When starting an windows exe called "resi.exe" I get the following error and log:
Running command: "/Users/myuser/Library/Application Support/CrossOver/Bottles/Notepadplusplus/drive_c/resi/ReSI.exe"
Bottle: Notepadplusplus
Debug channels: +pid,+process,+module,+loaddll,+seh,+threadname
Extra environment variables: (null)
Bottle:
Name: Notepadplusplus
Template: win11_64
Windows Version: win11
Managed: False
Arch: win64
D3DMetal: Unavailable
DXVK: Disabled
ESync: Disabled
High resolution mode: Unknown
MSync: Disabled
Product:
CrossOver
Version:
24.0.5
Install location:
/Applications/CrossOver.app/Contents/SharedSupport/CrossOver
Bitness:
64-bit
Desktop session:
Locale:
Locale:
LC_CTYPE: en_US.UTF-8
System Information:
Chipset Model: Apple M2 Max
Type: GPU
Bus: Built-In
Total Number of Cores: 12 (8 performance and 4 efficiency)
Vendor: Apple (0x106b)
Metal Support: Metal 3
Display Type: Built-in Liquid Retina XDR Display
Resolution: 3456 x 2234 Retina
Main Display: Yes
Mirror: Off
Online: Yes
Automatically Adjust Brightness: No
Connection Type: Internal
Model Name: Mac
Model Identifier: Mac14,6
Chip: Unknown
Memory: 64 GB
System Firmware Version: 10151.140.19
OS Loader Version: 8422.141.2.700.1
System Version: macOS 13.6.8 (22G820)
Kernel Version: Darwin 22.6.0
Time since boot: 9 Tage, 4 Stunden und 26 Minuten
Warnings:
Properties:
Libraries:
18418: Grabbing the '/var/folders/c7/tqzj_68j0x1f92ftyy04jm8m0000gn/T//.wine-501/bottle-0-0.lock' lock
18418: Got the '/var/folders/c7/tqzj_68j0x1f92ftyy04jm8m0000gn/T//.wine-501/bottle-0-0.lock' lock
CXConfig->read(/Applications/CrossOver.app/Contents/SharedSupport/CrossOver/etc/CrossOver.conf)
CXConfig->read(/Users/myuser/Library/Application Support/CrossOver/CrossOver.conf)
Product version=24.0.5.37094
CXConfig->read(/Users/myuser/Library/Application Support/CrossOver/Bottles/Notepadplusplus/cxbottle.conf)
Mode = 'private'
Environment:
CX_ROOT = "/Applications/CrossOver.app/Contents/SharedSupport/CrossOver"
CX_BOTTLE = "Notepadplusplus"
WINEPREFIX = "/Users/myuser/Library/Application Support/CrossOver/Bottles/Notepadplusplus"
CX_WINDOWS_VERSION = <undefined>
PATH = "/Applications/CrossOver.app/Contents/SharedSupport/CrossOver/bin:/usr/bin:/bin:/usr/sbin:/sbin"
DYLD_LIBRARY_PATH = "/Applications/CrossOver.app/Contents/SharedSupport/CrossOver/lib64"
WINEDLLPATH = "/Applications/CrossOver.app/Contents/SharedSupport/CrossOver/lib/wine/x86_64-windows:/Applications/CrossOver.app/Contents/SharedSupport/CrossOver/lib/wine/i386-windows"
WINEDLLOVERRIDES = <undefined>
WINEDLLPATH_PREPEND = <undefined>
LD_PRELOAD = <undefined>
LD_ASSUME_KERNEL = <undefined>
WINELOADER = "/Applications/CrossOver.app/Contents/SharedSupport/CrossOver/bin/wineloader"
WINESERVER = "/Applications/CrossOver.app/Contents/SharedSupport/CrossOver/bin/wineserver"
WINEDEBUG = "+pid,+process,+module,+loaddll,+seh,+threadname"
WINEWRAPPER = "/Applications/CrossOver.app/Contents/SharedSupport/CrossOver/lib/wine/x86_64-windows/winewrapper.exe"
CX_LOG = <undefined>
CX_DEBUGMSG = "+pid,+process,+module,+loaddll,+seh,+threadname"
DISPLAY = "/private/tmp/com.apple.launchd.3A9K7xfrc8/org.xquartz:0"
VKD3D_DEBUG = <undefined>
VKD3D_SHADER_DEBUG = <undefined>
18418: Releasing the '/var/folders/c7/tqzj_68j0x1f92ftyy04jm8m0000gn/T//.wine-501/bottle-0-0.lock' lock
Running `"/Applications/CrossOver.app/Contents/SharedSupport/CrossOver/bin/cxavscan" --gui "/Users/myuser/Library/Application Support/CrossOver/Bottles/Notepadplusplus/drive_c/resi/ReSI.exe"`
***** Sun Sep 15 21:05:19 2024
Starting: '/Applications/CrossOver.app/Contents/SharedSupport/CrossOver/bin/cxavscan' '--gui' '/Users/myuser/Library/Application Support/CrossOver/Bottles/Notepadplusplus/drive_c/resi/ReSI.exe'
CXConfig->read(/Applications/CrossOver.app/Contents/SharedSupport/CrossOver/etc/CrossOver.conf)
Found no antivirus tool
** Sun Sep 15 21:05:19 2024
Starting '/Applications/CrossOver.app/Contents/SharedSupport/CrossOver/bin/wineloader' '/Applications/CrossOver.app/Contents/SharedSupport/CrossOver/lib/wine/x86_64-windows/winewrapper.exe' '--new-console' '--workdir' '/Users/myuser/Library/Application Support/CrossOver/Bottles/Notepadplusplus/drive_c/resi' '--start' '--'
'/Users/myuser/Library/Application Support/CrossOver/Bottles/Notepadplusplus/drive_c/resi/ReSI.exe'
-> rc=768 (took 0.0300099849700928 seconds)
output=[]
Command:
/Applications/CrossOver.app/Contents/SharedSupport/CrossOver/bin/wineloader /Applications/CrossOver.app/Contents/SharedSupport/CrossOver/lib/wine/x86_64-windows/winewrapper.exe --new-console --workdir /Users/myuser/Library/Application Support/CrossOver/Bottles/Notepadplusplus/drive_c/resi --start -- /Users/myuser/Library/Application Support/CrossOver/Bottles/Notepadplusplus/drive_c/resi/ReSI.exe
wineserver: using server-side synchronization.
