffffffffff [0110.721] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8319, dwSize=0x8) returned 1 [0110.721] GetCurrentProcess () returned 0xffffffffffffffff [0110.721] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8318, dwSize=0x8) returned 1 [0110.721] GetCurrentProcess () returned 0xffffffffffffffff [0110.721] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8328, dwSize=0x2) returned 1 [0110.721] GetCurrentProcess () returned 0xffffffffffffffff [0110.721] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c837c, dwSize=0x4d) returned 1 [0110.721] VirtualProtect (in: lpAddress=0x1848c2c837c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x6c8139c35c | out: lpflOldProtect=0x6c8139c35c*=0x40) returned 1 [0110.722] GetCurrentProcess () returned 0xffffffffffffffff [0110.722] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c840c, dwSize=0x4d) returned 1 [0110.722] VirtualProtect (in: lpAddress=0x1848c2c840c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x6c8139c35c | out: lpflOldProtect=0x6c8139c35c*=0x40) returned 1 [0110.723] GetCurrentProcess () returned 0xffffffffffffffff [0110.723] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8491, dwSize=0x8) returned 1 [0110.723] GetCurrentProcess () returned 0xffffffffffffffff [0110.723] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8490, dwSize=0x8) returned 1 [0110.723] GetCurrentProcess () returned 0xffffffffffffffff [0110.723] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c84a0, dwSize=0x2) returned 1 [0110.723] GetCurrentProcess () returned 0xffffffffffffffff [0110.723] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c84f4, dwSize=0x55) returned 1 [0110.723] VirtualProtect (in: lpAddress=0x1848c2c84f4, dwSize=0x58, flNewProtect=0x40, lpflOldProtect=0x6c8139c35c | out: lpflOldProtect=0x6c8139c35c*=0x40) returned 1 [0110.724] GetCurrentProcess () returned 0xffffffffffffffff [0110.724] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c858c, dwSize=0x55) returned 1 [0110.724] VirtualProtect (in: lpAddress=0x1848c2c858c, dwSize=0x58, flNewProtect=0x40, lpflOldProtect=0x6c8139c35c | out: lpflOldProtect=0x6c8139c35c*=0x40) returned 1 [0110.725] GetCurrentProcess () returned 0xffffffffffffffff [0110.725] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8619, dwSize=0x8) returned 1 [0110.725] GetCurrentProcess () returned 0xffffffffffffffff [0110.725] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8618, dwSize=0x8) returned 1 [0110.725] GetCurrentProcess () returned 0xffffffffffffffff [0110.725] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8628, dwSize=0x2) returned 1 [0110.725] GetCurrentProcess () returned 0xffffffffffffffff [0110.725] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c869c, dwSize=0x4d) returned 1 [0110.725] VirtualProtect (in: lpAddress=0x1848c2c869c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x6c8139c35c | out: lpflOldProtect=0x6c8139c35c*=0x40) returned 1 [0110.726] GetCurrentProcess () returned 0xffffffffffffffff [0110.726] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c872c, dwSize=0x4d) returned 1 [0110.726] VirtualProtect (in: lpAddress=0x1848c2c872c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x6c8139c35c | out: lpflOldProtect=0x6c8139c35c*=0x40) returned 1 [0110.727] GetCurrentProcess () returned 0xffffffffffffffff [0110.727] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c87b1, dwSize=0x8) returned 1 [0110.727] GetCurrentProcess () returned 0xffffffffffffffff [0110.727] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c87b0, dwSize=0x8) returned 1 [0110.727] GetCurrentProcess () returned 0xffffffffffffffff [0110.727] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c87c0, dwSize=0x2) returned 1 [0110.727] GetCurrentProcess () returned 0xffffffffffffffff [0110.727] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c889c, dwSize=0x4d) returned 