Record the first return address we see that didn't point into a loaded DLL -- later we'll add exemptions for non-system DLLs for DLL analysis

This will make it easier to correlate logged behavior back to binary disassembly