0020:0024:trace:process:NtCreateUserProcess L"\\??\\C:\\windows\\system32\\wineboot.exe" image L"C:\\windows\\system32\\wineboot.exe" cmdline L"\"C:\\windows\\system32\\wineboot.exe\" --init" parent 0x0 machine 0
0020:0024:trace:process:send_to_cx_loader loader (null) wineserversocket 7 stdin_fd -1 stdout_fd -1 unixdir (null) winedebug "WINEDEBUG=+pid,+process,+module,+loaddll,+seh,+threadname" wineloader (null)
0020:0024:trace:process:send_to_cx_loader CX_ALT_LOADER_SOCKET is not set; nothing to do
0028:002c:trace:module:get_load_order looking for L"C:\\windows\\system32\\wineboot.exe"
0028:002c:trace:module:get_load_order got hardcoded default for L"wineboot.exe"
0028:002c:trace:module:get_load_order looking for L"C:\\windows\\system32\\wineboot.exe"
0028:002c:trace:module:get_load_order got hardcoded default for L"wineboot.exe"
0028:002c:trace:module:map_image_into_view mapping PE file L"\\??\\C:\\windows\\system32\\wineboot.exe" at 0x140000000-0x140024000
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\wineboot.exe" section .text at 0x140001000 off 1000 size 8000 virt 7620 flags 60000060
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\wineboot.exe" section .data at 0x140009000 off 9000 size 1000 virt 1c0 flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\wineboot.exe" section .rdata at 0x14000a000 off a000 size c000 virt b9a0 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\wineboot.exe" section .pdata at 0x140016000 off 16000 size 1000 virt 2ac flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\wineboot.exe" section .xdata at 0x140017000 off 17000 size 1000 virt 2c0 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\wineboot.exe" section .bss at 0x140018000 off 0 size 0 virt 5a0 flags c0000080
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\wineboot.exe" section .idata at 0x140019000 off 18000 size 2000 virt 1a98 flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\wineboot.exe" section .rsrc at 0x14001b000 off 1a000 size 8000 virt 7ef0 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\wineboot.exe" section .reloc at 0x140023000 off 22000 size 1000 virt 78 flags 42000040
0028:002c:trace:module:map_image_into_view mapping PE file L"\\??\\C:\\windows\\system32\\ntdll.dll" at 0x6ffffff40000-0x6ffffffe6000
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .text at 0x6ffffff41000 off 1000 size 6b000 virt 6ac00 flags 60000020
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .data at 0x6ffffffac000 off 6c000 size 1000 virt d20 flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .rodata at 0x6ffffffad000 off 6d000 size 3000 virt 2058 flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .rdata at 0x6ffffffb0000 off 70000 size 14000 virt 131b0 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section /4 at 0x6ffffffc4000 off 84000 size 1000 virt 8f0 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .pdata at 0x6ffffffc5000 off 85000 size 9000 virt 80ac flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .xdata at 0x6ffffffce000 off 8e000 size 6000 virt 5224 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .bss at 0x6ffffffd4000 off 0 size 0 virt 3510 flags c0000080
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .edata at 0x6ffffffd8000 off 94000 size b000 virt a04c flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .idata at 0x6ffffffe3000 off 9f000 size 1000 virt 18 flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .rsrc at 0x6ffffffe4000 off a0000 size 1000 virt 3b0 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .reloc at 0x6ffffffe5000 off a1000 size 1000 virt 19c flags 42000040
0028:002c:trace:module:map_image_into_view relocating L"\\??\\C:\\windows\\system32\\ntdll.dll" dynamic base 170000000 -> 6ffffff40000 mapped at 0x6ffffff40000
0028:002c:trace:module:load_apiset_dll loaded L"\\??\\C:\\windows\\system32\\apisetschema.dll" apiset at 0x221000
0020:0024:trace:process:NtCreateUserProcess L"\\??\\C:\\windows\\system32\\wineboot.exe" pid 0028 tid 002c handles 0x14/0x18
0028:002c:trace:process:NtQueryInformationProcess (0xffffffffffffffff,0x00000025,0x21fa30,0x00000040,0x0)
0028:002c:trace:module:build_module loaded L"\\??\\C:\\windows\\system32\\wineboot.exe" 0000000000242FC0 0000000140000000
0028:002c:trace:loaddll:build_module Loaded L"C:\\windows\\system32\\wineboot.exe" at 0000000140000000: builtin
0028:002c:trace:module:load_dll looking for L"kernel32.dll" in (null)
0028:002c:trace:module:get_load_order looking for L"C:\\windows\\system32\\kernel32.dll"
0028:002c:trace:module:get_load_order got hardcoded default for L"kernel32.dll"
0028:002c:trace:module:map_image_into_view mapping PE file L"\\??\\C:\\windows\\system32\\kernel32.dll" at 0x6fffffec0000-0x6ffffff22000
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .text at 0x6fffffec1000 off 1000 size 30000 virt 2f770 flags 60000020
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .data at 0x6fffffef1000 off 31000 size 1000 virt 200 flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .rodata at 0x6fffffef2000 off 32000 size 2000 virt 1d6c flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .rdata at 0x6fffffef4000 off 34000 size 4000 virt 31e0 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section /4 at 0x6fffffef8000 off 38000 size 1000 virt 710 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .pdata at 0x6fffffef9000 off 39000 size 6000 virt 5118 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .xdata at 0x6fffffeff000 off 3f000 size 3000 virt 2c1c flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .bss at 0x6ffffff02000 off 0 size 0 virt 240 flags c0000080
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .edata at 0x6ffffff03000 off 42000 size b000 virt a458 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .idata at 0x6ffffff0e000 off 4d000 size a000 virt 96e4 flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .rsrc at 0x6ffffff18000 off 57000 size 9000 virt 8190 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .reloc at 0x6ffffff21000 off 60000 size 1000 virt 1c flags 42000040
0028:002c:trace:module:map_image_into_view relocating L"\\??\\C:\\windows\\system32\\kernel32.dll" dynamic base 178000000 -> 6fffffec0000 mapped at 0x6fffffec0000
0028:002c:trace:module:load_dll looking for L"kernelbase.dll" in (null)
0028:002c:trace:module:get_load_order looking for L"C:\\windows\\system32\\kernelbase.dll"
0028:002c:trace:module:get_load_order got hardcoded default for L"kernelbase.dll"
0028:002c:trace:module:map_image_into_view mapping PE file L"\\??\\C:\\windows\\system32\\kernelbase.dll" at 0x6fffffc10000-0x6fffffea2000
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .text at 0x6fffffc11000 off 1000 size 85000 virt 84090 flags 60000020