1 [0110.727] VirtualProtect (in: lpAddress=0x1848c2c889c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x6c8139c35c | out: lpflOldProtect=0x6c8139c35c*=0x40) returned 1 [0110.728] GetCurrentProcess () returned 0xffffffffffffffff [0110.728] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c892c, dwSize=0x4d) returned 1 [0110.728] VirtualProtect (in: lpAddress=0x1848c2c892c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x6c8139c35c | out: lpflOldProtect=0x6c8139c35c*=0x40) returned 1 [0110.729] GetCurrentProcess () returned 0xffffffffffffffff [0110.729] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c89b1, dwSize=0x8) returned 1 [0110.729] GetCurrentProcess () returned 0xffffffffffffffff [0110.729] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c89b0, dwSize=0x8) returned 1 [0110.729] GetCurrentProcess () returned 0xffffffffffffffff [0110.729] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c89c0, dwSize=0x2) returned 1 [0110.729] GetCurrentProcess () returned 0xffffffffffffffff [0110.729] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8a9c, dwSize=0x55) returned 1 [0110.729] VirtualProtect (in: lpAddress=0x1848c2c8a9c, dwSize=0x58, flNewProtect=0x40, lpflOldProtect=0x6c8139c35c | out: lpflOldProtect=0x6c8139c35c*=0x40) returned 1 [0110.730] GetCurrentProcess () returned 0xffffffffffffffff [0110.730] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8b34, dwSize=0x55) returned 1 [0110.730] VirtualProtect (in: lpAddress=0x1848c2c8b34, dwSize=0x58, flNewProtect=0x40, lpflOldProtect=0x6c8139c35c | out: lpflOldProtect=0x6c8139c35c*=0x40) returned 1 [0110.731] GetCurrentProcess () returned 0xffffffffffffffff [0110.731] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8bc1, dwSize=0x8) returned 1 [0110.731] GetCurrentProcess () returned 0xffffffffffffffff [0110.731] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8bc0, dwSize=0x8) returned 1 [0110.731] GetCurrentProcess () returned 0xffffffffffffffff [0110.731] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8bd0, dwSize=0x2) returned 1 [0110.731] GetCurrentProcess () returned 0xffffffffffffffff [0110.731] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8c9c, dwSize=0x4d) returned 1 [0110.731] VirtualProtect (in: lpAddress=0x1848c2c8c9c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x6c8139c35c | out: lpflOldProtect=0x6c8139c35c*=0x40) returned 1 [0110.732] GetCurrentProcess () returned 0xffffffffffffffff [0110.732] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8c19, dwSize=0x8) returned 1 [0110.732] GetCurrentProcess () returned 0xffffffffffffffff [0110.732] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8c18, dwSize=0x8) returned 1 [0110.732] GetCurrentProcess () returned 0xffffffffffffffff [0110.732] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8c28, dwSize=0x2) returned 1 [0110.732] GetCurrentProcess () returned 0xffffffffffffffff [0110.732] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c90a0, dwSize=0x5d) returned 1 [0110.732] VirtualProtect (in: lpAddress=0x1848c2c90a0, dwSize=0x60, flNewProtect=0x40, lpflOldProtect=0x6c8139c35c | out: lpflOldProtect=0x6c8139c35c*=0x40) returned 1 [0110.733] GetCurrentProcess () returned 0xffffffffffffffff [0110.733] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8d21, dwSize=0x8) returned 1 [0110.733] GetCurrentProcess () returned 0xffffffffffffffff [0110.733] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8d20, dwSize=0x8) returned 1 [0110.733] GetCurrentProcess () returned 0xffffffffffffffff [0110.733] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8d30, dwSize=0x2) returned 1 [0110.733] GetCurrentProcess () returned 0xffffffffffffffff [0110.733] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8d84, dwSize=0x55) returned 1 [0110.733] VirtualProtect (in: lpAddress=0x1848c2c8d84, dwSize=0x58, flNewProtect=0x40, lpflOldProtect=0x6c8139c35c | out: lpflOldProtect=0x6c8139c35c*=0x40) returned 1 [0110.734] GetCurrentProcess () returned 0xffffffffffffffff [0110.734] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8e11, dwSize=0x8) returned 1 [0110.734] GetCurrentProcess () returned 0xffffffffffffffff [0110.734] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8e10, dwSize=0x8) returned 1 [0110.734] GetCurrentProcess () returned 0xffffffffffffffff [0110.734] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8e20, dwSize=0x2) returned 1 [0110.734] GetCurrentProcess () returned 0xffffffffffffffff [0110.734] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8e9c, dwSize=0x55) returned 1 [0110.734] VirtualProtect (in: lpAddress=0x1848c2c8e9c, dwSize=0x58, flNewProtect=0x40, lpflOldProtect=0x6c8139c35c | out: lpflOldProtect=0x6c8139c35c*=0x40) returned 1 [0110.735] GetCurrentProcess () returned 0xffffffffffffffff [0110.735] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8f29, dwSize=0x8) returned 1 [0110.735] GetCurrentProcess () returned 0xffffffffffffffff [0110.735] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8f28, dwSize=0x8) returned 1 [0110.735] GetCurrentProcess () returned 0xffffffffffffffff [0110.735] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8f38, dwSize=0x2) returned 1 [0110.735] GetCurrentProcess () returned 0xffffffffffffffff [0110.735] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8f90, dwSize=0x5d) returned 1 [0110.735] VirtualProtect (in: lpAddress=0x1848c2c8f90, dwSize=0x60, flNewProtect=0x40, lpflOldProtect=0x6c8139c35c | out: lpflOldProtect=0x6c8139c35c*=0x40) returned 1 [0110.736] GetCurrentProcess () returned 0xffffffffffffffff [0110.736] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c9021, dwSize=0x8) returned 1 [0110.736] GetCurrentProcess () returned 0xffffffffffffffff [0110.736] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c9020, dwSize=0x8) returned 1 [0110.736] GetCurrentProcess () returned 0xffffffffffffffff [0110.736] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c9030, dwSize=0x2) returned 1 [0110.736] GetCurrentProcess () returned 0xffffffffffffffff [0110.736] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x1848c2c8a14, dwSize=0x45) returned 1 [0110.736] VirtualProtect (in: lpAddress=0x1848c2c8a14, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x6c8139c35c | out: lpflOldProtect=0x6c8139c35c*=0x40) returned 1 [0110.744] DispCallFunc (pvInstance=0x1848c033e28, oVft=0x48, cc=0x4, vtReturn=0xa, cActuals=0x2, prgvt=0x18488cf0660, prgpvarg=0x18488cf0640, pvargResult=0x6c8139df70) returned 0x0 [0110.744] PeekMessageA (in: lpMsg=0x6c8139d9a0, hWnd=0x40426, wMsgFilterMin=0x1045, wMsgFilterMax=0x1045, wRemoveMsg=0x3 | out: lpMsg=0x6c8139d9a0) returned 0 [0110.744] GetActiveWindow () returned 0x0 [0147.373] DispCallFunc (pvInstance=0x1848c033e28, oVft=0x48, cc=0x4, vtReturn=0xa, cActuals=0x2, prgvt=0x1848d001340, prgpvarg=0x1848d001320, pvargResult=0x6c8139be50) returned 0x0 [0147.376] PeekMessageA (in: lpMsg=0x6c8139b880, hWnd=0x40426, wMsgFilterMin=0x1045, wMsgFilterMax=0x1045, wRemoveMsg=0x3 | out: lpMsg=0x6c8139b880) returned 0 [0147.376] GetActiveWindow () returned 0x5033c [0167.477] DispCallFunc (pvInstance=0x1848c033e28, oVft=0x48, cc=0x4, vtReturn=0xa, cActuals=0x2, prgvt=0x1848d002450, prgpvarg=0x1848d002430, pvargResult=0x6c8139df70) returned 0x0 [0167.477] PeekMessageA (in: lpMsg=0x6c8139d9a0, hWnd=0x40426, wMsgFilterMin=0x1045, wMsgFilterMax=0x1045, wRemoveMsg=0x3 | out: lpMsg=0x6c8139d9a0) returned 0 [0167.479] GetActiveWindow () returned 0x5033c Thread: id = 30 os_tid = 0x10b0 Thread: id = 31 os_tid = 0x8c Thread: id = 32 os_tid = 0x7a4 Thread: id = 33 os_tid = 0xcec Thread: id = 34 os_tid = 0x116c Thread: id = 35 os_tid = 0x1230 Thread: id = 36 os_tid = 0x6ac Thread: id = 37 os_tid = 0x10d4