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .data at 0x6fffffc96000 off 86000 size 2000 virt 1ea0 flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .rodata at 0x6fffffc98000 off 88000 size 2000 virt 1dd4 flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .rdata at 0x6fffffc9a000 off 8a000 size 18000 virt 17a20 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section /4 at 0x6fffffcb2000 off a2000 size 1000 virt 5a8 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .pdata at 0x6fffffcb3000 off a3000 size 9000 virt 8010 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .xdata at 0x6fffffcbc000 off ac000 size 6000 virt 5c88 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .bss at 0x6fffffcc2000 off 0 size 0 virt 28c0 flags c0000080
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .edata at 0x6fffffcc5000 off b2000 size b000 virt a950 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .idata at 0x6fffffcd0000 off bd000 size 5000 virt 475c flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .rsrc at 0x6fffffcd5000 off c2000 size 1cc000 virt 1cbc90 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .reloc at 0x6fffffea1000 off 28e000 size 1000 virt 1fc flags 42000040
0028:002c:trace:module:map_image_into_view relocating L"\\??\\C:\\windows\\system32\\kernelbase.dll" dynamic base 174000000 -> 6fffffc10000 mapped at 0x6fffffc10000
0028:002c:trace:module:load_dll looking for L"ntdll.dll" in (null)
0028:002c:trace:module:load_dll Found L"C:\\windows\\system32\\ntdll.dll" for L"ntdll.dll" at 00006FFFFFF40000, count=2
0028:002c:trace:module:build_module loaded L"\\??\\C:\\windows\\system32\\kernelbase.dll" 00000000002435E0 00006FFFFFC10000
0028:002c:trace:loaddll:build_module Loaded L"C:\\windows\\system32\\kernelbase.dll" at 00006FFFFFC10000: builtin
0028:002c:trace:module:load_dll Loaded module L"\\??\\C:\\windows\\system32\\kernelbase.dll" at 00006FFFFFC10000
0028:002c:trace:module:load_dll looking for L"ntdll.dll" in (null)
0028:002c:trace:module:load_dll Found L"C:\\windows\\system32\\ntdll.dll" for L"ntdll.dll" at 00006FFFFFF40000, count=3
0028:002c:trace:module:build_module loaded L"\\??\\C:\\windows\\system32\\kernel32.dll" 0000000000243350 00006FFFFFEC0000
0028:002c:trace:loaddll:build_module Loaded L"C:\\windows\\system32\\kernel32.dll" at 00006FFFFFEC0000: builtin
0028:002c:trace:module:load_dll Loaded module L"\\??\\C:\\windows\\system32\\kernel32.dll" at 00006FFFFFEC0000
0028:002c:trace:module:load_dll looking for L"advapi32.dll" in (null)
0028:002c:trace:module:get_load_order looking for L"C:\\windows\\system32\\advapi32.dll"
0028:002c:trace:module:get_load_order got hardcoded default for L"advapi32.dll"
0028:002c:trace:module:map_image_into_view mapping PE file L"\\??\\C:\\windows\\system32\\advapi32.dll" at 0x6fffffbb0000-0x6fffffbf2000
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .text at 0x6fffffbb1000 off 1000 size 25000 virt 24510 flags 60000060
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .data at 0x6fffffbd6000 off 26000 size 1000 virt 200 flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .rodata at 0x6fffffbd7000 off 27000 size 1000 virt e30 flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .rdata at 0x6fffffbd8000 off 28000 size 7000 virt 6480 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section /4 at 0x6fffffbdf000 off 2f000 size 1000 virt 360 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .pdata at 0x6fffffbe0000 off 30000 size 3000 virt 2cdc flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .xdata at 0x6fffffbe3000 off 33000 size 2000 virt 1f1c flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .bss at 0x6fffffbe5000 off 0 size 0 virt 19a0 flags c0000080
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .edata at 0x6fffffbe7000 off 35000 size 5000 virt 46cc flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .idata at 0x6fffffbec000 off 3a000 size 4000 virt 31dc flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .rsrc at 0x6fffffbf0000 off 3e000 size 1000 virt 3c8 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .reloc at 0x6fffffbf1000 off 3f000 size 1000 virt 164 flags 42000040
0028:002c:trace:module:map_image_into_view relocating L"\\??\\C:\\windows\\system32\\advapi32.dll" dynamic base 180000000 -> 6fffffbb0000 mapped at 0x6fffffbb0000
0028:002c:trace:module:load_dll looking for L"kernel32.dll" in (null)
0028:002c:trace:module:load_dll Found L"C:\\windows\\system32\\kernel32.dll" for L"kernel32.dll" at 00006FFFFFEC0000, count=2
0028:002c:trace:module:load_dll looking for L"kernelbase.dll" in (null)
0028:002c:trace:module:load_dll Found L"C:\\windows\\system32\\kernelbase.dll" for L"kernelbase.dll" at 00006FFFFFC10000, count=2
0028:002c:trace:module:load_dll looking for L"msvcrt.dll" in (null)
0028:002c:trace:module:get_load_order looking for L"C:\\windows\\system32\\msvcrt.dll"
0028:002c:trace:module:get_load_order got hardcoded default for L"msvcrt.dll"
0028:002c:trace:module:map_image_into_view mapping PE file L"\\??\\C:\\windows\\system32\\msvcrt.dll" at 0x6fffffb00000-0x6fffffb9b000
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .text at 0x6fffffb01000 off 1000 size 6d000 virt 6c4c0 flags 60000060
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .data at 0x6fffffb6e000 off 6e000 size 2000 virt 1840 flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .rodata at 0x6fffffb70000 off 70000 size 2000 virt 146c flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .rdata at 0x6fffffb72000 off 72000 size d000 virt c0a0 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section /4 at 0x6fffffb7f000 off 7f000 size 1000 virt 148 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .pdata at 0x6fffffb80000 off 80000 size 8000 virt 79bc flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .xdata at 0x6fffffb88000 off 88000 size 6000 virt 5224 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .bss at 0x6fffffb8e000 off 0 size 0 virt 1c60 flags c0000080
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .edata at 0x6fffffb90000 off 8e000 size 7000 virt 62f8 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .idata at 0x6fffffb97000 off 95000 size 2000 virt 195c flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .rsrc at 0x6fffffb99000 off 97000 size 1000 virt 398 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .reloc at 0x6fffffb9a000 off 98000 size 1000 virt 220 flags 42000040
0028:002c:trace:module:map_image_into_view relocating L"\\??\\C:\\windows\\system32\\msvcrt.dll" dynamic base 180000000 -> 6fffffb00000 mapped at 0x6fffffb00000
0028:002c:trace:module:load_dll looking for L"kernel32.dll" in (null)
0028:002c:trace:module:load_dll Found L"C:\\windows\\system32\\kernel32.dll" for L"kernel32.dll" at 00006FFFFFEC0000, count=3
0028:002c:trace:module:load_dll looking for L"ntdll.dll" in (null)
0028:002c:trace:module:load_dll Found L"C:\\windows\\system32\\ntdll.dll" for L"ntdll.dll" at 00006FFFFFF40000, count=4
0028:002c:trace:module:build_module loaded L"\\??\\C:\\windows\\system32\\msvcrt.dll" 0000000000243B70 00006FFFFFB00000
0028:002c:trace:loaddll:build_module Loaded L"C:\\windows\\system32\\msvcrt.dll" at 00006FFFFFB00000: builtin
0028:002c:trace:module:load_dll Loaded module L"\\??\\C:\\windows\\system32\\msvcrt.dll" at 00006FFFFFB00000
0028:002c:trace:module:load_dll looking for L"ntdll.dll" in (null)
0028:002c:trace:module:load_dll Found L"C:\\windows\\system32\\ntdll.dll" for L"ntdll.dll" at 00006FFFFFF40000, count=5
0028:002c:trace:module:load_dll looking for L"sechost.dll" in (null)
0028:002c:trace:module:get_load_order looking for L"C:\\windows\\system32\\sechost.dll"
0028:002c:trace:module:get_load_order got hardcoded default for L"sechost.dll"
0028:002c:trace:module:map_image_into_view mapping PE file L"\\??\\C:\\windows\\system32\\sechost.dll" at 0x6fffffac0000-0x6fffffaea000
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section .text at 0x6fffffac1000 off 1000 size 18000 virt 17240 flags 60000060
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section .data at 0x6fffffad9000 off 19000 size 1000 virt 190 flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section .rodata at 0x6fffffada000 off 1a000 size 1000 virt ef0 flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section .rdata at 0x6fffffadb000 off 1b000 size 4000 virt 3900 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section /4 at 0x6fffffadf000 off 1f000 size 1000 virt 978 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section .pdata at 0x6fffffae0000 off 20000 size 2000 virt 1410 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section .xdata at 0x6fffffae2000 off 22000 size 2000 virt 10a0 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section .bss at 0x6fffffae4000 off 0 size 0 virt 1a0 flags c0000080
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section .edata at 0x6fffffae5000 off 24000 size 2000 virt 1e58 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section .idata at 0x6fffffae7000 off 26000 size 2000 virt 13a8 flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section .reloc at 0x6fffffae9000 off 28000 size 1000 virt f0 flags 42000040
0028:002c:trace:module:map_image_into_view relocating L"\\??\\C:\\windows\\system32\\sechost.dll" dynamic base 180000000 -> 6fffffac0000 mapped at 0x6fffffac0000
0028:002c:trace:module:load_dll looking for L"kernel32.dll" in (null)
0028:002c:trace:module:load_dll Found L"C:\\windows\\system32\\kernel32.dll" for L"kernel32.dll" at 00006FFFFFEC0000, count=4
0028:002c:trace:module:load_dll looking for L"kernelbase.dll" in (null)
0028:002c:trace:module:load_dll Found L"C:\\windows\\system32\\kernelbase.dll" for L"kernelbase.dll" at 00006FFFFFC10000, count=3
0028:002c:trace:module:load_dll looking for L"ntdll.dll" in (null)
0028:002c:trace:module:load_dll Found L"C:\\windows\\system32\\ntdll.dll" for L"ntdll.dll" at 00006FFFFFF40000, count=6
0028:002c:trace:module:load_dll looking for L"ucrtbase.dll" in (null)
0028:002c:trace:module:get_load_order looking for L"C:\\windows\\system32\\ucrtbase.dll"
0028:002c:trace:module:get_load_order got hardcoded default for L"ucrtbase.dll"
0028:002c:trace:module:map_image_into_view mapping PE file L"\\??\\C:\\windows\\system32\\ucrtbase.dll" at 0x6fffff9e0000-0x6fffffaaa000
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ucrtbase.dll" section .text at 0x6fffff9e1000 off 1000 size 87000 virt 86480 flags 60000060
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ucrtbase.dll" section .data at 0x6fffffa68000 off 88000 size 2000 virt 1b50 flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ucrtbase.dll" section .rodata at 0x6fffffa6a000 off 8a000 size 4000 virt 3510 flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ucrtbase.dll" section .rdata at 0x6fffffa6e000 off 8e000 size 10000 virt f0d0 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ucrtbase.dll" section /4 at 0x6fffffa7e000 off 9e000 size 2000 virt 1638 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ucrtbase.dll" section .pdata at 0x6fffffa80000 off a0000 size d000 virt c774 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ucrtbase.dll" section .xdata at 0x6fffffa8d000 off ad000 size 8000 virt 77c0 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ucrtbase.dll" section .bss at 0x6fffffa95000 off 0 size 0 virt 20f0 flags c0000080
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ucrtbase.dll" section .edata at 0x6fffffa98000 off b5000 size e000 virt d5e4 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ucrtbase.dll" section .idata at 0x6fffffaa6000 off c3000 size 2000 virt 1b94 flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ucrtbase.dll" section .rsrc at 0x6fffffaa8000 off c5000 size 1000 virt 3c8 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ucrtbase.dll" section .reloc at 0x6fffffaa9000 off c6000 size 1000 virt 260 flags 42000040
0028:002c:trace:module:map_image_into_view relocating L"\\??\\C:\\windows\\system32\\ucrtbase.dll" dynamic base 180000000 -> 6fffff9e0000 mapped at 0x6fffff9e0000
0028:002c:trace:module:load_dll looking for L"kernel32.dll" in (null)
0028:002c:trace:module:load_dll Found L"C:\\windows\\system32\\kernel32.dll" for L"kernel32.dll" at 00006FFFFFEC0000, count=5
0028:002c:trace:module:load_dll looking for L"ntdll.dll" in (null)
0028:002c:trace:module:load_dll Found L"C:\\windows\\system32\\ntdll.dll" for L"ntdll.dll" at 00006FFFFFF40000, count=7
0028:002c:trace:module:build_module loaded L"\\??\\C:\\windows\\system32\\ucrtbase.dll" 0000000000244990 00006FFFFF9E0000
0028:002c:trace:loaddll:build_module Loaded L"C:\\windows\\system32\\ucrtbase.dll" at 00006FFFFF9E0000: builtin
0028:002c:trace:module:load_dll Loaded module L"\\??\\C:\\windows\\system32\\ucrtbase.dll" at 00006FFFFF9E0000
0028:002c:trace:module:build_module loaded L"\\??\\C:\\windows\\system32\\sechost.dll" 00000000002447A0 00006FFFFFAC0000
0028:002c:trace:loaddll:build_module Loaded L"C:\\windows\\system32\\sechost.dll" at 00006FFFFFAC0000: builtin
0028:002c:trace:module:load_dll Loaded module L"\\??\\C:\\windows\\system32\\sechost.dll" at 00006FFFFFAC0000
0028:002c:trace:module:build_module loaded L"\\??\\C:\\windows\\system32\\advapi32.dll" 0000000000244180 00006FFFFFBB0000
0028:002c:trace:loaddll:build_module Loaded L"C:\\windows\\system32\\advapi32.dll" at 00006FFFFFBB0000: builtin
0028:002c:trace:module:load_dll Loaded module L"\\??\\C:\\windows\\system32\\advapi32.dll" at 00006FFFFFBB0000
0028:002c:trace:module:load_dll looking for L"kernel32.dll" in (null)
0028:002c:trace:module:load_dll Found L"C:\\windows\\system32\\kernel32.dll" for L"kernel32.dll" at 00006FFFFFEC0000, count=6
0028:002c:trace:module:load_dll looking for L"kernelbase.dll" in (null)
0028:002c:trace:module:load_dll Found L"C:\\windows\\system32\\kernelbase.dll" for L"kernelbase.dll" at 00006FFFFFC10000, count=4
0028:002c:trace:module:load_dll looking for L"ntdll.dll" in (null)
0028:002c:trace:module:load_dll Found L"C:\\windows\\system32\\ntdll.dll" for L"ntdll.dll" at 00006FFFFFF40000, count=8
0028:002c:trace:module:load_dll looking for L"ucrtbase.dll" in (null)
0028:002c:trace:module:load_dll Found L"C:\\windows\\system32\\ucrtbase.dll" for L"ucrtbase.dll" at 00006FFFFF9E0000, count=2
0028:002c:trace:module:load_dll looking for L"ws2_32.dll" in (null)
0028:002c:trace:module:get_load_order looking for L"C:\\windows\\system32\\ws2_32.dll"
0028:002c:trace:module:get_load_order got hardcoded default for L"ws2_32.dll"
0028:002c:trace:module:map_image_into_view mapping PE file L"\\??\\C:\\windows\\system32\\ws2_32.dll" at 0x6fffff9a0000-0x6fffff9c7000
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ws2_32.dll" section .text at 0x6fffff9a1000 off 1000 size 14000 virt 134b0 flags 60000060
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ws2_32.dll" section .data at 0x6fffff9b5000 off 15000 size 1000 virt 240 flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ws2_32.dll" section .rodata at 0x6fffff9b6000 off 16000 size 1000 virt 864 flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ws2_32.dll" section .rdata at 0x6fffff9b7000 off 17000 size 5000 virt 4e10 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ws2_32.dll" section /4 at 0x6fffff9bc000 off 1c000 size 1000 virt 58 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ws2_32.dll" section .pdata at 0x6fffff9bd000 off 1d000 size 1000 virt fcc flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ws2_32.dll" section .xdata at 0x6fffff9be000 off 1e000 size 1000 virt ce4 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ws2_32.dll" section .bss at 0x6fffff9bf000 off 0 size 0 virt 170 flags c0000080
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ws2_32.dll" section .edata at 0x6fffff9c0000 off 1f000 size 2000 virt 1398 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ws2_32.dll" section .idata at 0x6fffff9c2000 off 21000 size 1000 virt d08 flags c0000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ws2_32.dll" section .rsrc at 0x6fffff9c3000 off 22000 size 3000 virt 29b8 flags 40000040
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ws2_32.dll" section .reloc at 0x6fffff9c6000 off 25000 size 1000 virt 68 flags 42000040
0028:002c:trace:module:map_image_into_view relocating L"\\??\\C:\\windows\\system32\\ws2_32.dll" dynamic base 180000000 -> 6fffff9a0000 mapped at 0x6fffff9a0000
0028:002c:trace:module:load_dll looking for L"kernel32.dll" in (null)
0028:002c:trace:module:load_dll Found L"C:\\windows\\system32\\kernel32.dll" for L"kernel32.dll" at 00006FFFFFEC0000, count=7
0028:002c:trace:module:load_dll looking for L"ntdll.dll" in (null)
0028:002c:trace:module:load_dll Found L"C:\\windows\\system32\\ntdll.dll" for L"ntdll.dll" at 00006FFFFFF40000, count=9
0028:002c:trace:module:load_dll looking for L"ucrtbase.dll" in (null)
0028:002c:trace:module:load_dll Found L"C:\\windows\\system32\\ucrtbase.dll" for L"ucrtbase.dll" at 00006FFFFF9E0000, count=3
0028:002c:trace:module:build_module loaded L"\\??\\C:\\windows\\system32\\ws2_32.dll" 00000000002408F0 00006FFFFF9A0000
0028:002c:trace:loaddll:build_module Loaded L"C:\\windows\\system32\\ws2_32.dll" at 00006FFFFF9A0000: builtin
0028:002c:trace:module:load_dll Loaded module L"\\??\\C:\\windows\\system32\\ws2_32.dll" at 00006FFFFF9A0000
0028:002c:trace:module:process_attach (L"ntdll.dll",000000000021FB00) - START
0028:002c:trace:module:MODULE_InitDLL (00006FFFFFF40000 L"ntdll.dll",PROCESS_ATTACH,000000000021FB00) - CALL
0028:002c:trace:module:MODULE_InitDLL (00006FFFFFF40000,PROCESS_ATTACH,000000000021FB00) - RETURN 1
0028:002c:trace:module:process_attach (L"ntdll.dll",000000000021FB00) - END
0028:002c:trace:module:process_attach (L"kernel32.dll",000000000021FB00) - START
0028:002c:trace:module:process_attach (L"kernelbase.dll",000000000021FB00) - START
0028:002c:trace:module:MODULE_InitDLL (00006FFFFFC10000 L"kernelbase.dll",PROCESS_ATTACH,000000000021FB00) - CALL
0028:002c:trace:process:NtQueryInformationProcess (0xffffffffffffffff,0x0000001a,0x21f588,0x00000008,0x0)
0028:002c:trace:process:GetEnvironmentVariableW (L"WINEUNIXCP" 000000000021F340 85)
0028:002c:trace:process:ExpandEnvironmentStringsW (L"@tzres.dll,-4896" 0000000000000000 0)
0028:002c:trace:process:ExpandEnvironmentStringsW (L"@tzres.dll,-4896" 0000000000240AB0 17)
0028:002c:trace:module:LdrGetDllHandleEx flags 0, load_path 0000000000241020, dll_characteristics 0000000000000000, name 000000000021F060, base 000000000021EFF8.
0028:002c:trace:module:LdrGetDllHandleEx L"C:\\windows\\system32\\tzres.dll" -> 0000000000000000 (load path L"C:\\windows\\system32;C:\\windows\\system32;C:\\windows\\system;C:\\windows;.;C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem;C:\\windows\\system32\\WindowsPowershell\\v1.0")
0028:002c:trace:module:get_load_order looking for L"C:\\windows\\system32\\tzres.dll"
0028:002c:trace:module:get_load_order got hardcoded default for L"tzres.dll"
0028:002c:trace:module:map_image_into_view mapping PE file L"\\??\\C:\\windows\\system32\\tzres.dll" at 0x180000000-0x180081000
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\tzres.dll" section .rsrc at 0x180001000 off 1000 size 80000 virt 7fdc8 flags 40000040
0028:002c:trace:module:FindResourceExW 0000000180000002 #0006 #0133 0000
0028:002c:trace:module:LoadResource 0000000180000002 0000000180008180
0028:002c:trace:process:ExpandEnvironmentStringsW (L"@tzres.dll,-4897" 0000000000000000 0)
0028:002c:trace:process:ExpandEnvironmentStringsW (L"@tzres.dll,-4897" 0000000000240AE0 17)
0028:002c:trace:module:LdrGetDllHandleEx flags 0, load_path 00000000002410B0, dll_characteristics 0000000000000000, name 000000000021F060, base 000000000021EFF8.
0028:002c:trace:module:LdrGetDllHandleEx L"C:\\windows\\system32\\tzres.dll" -> 0000000000000000 (load path L"C:\\windows\\system32;C:\\windows\\system32;C:\\windows\\system;C:\\windows;.;C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem;C:\\windows\\system32\\WindowsPowershell\\v1.0")
0028:002c:trace:module:get_load_order looking for L"C:\\windows\\system32\\tzres.dll"
0028:002c:trace:module:get_load_order got hardcoded default for L"tzres.dll"
0028:002c:trace:module:map_image_into_view mapping PE file L"\\??\\C:\\windows\\system32\\tzres.dll" at 0x180000000-0x180081000
0028:002c:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\tzres.dll" section .rsrc at 0x180001000 off 1000 size 80000 virt 7fdc8 flags 40000040
0028:002c:trace:module:FindResourceExW 0000000180000002 #0006 #0133 0000
0028:002c:trace:module:LoadResource 0000000180000002 0000000180008180
0028:002c:trace:module:MODULE_InitDLL (00006FFFFFC10000,PROCESS_ATTACH,000000000021FB00) - RETURN 1
0028:002c:trace:module:process_attach (L"kernelbase.dll",000000000021FB00) - END
0028:002c:trace:module:MODULE_InitDLL (00006FFFFFEC0000 L"kernel32.dll",PROCESS_ATTACH,000000000021FB00) - CALL
0028:002c:trace:module:MODULE_InitDLL (00006FFFFFEC0000,PROCESS_ATTACH,000000000021FB00) - RETURN 1
0028:002c:trace:module:process_attach (L"kernel32.dll",000000000021FB00) - END
0028:002c:trace:module:process_attach (L"advapi32.dll",000000000021FB00) - START
0028:002c:trace:module:process_attach (L"msvcrt.dll",000000000021FB00) - START
0028:002c:trace:module:MODULE_InitDLL (00006FFFFFB00000 L"msvcrt.dll",PROCESS_ATTACH,000000000021FB00) - CALL
0028:002c:trace:module:LdrGetDllFullName module 0000000000000000, name 000000000021F330.
0028:002c:trace:module:GetModuleFileNameW L"C:\\windows\\system32\\wineboot.exe"
0028:002c:trace:module:LdrGetDllFullName module 0000000000000000, name 000000000021F380.
0028:002c:trace:module:GetModuleFileNameW L"C:\\windows\\system32\\wineboot.exe"
0028:002c:trace:module:LdrAddRefDll (L"msvcrt.dll") ldr.LoadCount: -1
0028:002c:trace:module:MODULE_InitDLL (00006FFFFFB00000,PROCESS_ATTACH,000000000021FB00) - RETURN 1
0028:002c:trace:module:process_attach (L"msvcrt.dll",000000000021FB00) - END
0028:002c:trace:module:process_attach (L"sechost.dll",000000000021FB00) - START
0028:002c:trace:module:process_attach (L"ucrtbase.dll",000000000021FB00) - START
0028:002c:trace:module:MODULE_InitDLL (00006FFFFF9E0000 L"ucrtbase.dll",PROCESS_ATTACH,000000000021FB00) - CALL
0028:002c:trace:module:LdrGetDllFullName module 0000000000000000, name 000000000021F2B0.
0028:002c:trace:module:GetModuleFileNameW L"C:\\windows\\system32\\wineboot.exe"
0028:002c:trace:module:LdrGetDllFullName module 0000000000000000, name 000000000021F300.
0028:002c:trace:module:GetModuleFileNameW L"C:\\windows\\system32\\wineboot.exe"
0028:002c:trace:module:MODULE_InitDLL (00006FFFFF9E0000,PROCESS_ATTACH,000000000021FB00) - RETURN 1
0028:002c:trace:module:process_attach (L"ucrtbase.dll",000000000021FB00) - END
0028:002c:trace:module:MODULE_InitDLL (00006FFFFFAC0000 L"sechost.dll",PROCESS_ATTACH,000000000021FB00) - CALL
0028:002c:trace:module:MODULE_InitDLL (00006FFFFFAC0000,PROCESS_ATTACH,000000000021FB00) - RETURN 1
0028:002c:trace:module:process_attach (L"sechost.dll",000000000021FB00) - END
0028:002c:trace:module:MODULE_InitDLL (00006FFFFFBB0000 L"advapi32.dll",PROCESS_ATTACH,000000000021FB00) - CALL
0028:002c:trace:module:MODULE_InitDLL (00006FFFFFBB0000,PROCESS_ATTACH,000000000021FB00) - RETURN 1
0028:002c:trace:module:process_attach (L"advapi32.dll",000000000021FB00) - END
0028:002c:trace:module:process_attach (L"ws2_32.dll",000000000021FB00) - START
0028:002c:trace:module:MODULE_InitDLL (00006FFFFF9A0000 L"ws2_32.dll",PROCESS_ATTACH,000000000021FB00) - CALL
0028:002c:trace:module:LdrGetDllHandleEx flags 0x1, load_path 0000000000000000, dll_characteristics 0000000000000000, name 000000000021F5E0, base 000000000021F5D8.
0028:002c:trace:module:LdrGetDllHandleEx L"ntdll.dll" -> 00006FFFFFF40000 (load path (null))
0028:002c:trace:module:MODULE_InitDLL (00006FFFFF9A0000,PROCESS_ATTACH,000000000021FB00) - RETURN 1
0028:002c:trace:module:process_attach (L"ws2_32.dll",000000000021FB00) - END
0028:002c:trace:process:NtQueryInformationProcess (0xffffffffffffffff,0x00000007,0x21f838,0x00000008,0x0)
0028:002c:trace:process:NtQueryInformationProcess (0xffffffffffffffff,0x0000001a,0x21ef08,0x00000008,0x0)
0028:002c:trace:module:LdrGetDllHandleEx flags 0x1, load_path 0000000000000000, dll_characteristics 0000000000000000, name 000000000021EE50, base 000000000021EE48.
0028:002c:trace:module:LdrGetDllHandleEx L"ntdll.dll" -> 00006FFFFFF40000 (load path (null))
0028:002c:trace:module:LdrGetDllHandleEx flags 0x1, load_path 0000000000000000, dll_characteristics 0000000000000000, name 000000000021EB80, base 000000000021EB78.
0028:002c:trace:module:LdrGetDllHandleEx L"ntdll.dll" -> 00006FFFFFF40000 (load path (null))
0028:002c:trace:process:CreateProcessInternalW app L"C:\\windows\\system32\\services.exe" cmdline (null)
0028:002c:trace:process:CreateProcessInternalW app L"C:\\windows\\system32\\services.exe" cmdline L"\"C:\\windows\\system32\\services.exe\"" after all hacks
0028:002c:trace:process:NtCreateUserProcess L"\\??\\C:\\windows\\system32\\services.exe" image L"C:\\windows\\system32\\services.exe" cmdline L"\"C:\\windows\\system32\\services.exe\"" parent 0x0 machine 0
0028:002c:trace:process:send_to_cx_loader loader (null) wineserversocket 12 stdin_fd -1 stdout_fd -1 unixdir (null) winedebug "WINEDEBUG=+pid,+process,+module,+loaddll,+seh,+threadname" wineloader (null)
0028:002c:trace:process:send_to_cx_loader CX_ALT_LOADER_SOCKET is not set; nothing to do
0030:0034:trace:module:get_load_order looking for L"C:\\windows\\system32\\services.exe"
0030:0034:trace:module:get_load_order got hardcoded default for L"services.exe"
0030:0034:trace:module:get_load_order looking for L"C:\\windows\\system32\\services.exe"
0030:0034:trace:module:get_load_order got hardcoded default for L"services.exe"
0030:0034:trace:module:map_image_into_view mapping PE file L"\\??\\C:\\windows\\system32\\services.exe" at 0x140000000-0x140024000
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\services.exe" section .text at 0x140001000 off 1000 size 19000 virt 18240 flags 60000020
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\services.exe" section .data at 0x14001a000 off 1a000 size 1000 virt 2d0 flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\services.exe" section .rdata at 0x14001b000 off 1b000 size 3000 virt 2c80 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\services.exe" section .pdata at 0x14001e000 off 1e000 size 1000 virt c84 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\services.exe" section .xdata at 0x14001f000 off 1f000 size 1000 virt ae8 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\services.exe" section .bss at 0x140020000 off 0 size 0 virt 240 flags c0000080
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\services.exe" section .idata at 0x140021000 off 20000 size 2000 virt 1870 flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\services.exe" section .reloc at 0x140023000 off 22000 size 1000 virt 12c flags 42000040
0030:0034:trace:module:map_image_into_view mapping PE file L"\\??\\C:\\windows\\system32\\ntdll.dll" at 0x6ffffff40000-0x6ffffffe6000
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .text at 0x6ffffff41000 off 1000 size 6b000 virt 6ac00 flags 60000020
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .data at 0x6ffffffac000 off 6c000 size 1000 virt d20 flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .rodata at 0x6ffffffad000 off 6d000 size 3000 virt 2058 flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .rdata at 0x6ffffffb0000 off 70000 size 14000 virt 131b0 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section /4 at 0x6ffffffc4000 off 84000 size 1000 virt 8f0 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .pdata at 0x6ffffffc5000 off 85000 size 9000 virt 80ac flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .xdata at 0x6ffffffce000 off 8e000 size 6000 virt 5224 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .bss at 0x6ffffffd4000 off 0 size 0 virt 3510 flags c0000080
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .edata at 0x6ffffffd8000 off 94000 size b000 virt a04c flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .idata at 0x6ffffffe3000 off 9f000 size 1000 virt 18 flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .rsrc at 0x6ffffffe4000 off a0000 size 1000 virt 3b0 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ntdll.dll" section .reloc at 0x6ffffffe5000 off a1000 size 1000 virt 19c flags 42000040
0030:0034:trace:module:map_image_into_view relocating L"\\??\\C:\\windows\\system32\\ntdll.dll" dynamic base 170000000 -> 6ffffff40000 mapped at 0x6ffffff40000
0030:0034:trace:module:load_apiset_dll loaded L"\\??\\C:\\windows\\system32\\apisetschema.dll" apiset at 0x221000
0028:002c:trace:process:NtCreateUserProcess L"\\??\\C:\\windows\\system32\\services.exe" pid 0030 tid 0034 handles 0x3c/0x40
0028:002c:trace:process:CreateProcessInternalW started process pid 0030 tid 0034
0030:0034:trace:process:NtQueryInformationProcess (0xffffffffffffffff,0x00000025,0x21fa30,0x00000040,0x0)
0030:0034:trace:module:build_module loaded L"\\??\\C:\\windows\\system32\\services.exe" 0000000000243050 0000000140000000
0030:0034:trace:loaddll:build_module Loaded L"C:\\windows\\system32\\services.exe" at 0000000140000000: builtin
0030:0034:trace:module:load_dll looking for L"kernel32.dll" in (null)
0030:0034:trace:module:get_load_order looking for L"C:\\windows\\system32\\kernel32.dll"
0030:0034:trace:module:get_load_order got hardcoded default for L"kernel32.dll"
0030:0034:trace:module:map_image_into_view mapping PE file L"\\??\\C:\\windows\\system32\\kernel32.dll" at 0x6fffffec0000-0x6ffffff22000
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .text at 0x6fffffec1000 off 1000 size 30000 virt 2f770 flags 60000020
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .data at 0x6fffffef1000 off 31000 size 1000 virt 200 flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .rodata at 0x6fffffef2000 off 32000 size 2000 virt 1d6c flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .rdata at 0x6fffffef4000 off 34000 size 4000 virt 31e0 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section /4 at 0x6fffffef8000 off 38000 size 1000 virt 710 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .pdata at 0x6fffffef9000 off 39000 size 6000 virt 5118 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .xdata at 0x6fffffeff000 off 3f000 size 3000 virt 2c1c flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .bss at 0x6ffffff02000 off 0 size 0 virt 240 flags c0000080
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .edata at 0x6ffffff03000 off 42000 size b000 virt a458 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .idata at 0x6ffffff0e000 off 4d000 size a000 virt 96e4 flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .rsrc at 0x6ffffff18000 off 57000 size 9000 virt 8190 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernel32.dll" section .reloc at 0x6ffffff21000 off 60000 size 1000 virt 1c flags 42000040
0030:0034:trace:module:map_image_into_view relocating L"\\??\\C:\\windows\\system32\\kernel32.dll" dynamic base 178000000 -> 6fffffec0000 mapped at 0x6fffffec0000
0030:0034:trace:module:load_dll looking for L"kernelbase.dll" in (null)
0030:0034:trace:module:get_load_order looking for L"C:\\windows\\system32\\kernelbase.dll"
0030:0034:trace:module:get_load_order got hardcoded default for L"kernelbase.dll"
0030:0034:trace:module:map_image_into_view mapping PE file L"\\??\\C:\\windows\\system32\\kernelbase.dll" at 0x6fffffc10000-0x6fffffea2000
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .text at 0x6fffffc11000 off 1000 size 85000 virt 84090 flags 60000020
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .data at 0x6fffffc96000 off 86000 size 2000 virt 1ea0 flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .rodata at 0x6fffffc98000 off 88000 size 2000 virt 1dd4 flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .rdata at 0x6fffffc9a000 off 8a000 size 18000 virt 17a20 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section /4 at 0x6fffffcb2000 off a2000 size 1000 virt 5a8 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .pdata at 0x6fffffcb3000 off a3000 size 9000 virt 8010 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .xdata at 0x6fffffcbc000 off ac000 size 6000 virt 5c88 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .bss at 0x6fffffcc2000 off 0 size 0 virt 28c0 flags c0000080
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .edata at 0x6fffffcc5000 off b2000 size b000 virt a950 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .idata at 0x6fffffcd0000 off bd000 size 5000 virt 475c flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .rsrc at 0x6fffffcd5000 off c2000 size 1cc000 virt 1cbc90 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\kernelbase.dll" section .reloc at 0x6fffffea1000 off 28e000 size 1000 virt 1fc flags 42000040
0030:0034:trace:module:map_image_into_view relocating L"\\??\\C:\\windows\\system32\\kernelbase.dll" dynamic base 174000000 -> 6fffffc10000 mapped at 0x6fffffc10000
0030:0034:trace:module:load_dll looking for L"ntdll.dll" in (null)
0030:0034:trace:module:load_dll Found L"C:\\windows\\system32\\ntdll.dll" for L"ntdll.dll" at 00006FFFFFF40000, count=2
0030:0034:trace:module:build_module loaded L"\\??\\C:\\windows\\system32\\kernelbase.dll" 0000000000243670 00006FFFFFC10000
0030:0034:trace:loaddll:build_module Loaded L"C:\\windows\\system32\\kernelbase.dll" at 00006FFFFFC10000: builtin
0030:0034:trace:module:load_dll Loaded module L"\\??\\C:\\windows\\system32\\kernelbase.dll" at 00006FFFFFC10000
0030:0034:trace:module:load_dll looking for L"ntdll.dll" in (null)
0030:0034:trace:module:load_dll Found L"C:\\windows\\system32\\ntdll.dll" for L"ntdll.dll" at 00006FFFFFF40000, count=3
0030:0034:trace:module:build_module loaded L"\\??\\C:\\windows\\system32\\kernel32.dll" 00000000002433E0 00006FFFFFEC0000
0030:0034:trace:loaddll:build_module Loaded L"C:\\windows\\system32\\kernel32.dll" at 00006FFFFFEC0000: builtin
0030:0034:trace:module:load_dll Loaded module L"\\??\\C:\\windows\\system32\\kernel32.dll" at 00006FFFFFEC0000
0030:0034:trace:module:load_dll looking for L"advapi32.dll" in (null)
0030:0034:trace:module:get_load_order looking for L"C:\\windows\\system32\\advapi32.dll"
0030:0034:trace:module:get_load_order got hardcoded default for L"advapi32.dll"
0030:0034:trace:module:map_image_into_view mapping PE file L"\\??\\C:\\windows\\system32\\advapi32.dll" at 0x6fffffbb0000-0x6fffffbf2000
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .text at 0x6fffffbb1000 off 1000 size 25000 virt 24510 flags 60000060
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .data at 0x6fffffbd6000 off 26000 size 1000 virt 200 flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .rodata at 0x6fffffbd7000 off 27000 size 1000 virt e30 flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .rdata at 0x6fffffbd8000 off 28000 size 7000 virt 6480 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section /4 at 0x6fffffbdf000 off 2f000 size 1000 virt 360 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .pdata at 0x6fffffbe0000 off 30000 size 3000 virt 2cdc flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .xdata at 0x6fffffbe3000 off 33000 size 2000 virt 1f1c flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .bss at 0x6fffffbe5000 off 0 size 0 virt 19a0 flags c0000080
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .edata at 0x6fffffbe7000 off 35000 size 5000 virt 46cc flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .idata at 0x6fffffbec000 off 3a000 size 4000 virt 31dc flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .rsrc at 0x6fffffbf0000 off 3e000 size 1000 virt 3c8 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\advapi32.dll" section .reloc at 0x6fffffbf1000 off 3f000 size 1000 virt 164 flags 42000040
0030:0034:trace:module:map_image_into_view relocating L"\\??\\C:\\windows\\system32\\advapi32.dll" dynamic base 180000000 -> 6fffffbb0000 mapped at 0x6fffffbb0000
0030:0034:trace:module:load_dll looking for L"kernel32.dll" in (null)
0030:0034:trace:module:load_dll Found L"C:\\windows\\system32\\kernel32.dll" for L"kernel32.dll" at 00006FFFFFEC0000, count=2
0030:0034:trace:module:load_dll looking for L"kernelbase.dll" in (null)
0030:0034:trace:module:load_dll Found L"C:\\windows\\system32\\kernelbase.dll" for L"kernelbase.dll" at 00006FFFFFC10000, count=2
0030:0034:trace:module:load_dll looking for L"msvcrt.dll" in (null)
0030:0034:trace:module:get_load_order looking for L"C:\\windows\\system32\\msvcrt.dll"
0030:0034:trace:module:get_load_order got hardcoded default for L"msvcrt.dll"
0030:0034:trace:module:map_image_into_view mapping PE file L"\\??\\C:\\windows\\system32\\msvcrt.dll" at 0x6fffffb00000-0x6fffffb9b000
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .text at 0x6fffffb01000 off 1000 size 6d000 virt 6c4c0 flags 60000060
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .data at 0x6fffffb6e000 off 6e000 size 2000 virt 1840 flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .rodata at 0x6fffffb70000 off 70000 size 2000 virt 146c flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .rdata at 0x6fffffb72000 off 72000 size d000 virt c0a0 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section /4 at 0x6fffffb7f000 off 7f000 size 1000 virt 148 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .pdata at 0x6fffffb80000 off 80000 size 8000 virt 79bc flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .xdata at 0x6fffffb88000 off 88000 size 6000 virt 5224 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .bss at 0x6fffffb8e000 off 0 size 0 virt 1c60 flags c0000080
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .edata at 0x6fffffb90000 off 8e000 size 7000 virt 62f8 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .idata at 0x6fffffb97000 off 95000 size 2000 virt 195c flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .rsrc at 0x6fffffb99000 off 97000 size 1000 virt 398 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\msvcrt.dll" section .reloc at 0x6fffffb9a000 off 98000 size 1000 virt 220 flags 42000040
0030:0034:trace:module:map_image_into_view relocating L"\\??\\C:\\windows\\system32\\msvcrt.dll" dynamic base 180000000 -> 6fffffb00000 mapped at 0x6fffffb00000
0030:0034:trace:module:load_dll looking for L"kernel32.dll" in (null)
0030:0034:trace:module:load_dll Found L"C:\\windows\\system32\\kernel32.dll" for L"kernel32.dll" at 00006FFFFFEC0000, count=3
0030:0034:trace:module:load_dll looking for L"ntdll.dll" in (null)
0030:0034:trace:module:load_dll Found L"C:\\windows\\system32\\ntdll.dll" for L"ntdll.dll" at 00006FFFFFF40000, count=4
0030:0034:trace:module:build_module loaded L"\\??\\C:\\windows\\system32\\msvcrt.dll" 0000000000243AA0 00006FFFFFB00000
0030:0034:trace:loaddll:build_module Loaded L"C:\\windows\\system32\\msvcrt.dll" at 00006FFFFFB00000: builtin
0030:0034:trace:module:load_dll Loaded module L"\\??\\C:\\windows\\system32\\msvcrt.dll" at 00006FFFFFB00000
0030:0034:trace:module:load_dll looking for L"ntdll.dll" in (null)
0030:0034:trace:module:load_dll Found L"C:\\windows\\system32\\ntdll.dll" for L"ntdll.dll" at 00006FFFFFF40000, count=5
0030:0034:trace:module:load_dll looking for L"sechost.dll" in (null)
0030:0034:trace:module:get_load_order looking for L"C:\\windows\\system32\\sechost.dll"
0030:0034:trace:module:get_load_order got hardcoded default for L"sechost.dll"
0030:0034:trace:module:map_image_into_view mapping PE file L"\\??\\C:\\windows\\system32\\sechost.dll" at 0x6fffffac0000-0x6fffffaea000
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section .text at 0x6fffffac1000 off 1000 size 18000 virt 17240 flags 60000060
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section .data at 0x6fffffad9000 off 19000 size 1000 virt 190 flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section .rodata at 0x6fffffada000 off 1a000 size 1000 virt ef0 flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section .rdata at 0x6fffffadb000 off 1b000 size 4000 virt 3900 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section /4 at 0x6fffffadf000 off 1f000 size 1000 virt 978 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section .pdata at 0x6fffffae0000 off 20000 size 2000 virt 1410 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section .xdata at 0x6fffffae2000 off 22000 size 2000 virt 10a0 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section .bss at 0x6fffffae4000 off 0 size 0 virt 1a0 flags c0000080
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section .edata at 0x6fffffae5000 off 24000 size 2000 virt 1e58 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section .idata at 0x6fffffae7000 off 26000 size 2000 virt 13a8 flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\sechost.dll" section .reloc at 0x6fffffae9000 off 28000 size 1000 virt f0 flags 42000040
0030:0034:trace:module:map_image_into_view relocating L"\\??\\C:\\windows\\system32\\sechost.dll" dynamic base 180000000 -> 6fffffac0000 mapped at 0x6fffffac0000
0030:0034:trace:module:load_dll looking for L"kernel32.dll" in (null)
0030:0034:trace:module:load_dll Found L"C:\\windows\\system32\\kernel32.dll" for L"kernel32.dll" at 00006FFFFFEC0000, count=4
0030:0034:trace:module:load_dll looking for L"kernelbase.dll" in (null)
0030:0034:trace:module:load_dll Found L"C:\\windows\\system32\\kernelbase.dll" for L"kernelbase.dll" at 00006FFFFFC10000, count=3
0030:0034:trace:module:load_dll looking for L"ntdll.dll" in (null)
0030:0034:trace:module:load_dll Found L"C:\\windows\\system32\\ntdll.dll" for L"ntdll.dll" at 00006FFFFFF40000, count=6
0030:0034:trace:module:load_dll looking for L"ucrtbase.dll" in (null)
0030:0034:trace:module:get_load_order looking for L"C:\\windows\\system32\\ucrtbase.dll"
0030:0034:trace:module:get_load_order got hardcoded default for L"ucrtbase.dll"
0030:0034:trace:module:map_image_into_view mapping PE file L"\\??\\C:\\windows\\system32\\ucrtbase.dll" at 0x6fffff9e0000-0x6fffffaaa000
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ucrtbase.dll" section .text at 0x6fffff9e1000 off 1000 size 87000 virt 86480 flags 60000060
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ucrtbase.dll" section .data at 0x6fffffa68000 off 88000 size 2000 virt 1b50 flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ucrtbase.dll" section .rodata at 0x6fffffa6a000 off 8a000 size 4000 virt 3510 flags c0000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ucrtbase.dll" section .rdata at 0x6fffffa6e000 off 8e000 size 10000 virt f0d0 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ucrtbase.dll" section /4 at 0x6fffffa7e000 off 9e000 size 2000 virt 1638 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ucrtbase.dll" section .pdata at 0x6fffffa80000 off a0000 size d000 virt c774 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ucrtbase.dll" section .xdata at 0x6fffffa8d000 off ad000 size 8000 virt 77c0 flags 40000040
0030:0034:trace:module:map_image_into_view mapping L"\\??\\C:\\windows\\system32\\ucrtbase.dll" section .bss at 0x6fffffa95000 off 0 size 0 virt 20f0 flags c0000080
0030:0034:trace:module:map_image_into_view mapping L"\\??\